0

Recently, while checking the windows application logs, I found that an application communicates with a certain website. The process starts and ends in about a minute. It does not appear in my search results. I have captured its details. It is acting suspiciously, but I am not sure about this.

Any help would be useful.

below image provides much detail on this

  • I also searched out this application on the system, it doesn't exist.Usually a malware such as a virus, or ransomware, or adware, or anything would exist as an executable file. There is nothing to analyse what this could be. What would you suggest? – Vikas Feb 5 at 9:49
  • The domain is no longer active when I try it. – schroeder Feb 5 at 12:52
  • also the js. extension in the beginning is usually used by javascript embedded in HTML sheets. but shouldn't .js come in the end? This looks confusing, but suspicious. – Vikas Feb 6 at 6:53
  • 1
    .js at the end of a file is just a helpful tag. Ultimately it means nothing. In a URL, the letters, likewise, mean nothing. The fact that the URL has the letters js means nothing, just as the letters 5b mean nothing. – schroeder Feb 6 at 9:55
2

This does not look legit at all. These are the points that indicate to me, that something fishy is going on:

  • MsiInstaller with some Russian HTTP-only-domain
  • The domain name is not meaningful.
  • The strange port 280 is used for HTTP.

I can think of no legit reason for this log entry.

I'm not familiar enough to prove it, but I'd consider your computer as compromised. I'd therefore recommend to reinstall it from scratch and change all passwords of services, you accessed with this computer. This procedure might be overkill, but as there is no way of telling what this software has been doing lately, you'd be on the safe side.

  • I doubted it from the beginning. Also, the process ran an installer at 4:37 am today morning. I usually begin work at 10:00 am (how can this happen). Even the anti-virus has not caught this one (running the most recently updated version). – Vikas Feb 5 at 9:31
  • Also, I run wireshark and analyse the connections, there haven't been much communications later on, which use the HTTP channel. – Vikas Feb 5 at 9:40
  • You might also want to upload the executable to something like virustotal and see, what different scanners think about it. Usually this will also help anti virus vendors to update their signatures. – Euphrasius von der Hummelwiese Feb 5 at 9:42
2

What you need to do is to get a copy of that file and send it to VirusTotal or some other analysis site for review. Just looking at a log is enough to ask questions, but not enough to answer those questions.

  • I ran a search in all the directories, there seems to be no such installed file. I also tried to open up these details using command prompt, nothing over there too. Also, I have been assigned standard user rights (which means that the admin would have to key in the password to install any file). But there haven't been any installations other than the automatic system updates from Microsoft. – Vikas Feb 6 at 7:30
  • You need to get a copy from the source, not your local machine. – schroeder Feb 6 at 9:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.