search

hasherezade / pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
https://hshrzd.wordpress.com/pe-sieve/
BSD 2-Clause "Simplified" License
3.01k stars 421 forks source link

False positives or something weird? #26

Closed jfariasf closed 4 years ago

jfariasf commented 5 years ago

I used the software with all the processes in my machine and got a lot of warnings, so either it's severely compromised by undetected malware or there are many false positives.

Example:

{ "pid" : 612, "main_image_path" : "C:\Windows\System32\svchost.exe", "scanned" : { "total" : 25, "skipped" : 0, "modified" : { "total" : 6, "hooked" : 6, "replaced" : 0, "detached" : 0, "implanted" : 0, "other" : 0 }, "errors" : 0 }, "scans" : [ { "code_scan" : { "module" : "7ffd51060000", "status" : 1, "patches" : 59 } }, { "code_scan" : { "module" : "7ffd4d4b0000", "status" : 1, "patches" : 11 } }, { "code_scan" : { "module" : "7ffd50320000", "status" : 1, "patches" : 4 } }, { "code_scan" : { "module" : "7ffd4e4d0000", "status" : 1, "patches" : 58 } }, { "code_scan" : { "module" : "7ffd50250000", "status" : 1, "patches" : 9 } }, { "code_scan" : { "module" : "7ffd4d3e0000", "status" : 1, "patches" : 3 } } ] }

Although... 1 file got detected, so maybe nothing or double false positive? https://www.virustotal.com/#/file-analysis/MGRiNGZlOWU0ZWVjNjM5MjliZDVhY2Q3OGRiMjY2ZjE6MTU0Nzg3MDQ5OQ==

Attaching 1 of the many many processes with warnings.

process_612.zip

jfariasf commented 5 years ago

And I don't even know what these .shc files are:

shc.zip

hasherezade commented 5 years ago

hi!

  1. First of all, are you using the latest PE-sieve (0.1.6)? If not, can you please update it to the latest release and scan it once again?
  2. I see those DLLs are hooked. There are many reasons for DLLs being hooked, not all of them are malicious. PE-sieve detects the presence of a hook, but it is not meant to make a judgment if the hook is malicious or not. Read more about it on wiki. If you have an antivirus installed, it is very likely that it modifies memory of the processes in some way or the other - so, all those modifications are going to be detected by PE-sieve.
  3. If you download the version 0.1.6, it will print more information about where the hook leads to. Please drop me the reports and I will tell you more about interpreting them. From what I see for now, probably your hooks are non-malicious.