6.pdf

0:00I received this email. It says, "Hello, Mr. Hammond. Hi, you can call me John. While searching for the remote tool anyes, I came across a link that redirected me to any disk.inc." Part of me wonders if that was like a Google malvertising like an ad that's placed higher in like a sponsored result while trying to search for Google search for

0:18something. The page displays only a single button that immediately starts a file download. For your review, I've attached the website link below. Would appreciate your analysis and any guidance. So, if we go visit the page that they linked any disk.inc inc is just a blank page, just a homepage. It's all white. There's literally no contents there. But any dink, sorry, any.inc/d

0:38download/esk.html brings you to this page, which looks hysterical, if I may say. Uh, it looks pretty awful. The black text on a gray background doesn't really just have the right contrast that you need for what looks like a cloud flare turn style, like the verify you're human. Oh, click the submit button to say you're not a

0:59bot. And our knee-jerk reaction might say this looks like clickfix. This looks like the verify you're human. I'm not a robot checkbox. That normally now has led to some malware and social engineering lures. My bad. Sorry. But if I were to click the button for verify you are human, this actually does something interesting. It prompts do you

1:18want to open Windows Explorer? Verification. wants to open this application. And that is not the usual clickfix setup. So, this has some other cool components to it. Before we fall down that rabbit hole, I do want to look at the page source here because this is another awesome funny thing that I thought you might like. You can see the title of

1:37this is encoded page and the actual HTML contents are practically nothing. It just says loading and then there's a lot of JavaScript that handles the actual rendering of what's displayed to you. Let me paste this into a text editor so we could get an idea for what it really looks like with syntax highlighting. Obviously, there is a giant B 64 blob at

1:57the very top of the file and that is probably the contents of the page as it is decoded or decrypted, whatever we want to call that. With these functions below, we have a convenience function that's basically just running at OB or the JavaScript equivalent to B 64 decode variable or parameter that's passed in. And it looks like that is only used once

2:18down there. So, we could basically just call that at o and we don't need to care about that function. The other one looks like it's doing some exor operations. You can see the carrot symbol for the exor operator and actually using the modulus or the percent sign as it wraps or loops through the material of a given

2:35key which is probably that actually looking for the occurrences of that variable. It's never even actually used. So that one doesn't matter and I was wrong. If we look back, the call that runs getting the page content using this decrypt or exor routine is actually using the e back variable. Things I never thought I'd say in a YouTube

2:56video. So, what we could do to unravel this to even just see the actual source code letting the JavaScript do its thing, we could just grab these variables and the function that it will use. And while we could get back on the web page and try to right-click or inspect to see this all in the HTML sort

3:12of interactive element section here, this is neat, but we could also dump that the same way that they do when they actually kind of let the code unravel itself. So when we see them add this event listener for the DOM content loaded or the page is ready, because they decode the base 64 and then use the exor operation, we could just retrieve

3:31the page content variable on its own. Let's paste those in. And now we'll have page content for us to work with. There's all the material. Let's display that out. Let me use console log and then display inside the parentheses that page content. That will display in an easy way for us to copy and paste and look inside of our text editor. Pasting

3:51all that in. Now, obviously this is HTML, but there are some interesting things here. We get the HTML structure and CSS or cascading stylesheets to sort of design and look like a regular CloudFlare turn style with a secure access verification and all the Cloudflare links. But the JavaScript down below is actually where this gets a little bit more interesting. They have a

4:11redirect helper. They have a browser detection capability and then the check and redirect which even will force you in to a specific browser whether or not you're using Chrome or Microsoft Edge. they get a fake Cloudflare ray ID or the unique sort of verification ID thing. And that's actually kind of neat because now that we know that that is JavaScript

4:31rendered, we could refresh the page. Let me run it one more time. Refresh the page again. Down below, you can see that ray ID is changing. Refresh the page again. Obviously, that's because that's dynamically determined to look random by JavaScript. But let's get to the real neat code here. Once the check box is clicked, it redirects or doesn't even

4:52use the redirect function that it made. Okay. Uh just window.location.href setting to verification.nedisk.inc to recapture v2.php. Now, here's the thing. We could copy this. We could go to this page and if I navigated to that in the browser up here, that will pop open the Windows Explorer prompt to oh,

5:13open something like in your file explorer. That's the functionality of that page. Like if I were to open up the network tab, even in our browser developer tools, whenever I were to click that button, you can see it brings us to recapture v2.php. But take a look here. That's actually making a 302 redirect or an HTTP status

5:32code to send you to a different location. Of course, just as we saw in the code, what that redirects you to though in the location header is this thing. We can copy that value because we will want to take a look at it. But obviously if we saw in our network traffic trying to go to that location

5:48that request URL is the exact same thing. So back in our text editor again just cuz I want to take a look at this. This is actually one of the Microsoft Windows different protocol handlers. Like when you're used to going to http colon sl something or even if you were to interact with a normal file you could

6:07use file slash something. Now, there are a lot of these FTP, whatever, SMB, blah, blah, blah. But you also have other opportunities in Windows to do or invoke something else with another protocol handler. We've covered these in a couple other videos, but I'll add some links in the video description if you're interested. These are Atom or Hexacorn

6:26on his blog. A whole lot of the cool opportunities when you add a colon just following some other sort of prefix again like file http as I was referring to. and we could probably see search- and those as those potential opportunities. Now, I'm inside of a Windows 11 virtual machine and if I were to open up the file explorer, whenever

6:47you run a search like that search bar at the very top right of the window, that's basically what you're doing. If I search for CVE, okay, we see some nonsense there. But if I were to click enter in on this, it'll bring us to a search results page. But if I go to the very beginning, it's that exact same protocol

7:04handler using search-ms with a display name for what it shows in the title bar, crumb for a location of what you're actually searching for, etc. So the neat thing here is that they were actually using that feature search MS with a display name to look for search access percent 20 results percent 20 in blah blah blah with a crumb location being

7:27set to percent 5C percent 5C secure view.incsl percent 5c sec secure access. Now, some of you might clearly be able to see that is a URL encoded. When we have the percent signs and then two values that follow like decimal, but actually hexadimal because you can see a letter C

7:48in one of those, that's base 16, not base 10 like we're used to counting 0 through 9, but 0 through 9 and then A through F. So, quick and easy, we can URL decode that to see what those characters are. There are some command line tools that can do that pretty easily, but honestly, we'll just keep it

8:02super simple and let's use Cybersh. So let me look for URL decode and then now that will be decoded. Let's look at that new value and okay here you can see back slashbackslash to secure view.nisk.incsl. So the back slashbackslash clues us in that this is a network location like an SMB share like a file share you might be

8:24used to I don't know maybe a corporate office environment where you oh access the network file drive mounted to like your X drive or your Z drive or whatever. But all that really is is just a back slashback/n network location. Those can be totally open out on the internet. It's just like a web server essentially serving HTTP, but this was

8:44serving SMB. And a funny thing here, I think they missed a percent sign because you could barely see it. There is one dangling leftover 5C character that was missing the percent sign. Obviously, this is all URL encoded because it came through your web browser as you were interacting with that any.inc. inc page. But if we were to try to go to this

9:06location, just as we had inside of file explorer, if this were invoked as the website and the lore intended us to, well, uh, it's down right now. Got to be honest. Hey, this thing probably lived and died for a few days. Now it's offline. Obviously, the neis.inc website was still up. We got to play with it, but this portion or segment of the

9:25attack chain offline. But I did get a chance to save a copy of what was stored and shared on that network drive while this malware was live. Hey, super quick. Before we go any further, please let me take just a few moments to tell you about the sponsor of today's video. Let's be honest, passwords are still a

9:41mess. Forgotten login, weak credential reuse, reset tickets clogging up the help desk. It's a nightmare and attackers know it. That's why I'm a fan of Spec Ops Software. They take password security from reactive to proactive with their breached password protection. You're blocking over 4 billion compromised passwords updated daily from

10:03real world leaks, live attacks, and even malware botn nets. And it's not just password resets. Spec Ops actively scans your Active Directory environment and flags compromised passwords the same day they show up in the wild. You can even build custom block lists so users can't set passwords with your company name, project code names, or that one sports

10:25team that everyone's obsessed with in the office. And for the end users, they get dynamic feedback that helps them choose strong passwords that meet policy without the guessing game. Fewer bad passwords, fewer help desk tickets. Throw in self-service password reset and built-in multiffactor authentication and suddenly passwords aren't your weakest

10:46link anymore. They're just one more thing. You've locked down smart. Check out Spec Ops software and get started with my link below in the video description. jh.live/spec ops. Huge thanks to Spec Ops for sponsoring this video. So, if you were to fall for this, if you were to follow through, click the button to verify you're human, and then open Windows

11:08Explorer, you would be presented in that search pane with this network share with a readme any PDF file presented to you. But you might notice this little arrow icon and symbol in the bottom left of the icon clues us in that that's not really a PDF. That's actually a Windows shortcut file or LNK that can point to

11:29something else. and realistically run computer code. Now, because that's a Windows shortcut, I'm actually going to hop over to my Kali Linux virtual machine. Really, I should be using like Remnucks, a better distribution for actually looking at malware and stuff, but any Linux distribution, if just so while I'm handling these weird sketchy malware files, I don't ever accidentally

11:50detonate or execute or run this malware on a system that would handle and execute that code. So, let me open up Sublime Text just as I have with the text editor previously and let me show you what the payload was that was ran by that. LNK file. Now, this is all batch script or like Windows commands that

12:08could be run from cmd.exe or the command prompt. And we have a couple neat things to take apart here. So, this is using comspec or the environment variable that points to cmd.exe. Quick aside, let me pop back over to my Windows VM just so I could show you that if I were to open up the command prompt, obviously trying to

12:26echo out a variable like comspec, you can see that that one already has the value of the absolute path C col32 cmd.exe. You could see all of the environment variables with set as the command with no other arguments. And that will give you a ton of the other stuff that's present here. Obviously, at the very top, comspec being listed as

12:45that. So that means they're basically running cmd.exe/k with an argument to mean okay we're going to run other commands here that are provided as a string. So this double quote and the very ending trailing double quote basically are just the second payload or really subsequent stage that's now executed. So we start a

13:06new process MS Edge or Microsoft Edge your web browser at least installed by default on Windows. And that's interesting. It takes us to the real actual legitimate NESK download. Anyes.com/en/d download/windows latest obviously is going to pull down that binary for the

13:27real anyes installer just to make it look like oh you're not falling for a trick a scam malware in this case but if you were to be none the wiser and oblivious you did download any at the end of this. Now the amperand acts as another like command separator. So we have one command that follows where we're using curl curl tac s lowercase

13:48for silent tac capital l to follow redirects in case this were to bring us anywhere else and then tac o to denote okay we will output a file here we'll have a destination where we save the contents and it uses more environment variables for batch wrapped in those percent signs for the temporary directory based off of your computer

14:08name trailing percent sign there with six pdf That would be the eventual file name noting your actual devices host name. But that's the output file. Keep in mind that is just where the response from the website is going to be saved. So the actual website that we go to, this is kind of neat. I think you might

14:27like this. It goes to https percentername percent 6.1.store/update/6.pdf. Do you see what they're doing there? The real domain for this website that they're going to is chat1.store, but they have uh percent computer name

14:48percent 6 in there. So, would they have a domain that's set up for your victim host name? How is that possible? Would they know that? Uh there's no way they could tell where this lands or how this runs and infects on a victim computer. Well, no. This is kind of clever. I think they use the environment variable

15:08here for your computer name as a subdomain. And a subdomain could respond to anything. You don't have to have a static strict defined and explicit subdomain. You could make that a variable. It could be super dynamic. So, in a way, they have only reached one domain because chat one.store is the

15:28actual website they're going to. But now they're exfiltrating and leaking and getting to know what your computer name or host name is so they can keep track of, oh, that that IDed victim and target has now been compromised by including it as a subdomain that they can still capture and keep track of. Neat. Anyway, that is the download that they run from

15:49that site. And let me see, is chat one store still alive? Let's get back to tour just so we uh are not giving anything away for our IP address and all. H nope. What if we were to add a fake little lol fake hostn name six or six dot and I do want to do http here. Is that still alive? Ooh, cloudflare

16:10response but no content there. Anything that might be like similar to the other one where um that has something only at that endpoint and not at the homepage. So let's go to our lol6.1.store at upupdate6.pdf. I'm sketched now. How's that rendering as a real PDF? Yeah, failed to load.

16:31Okay, let's try anything. Chat one store update PDF. Still trying. Obviously, this 6. PDF is not a real PDF because the following command, the subsequent again amperand to add something new. They use MSI exec or one of those living off the land binaries to be able to run and execute further code with an MSI

16:52package. One of those Microsoft installers. They use slash I as the argument to install with the actual file name that they saved this at. Remember that's our output argument for the curl command to download tac qn for very quiet and I think n is also no restart. We could look at lbins if we wanted to. But then they pipe to another command

17:13which is also clever because that means the output of MSI exec will be piped into task kill following that which means it's still going to execute this after MSI exec were to finish or succeed and task kill is going to force killing a process based off an image name cmd.exe which if you remember is where we started with if we bring this all the

17:34way back comspec was realistically cmd.exe exe. So now they're just covering their tracks. But that meant the very end of this little stager was to pull down and install a 6pdf or whatever your host name would have been. We're just going to call it 6. PDF knowing that it's not an actual PDF. So let me move into an any directory here

17:56for us. And I do have the original saved uh when I got to kind of explore and experiment with this the first time. Part of me wonders if there is a different payload up since that portion of the attack chain is again still online. Let's curl it down kind of the same way that they did. Follow redirects. Save an output directory.

18:13We'll call this other 6. PDF based off of a fake computer name again. We can use uh please subscribe just so the thread actors know that they're in a YouTube video. Will it pull it down? Okay. Seemed like it did. No. Did it not? Don't follow redirects. Just tell me everything you're doing. Anything. taking a while to download. Big file.

18:34Oh, yeah. It's still going. Okay. Oh, the other one was like, how many megs is that? Let me run that with attack H for human. Oh, all right. We got a little bit of time to kill. And this is totally just like a 5minute adventure because I want to see if it's the same hash. Are they giving us a different binary or is

18:50there a different payload now at this part? Okay, so this is taking a lot more time than it needed to. And I'm pretty sure the download kind of just got sniped because time is passing and we are no longer getting any data back. When I try to go look at the page on a browser again, uh, I no longer have

19:06that. Maybe they didn't like the please subscribe joke. Let's just reconnect with a tour edge and try to get that one more time. How about this? Okay, I didn't need to burn all that time, but now we do at least have a another Nerf file that we could use that is much bigger. 17 megs. And I'm curious, is

19:29that still an MSI? Yeah, it might just be bloated a little bit more because the original looks like the very almost same structure here. I guess different metadata barely. Number of pages 200, number of words 12. We see all that the very same. Oh, but wait, look. This is a keypass installer and this one was a

19:51docuign edit document. Well, for the sake of this video, not taking eons. Let me hone in on one. Let me remove the the very very latest and I'll leave that as an exercise for the reader if anyone wanted to follow along and play. But let's keep working with our OG original from last time I got to pull this thing

20:08down. 6. PDF. Now, knowing that this is an MSI installer, realistically that's an archive, like that's essentially a bundled up archive of files. So, we could use something like sevenzip to extract that out. There are other MSI utilities and tools you could get. I think MSI info is one that's from some

20:29package, MSI tools perhaps, like can you tell me the summary of the info? Uh, while we're looking at MSI info here and we could extract things out if we wanted to pull out binaries. Let me MSI info extract. Oh, we need to know the specific streams. Can we get these streams? Yeah. So, we could list those out just as well before using like 7z to

20:51extract it all. 6. PDF tells us we have a custom action DL, a wrapped setup program, and some summary information and document summary information. So, let's get those just to see what they are. I don't think that pulled anything out. Can I do the document summary information? Pretty please. No. How about the custom action DL that one? Oh

21:11yeah. Okay, that adds stuff. And let's do the very same when we look at the streams. I just want to be able to get now the wrapped setup program. So let's extract that one. And that is a binary ls. What do I have here? One executable, a DL, and a cabinet file. Oo. Now, gentle reminder, the reason why I'm

21:33doing this and walking through these steps within Kali Linux to try and carve out or extract the executables or files inside of the fake PDF and MSI file is so that I don't have to install it or run MSI exec and therefore infect myself. This is just how we can carve all this out and having the portable

21:53executable uh DLL and the setup program as a CAB file. Actually, what I want to do is just make a directory for like extracted. And then let me move the custom DL and the wrap setup program in there just so I can show you. We could just as easily extract all of this with sevenzip. As I mentioned, we can use 7zx

22:14to extract 6.pdf and that will just dump out everything that was in there. Granted, there's a lot more stuff. Some of the different things that may or may not be helpful to you because a lot of it could just be boilerplate MSI packaged file things. Like if I try to look at the string data, I think that

22:34was one that was able to pull out. There is this stuff, but again, I don't know if that's immediately helpful for you. Some of these clue us in Okay, it's probably built with Wix, which I think is one of those package builders, MSI file creators. And really, a lot of this is overwhelming. We could use Sublime Text to try and like click into any of

22:52these and make that easy for us, but not all of them will be super duper valuable for us. So, I really like to just try and carve it out with MSI info and the command line tools that we used already rather than trying to dump all of this out. Even though we will get the binary.bz custom action DL and wrap setup program.

23:13As you can see here, obviously Sublime Text, we're just looking at bytes. So that's not helpful. But another option and alternative for you. Let's get to that clean extracted directory where we had those two files. The custom action.dll is actually a like full natural native PE32 executable. It's not like a net assembly or something we

23:35could crack open with DNS spy or spy or peak. So, we would need to crack open a real disassembler and debugger like Gedra or IDA or binary ninja, whatever you really want. I'll admit that might be jumping off the cliff for this video, but we will do some dynamic analysis in just a moment. Otherwise, let's take a

23:54look at our wrapped setup program. Now, this is a Microsoft cabinet archive file or a cab file. That means it could also include a couple other subcomponents like 1.js, JS, which you might not be able to see, and ls26.exe. So, we could pull those out with the cab extract utility, and that will work pretty well for us on our wrap setup

24:16program. Now, that will pull out 1.js and ls26.exe. Easy peasy. Let's take a look at what we have here. Okay, 1.js is pretty small and simple, and that's probably going to be human readable. LS26.exe is 77 megabytes. Granted, a lot of that is probably bloat. That is another hardcore

24:37actual real portable executable, not a net assembly. That's nice and easy for us. Once again, you'd have to do the legit reverse engineering. Let me go take a look at 1.js though, just so we know what that is. Ooh. Okay. So, this is JS, not JavaScript. I know that's kind of something that I a hill that I

24:55will die on because this is natural and native code that will run on Windows by default. It has that handler set up to run CScript or WScript.exe and it could access and open ActiveX objects or WScript shell objects which allow you to potentially work with the file system, do more damage and run code, etc. So,

25:16what this looks like it's doing is just looking through the temporary directory as it has extracted that out or expanded the environment variable string like we've seen before. Sleeping for 5 seconds just to wait a little bit of time. That's in milliseconds here. and then getting a file system object so that it could retrieve the folder of the

25:35temporary directory and then loop through all the files inside of it. And then there's a little convenience function down here to delete files and everything else in the subdirectories that is all coming from our temporary directory. So probably just like a simple cleanup script, right? Oh, trying to remove any traces stuff that might have been left in temp much like the

25:56stager for this malware payload to begin with. So consider it cleanup. The question is how does this get ran? I'm not positive if MSI and executing MSI exec would run that cuz I don't know the order of all of these things. Please do genuinely school me. I'd love to know a little bit more of that MSI unpacking

26:13unraveling and analysis. But let's go take a look at what our LS26.exe might be along with our wrap DL. So now I have moved both of these into a Windows virtual machine. And our LS26 program has the Microsoft Edge icon, which is kind of funny. I do want to look at the properties here. The description is a Microsoft Edge PWA or

26:35portable web app launcher. Security info and details, though. I'm not thinking it is actually assigned Microsoft executable. It's It's not There is no signature here, but at least they filled out all the file version, metadata, product name, info, stuff to be able to make that, you know, somewhat believable. Let's take a look at our custom action.dll. That one missed the

26:57mark. Totally failed filling out the metadata. That would have been helpful. Now, I did bring us into Windows because I did want to show you something. I'll admit I don't think we're going to just fall down the rabbit hole to do a lot of the hardcore reverse engineering, cracking open IDA, Gedra, Binary Ninja, or whatever uh to rip apart what these

27:14files are. So, we'll do some dynamic analysis, but I at least wanted to run these through detected easy because that will probably help us understand and see what at least these are packed with considering ls26.exe is like a bloated 707 megabyte file. So, could this tell us a little bit about our custom action dl? Opening that up.

27:35H, nothing fancy here. We'll explore that in a dynamic sandbox. I'll use any run in just a moment, but normal sane file size, I think. Let's go take a look at ls26.exe. Oh, chugging along through potential PI installer maybe. All right, Detected Easy is still chug chug chugging along. DBLO I do have ready for us. I just made

27:56a copy of the LS26 binary just in case. Detected easy had whatever handles on it and stuff. So, let me see if this can carve anything out. I don't know and I don't want to be wrong. Okay. File was reduced 98.5%. It comes in clutch. single repeated bite and overlay. You know what? We probably if we looked we could have we would have

28:16seen it. All right. Can I open two instances of detected easy now just cuz I want to see if this one can just rip through our L26 copy patch and that has a UAC icon on it. That's a little bit faster than the other one. Yeah. Yeah. Yeah. Yeah. Okay. Here it is. This is really what I wanted to show you. This

28:35uses a protector. This uses the private exe protector. Huristic kind of signature tracking. There's a packer compressed pack data imports like UPX with a strange overlay high injury section. So this being 10 megs a heck of a lot better than the 707. If I put this on the desktop, we'll make it Windows 11. We'll amp this up. I think this will

28:57run. I don't know cuz the DL really depends on the entry points of all this, right? And it may very well be trying to execute what could be included in the rest of the cabinet file or the MSI. And yeah, that just died immediately. So it might need the whole rest of this. You know what? Why don't we actually take a

29:15step back? Why don't we do this from the entire six PDF or it would have been the MSI file. So that includes everything, right? This is what appeared alongside a valid, legitimate, and genuine anyes install. So if I extract this, I set a

29:35password on it and then we might even be able to see at least what this thing looks like. Password was infected as it usually is for malware samples. So this has a nerf file extension because that's what I tend to add on there. And I know this is pretty tough to see inside of any run. Can I full screen this? Not

29:54that that's going to give me any better view. That just looks more JPEG. Look, docuignedit. I don't know if you can see that at all, but MSI Exec is now running. What else we got going on? SR tasks. System restore tasks. Oh, it's creating. Oh, it's inhibiting system restore. Okay. Yeah, so we can no longer create system restore point. Can I rerun

30:13that? Pretty please. Maybe I just didn't give it enough time. Okay. So, right now I've uploaded just the MSI file and you can see that it's trying to configure docuignedit, which is what we were tracking previously. MSI Exec runs and that should end up Oh, you can see it expands the CAB files and LSA26.exe is running. Quiet/Q quiet. Are there any

30:36other connections that are being made from any of the processes ls26.exe or any of the others? Not yet. Oh, there it is. Metaste HTTP activity observed. And that was then determined to be metastaler. process creates files with names similar to system file name. Starts a Microsoft application. It ran

30:58it used winver computer defaults.exe. Oh, they use that to bypass user account control. Neat. Did they do that based off of for probably a dropped file like written fontost.exe. Then they use WScript to execute the 1.js that we were looking at earlier just as we expected. Yep. uses the sleep, deletes the script, accesses environment variables, and now

31:20font host is the one that is probably the what it has dropped and is now going to be communicating as metastaler. H you track down the config or anything. And we say metastaler because this is pulling out a lot of the different profiles from your web browser trying to extract out different credentials, maybe

31:40cookies or anything that would have been present there. Actions stealing of personal data. Yeah. Okay, so all the browsers that were there and add its path to the Windows Defender exclusion list so it can run without any guardrails and yeah modifies defender. Neat, funny, interesting. So look at the end of the day this is commodity

32:01malware. This is just metastaler again as we have seen plenty of times before. But I think the buildup some of the attack chain had some kind of neat cool interesting parts right and what I wanted to show you especially with the detected easy was this pep or pep ghitub repository for the private exe protector I guess there's a website private-exe

32:23proctor.com and this is a old old old it looks like capability to encrypt obuscate protect hide and tuck away what the actual program does. This is written in like Delelfy. Look at the uh languages that are noted here. Pascal, whatever you say, 92% assembly 7.7. So,

32:48that would be pretty hardcore to uh reverse engineer. If anyone wants to sit through that torture, you're more than welcome to, but I don't think we need to for a YouTube video. Now, this is just kind of a cool fun fact. Um, but this is one that I thought was just neat, and I was able to share it with Huntress uh

33:04work. So, I walked through kind of the same similar stuff that I have here with you in the video. And then I was just talking about, look, these are now compiled binaries and I got to run. I got to go do meetings and call. I'm a busy guy. No one believes me. And a couple good friends and teammates were

33:21willing to tag in kind of where I left off. And Alden, I think, was the one that tracked it down and saw it in Detected Easy that that is the private protector uh obfuscating packer there. Presumably the custom action DL would do some dynamic DL resolution which I don't think MSI boiler plate like MSI installers just naturally do and then

33:40we're just thinking oh hey you know it's it's metastaler again. Uh there was cool little C2 though I guess that's new for what some of the callback domains were and then Alden schooled me of like yeah detected easy just like tracked it down pretty easy for the protector. So honestly I thought this was really cool because this is probably one of the

33:58first times we're kind of able to make this a little bit of a double whammy. Right. Hey, we got a YouTube video out and about to showcase it. And we actually were able to get this into a Huntress blog. So, chatting a little bit about that ClickFix lore, the beginning, the start of this, how this kind of

34:11unfolded. Kind of neat. That was just a sweet story. Something cool to tell. And we walked through the same screenshots and explanation as everything that we've done here in this video. But, uh, cool to be able to, hey, get a little two birds, one stone kind of thing for this. And that got a little bit of PR. Hey,

34:26you know, public relations, some news, news articles out and about. Sweet to be able to see that. shared uh and tell the story a little bit more in a broader audience. So sweet. All good things. Hey, that's it for this video. Thanks so much for sticking with me. I know this was a little bit of a long one. You

34:39know, I tend to ramble, but it's just so much fun. It's so cool. It's uh I enjoy getting a chance to dig into some of this and learn a little bit more as we all go through it. So, thank you so much for watching. Thank you for tuning in, doing all those YouTube algorithm things. Please, pretty please click that

34:53like button, subscribe, leave a comment, blah blah blah, and do give some love to our sponsors. All right, I'll see you in the next video. I don't know how to do outros anymore. You can end the video.