topic Re: malware?? in General Topics

malware??

VSU_ITSEC — Tue, 23 Sep 2014 14:58:36 GMT

Dumb question perhaps, but why is www.googletagservices.com/tag/js/gpt.js being flagged as a malicious URL? It doesn't come up that way in PA's URL filtering site.

It's created a considerable jump in my botnet list.

Thanks in advance...

//moe

Re: malware??

HULK — Tue, 23 Sep 2014 15:01:56 GMT

Hello VSU_ITSEC,

Recently, There was a BUG identified for the same and The fix has been shipped with current PAN-DB version.

Thanks

Re: malware??

HULK — Tue, 23 Sep 2014 15:07:12 GMT

Hello VSU_ITSEC,

Could you please let us know what URL DB version running on your PAN firewall...?

Thanks

Re: malware??

VSU_ITSEC — Tue, 23 Sep 2014 15:20:23 GMT

6.0.3

Re: malware??

HULK — Tue, 23 Sep 2014 15:28:16 GMT

I hope 6.0.3 is the PAN OS version, but what is the URL DB version. You will get this information from GUI dashboard > General Information > URL Filtering version. OR from CLI > Show system Info ---

Thanks

Re: malware??

HULK — Tue, 23 Sep 2014 15:30:42 GMT

A good doc for your reference: How to Handle a URL Miscategorization

Thanks

Re: malware??

hshah — Tue, 23 Sep 2014 17:00:29 GMT

Hi VSU_ITSEC,

I just did PAN-DB URL Lookup and its classified as Comp&Inter.

Best match	googletagservices.com
Category	computer-and-internet-info

Can you please provide me output for "test url googletagservices.com".

Regards,

Hardik Shah

Re: malware??

VSU_ITSEC — Tue, 23 Sep 2014 17:19:46 GMT

URL

googletagservices.com

Re: malware??

hshah — Tue, 23 Sep 2014 17:36:04 GMT

Hi VSU,

Firewall is doing correct catagorization, hence its not issue of mis-categorization.

admin@93-PA-VM-200> test url-info-cloud googletagservices.com

BM:

googletagservices.com,9,5,search-engines

www.googletagservices.com/tag/js/gpt.js,1,5,search-engines

www.googletagservices.com,1,5,computer-and-internet-info

Can you put enlarged URL/Threat log here. That will help us to understand issue in detail.

Regards,

Hardik Shah

Re: malware??

hshah — Tue, 23 Sep 2014 17:39:38 GMT

Hi VSU,

Please find virustotal analysis, its not a malware.

https://www.virustotal.com/en/url/50ddccd826c769b904f0d115b89c71faaab91882ec50fbf76a791ee848c5c7d4/analysis/1411493884/

Hence provide us threat/URL log to confirm potential false positive.

Regards,

Hardik Shah

Re: malware??

VSU_ITSEC — Tue, 23 Sep 2014 17:41:25 GMT

from the CLI

@PA-5020-P(active)> test url www.googletagservices.com/tag/js/gpt.js

www.googletagservices.com/tag/js/gpt.js search-engines (Base db) expires in 0 seconds

www.googletagservices.com/tag/js/gpt.js search-engines (Cloud db)

i'll get the URL/threat log in a few...

Re: malware??

VSU_ITSEC — Tue, 23 Sep 2014 17:53:22 GMT

Re: malware??

HULK — Tue, 23 Sep 2014 17:58:20 GMT

Hello VSU_ITSEC,

It seems currently the PAN firewall is categorized properly. The above mentioned logs is for 09/22/14. As i said before, we had an issue with prior version and that has been fixed now. That is why, you don't have logs for current date ( 09/23/14-Block-URL).

Hope this helps.

Thanks

Re: malware??

hshah — Tue, 23 Sep 2014 18:23:50 GMT

HI VSU,

Thanks for providing URL Logs, its confirmed now that its yesterdays log.I agree with HULK. Today classification looks good. Let us know if issue still appears.

Regards,

Hardik Shah

Re: malware??

VSU_ITSEC — Thu, 25 Sep 2014 15:27:09 GMT

Have a new site in today's list with the same issue: g.symcd.com. This is new for us (so is the device); how often does this happen?

Re: malware??

HULK — Thu, 25 Sep 2014 15:33:03 GMT

What output you are getting for this new URL from ">test url " command ..?

Thanks

Re: malware??

hshah — Thu, 25 Sep 2014 17:20:12 GMT

For us its comp&Internet.

admin@85-PA-VM-300> test url-info-cloud g.symcd.com

BM:

symcd.com,9,5,computer-and-internet-info

Please provide us output for

test url-info-cloud g.symcd.com

show system info

Regards,

Hardik Shah

Re: malware??

VSU_ITSEC — Thu, 25 Sep 2014 21:38:34 GMT

@PA-5020-P(active)> test url g.symcd.com

g.symcd.com computer-and-internet-info (Base db) expires in 0 seconds

g.symcd.com computer-and-internet-info (Cloud db)

I see where you are going w/this…. So…

Am I to verify each entry on my botnet report prior to taking action?

Am I getting URL updates soon enough, an if not, where do I adjust?

Am I placing too much ‘faith’ in the botnet report?

From the botnet report:

confidence Virtual System description

4 vsys1 Repeatedly visited (42) the same malicious URL g.symcd.com/

4 vsys1 Repeatedly visited (441) the same malicious URL g.symcd.com/

4 vsys1 Repeatedly visited (65) the same malicious URL g.symcd.com/

4 vsys1 Repeatedly visited (59) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCK7KMAoI08AAGfwI84AAACi

4 vsys1 Repeatedly visited (40) the same malicious URL acuityplatform.com/Adserver/exds?xuid=8f02281c60d856473aab5158f5ac729c

4 vsys1 Repeatedly visited (123) the same malicious URL g.symcd.com/

4 vsys1 Repeatedly visited (190) the same malicious URL g.symcd.com/

4 vsys1 Repeatedly visited (63) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLtJMAoI0gAAHjWIP0AAABR

4 vsys1 Repeatedly visited (68) the same malicious URL g.symcd.com/

4 vsys1 Repeatedly visited (65) the same malicious URL acuityplatform.com/Adserver/exds?xuid=ef8c5c814844f7f359896d10d97045dd

4 vsys1 Repeatedly visited (100) the same malicious URL cache.dtmpub.com/js/ncg6/0/optinrt_0.js?cgver=36931

4 vsys1 Repeatedly visited (51) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLVhsAoI0YAACmlXH8AAACE

4 vsys1 Repeatedly visited (198) the same malicious URL g.symcd.com/MEkwR6ADAgEAMEAwPjA8MAkGBSsOAwIaBQAEFLG0OReQFreXeVAR8WC51KI82+3uBBQA+SrDQZG2ycK4PlXywJcRE6AHIAIDAjp2

4 vsys1 Repeatedly visited (39) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLTtsAoIz0AAAZPA.MAAACV

4 vsys1 Repeatedly visited (45) the same malicious URL cache.dtmpub.com/js/ncg6/0/optinrt_0.js?cgver=36931

4 vsys1 Repeatedly visited (73) the same malicious URL acuityplatform.com/Adserver/atds?getuserid=http://ums.adtechus.com/mapuser?providerid=1027;userid=$UID

4 vsys1 Repeatedly visited (157) the same malicious URL acuityplatform.com/Adserver/atds?getuserid=http://ums.adtechus.com/mapuser?providerid=1027;userid=$UID

4 vsys1 Repeatedly visited (47) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLeicAoI0YAAD4Vd2cAAAAD

4 vsys1 Repeatedly visited (121) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCMOwMAoI0oAAEKePowAAADV

4 vsys1 Repeatedly visited (45) the same malicious URL acuityplatform.com/Adserver/atds?getuserid=http://ums.adtechus.com/mapuser?providerid=1027;userid=$UID

4 vsys1 Repeatedly visited (36) the same malicious URL assets.tumblr.com/fonts/gibson/stylesheet.css?v=3

4 vsys1 Repeatedly visited (575) the same malicious URL g.symcd.com/

4 vsys1 Repeatedly visited (43) the same malicious URL acuityplatform.com/Adserver/exds?xuid=41ed950b4ac8a2da0effdb75f6b13fe2

4 vsys1 Repeatedly visited (45) the same malicious URL cache.dtmpub.com/js/ncg6/0/optinrt_0.js?cgver=36953

4 vsys1 Repeatedly visited (127) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLQicAoIzcAAIBXHTwAAAD7

4 vsys1 Repeatedly visited (133) the same malicious URL g.symcd.com/

4 vsys1 Repeatedly visited (107) the same malicious URL cache.dtmpub.com/js/ncg6/0/optinrt_0.js?cgver=36939

4 vsys1 Repeatedly visited (38) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLi5cAoI0oAAJ2eaAIAAAAD

4 vsys1 Repeatedly visited (150) the same malicious URL g.symcd.com/

4 vsys1 Repeatedly visited (38) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLwVMAoIzsAABrw-C0AAAE8

4 vsys1 Repeatedly visited (42) the same malicious URL cdn.mxpnl.com/libs/mixpanel-2.2.min.js

4 vsys1 Repeatedly visited (187) the same malicious URL g.symcd.com/

4 vsys1 Repeatedly visited (58) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCL9o8AoIzMAABBzJg0AAABO

4 vsys1 Repeatedly visited (51) the same malicious URL g.symcd.com/

4 vsys1 Repeatedly visited (85) the same malicious URL g.symcd.com/

4 vsys1 Repeatedly visited (54) the same malicious URL g.symcd.com/MEkwR6ADAgEAMEAwPjA8MAkGBSsOAwIaBQAEFLG0OReQFreXeVAR8WC51KI82+3uBBQA+SrDQZG2ycK4PlXywJcRE6AHIAIDAjp2

4 vsys1 Repeatedly visited (163) the same malicious URL acuityplatform.com/Adserver/atds?getuserid=http://ums.adtechus.com/mapuser?providerid=1027;userid=$UID

4 vsys1 Repeatedly visited (70) the same malicious URL ortc-ws6-useast1-s0003.realtime.co/

4 vsys1 Repeatedly visited (555) the same malicious URL g.symcd.com/MEkwR6ADAgEAMEAwPjA8MAkGBSsOAwIaBQAEFLG0OReQFreXeVAR8WC51KI82+3uBBQA+SrDQZG2ycK4PlXywJcRE6AHIAIDAjp2

Re: malware??

torm — Fri, 26 Sep 2014 08:05:17 GMT

I'm seeing the same behaviour in our botnet report. Mulitiple users repeatedly visiting supposedly malicious URLs. All URLs seem to be related to advertisement or cnd. Running pan-db 2014.09.25.451.

We have a open case with TAC regarding this. Will let you know how it goes.

Re: malware??

hshah — Fri, 26 Sep 2014 17:48:23 GMT

Hi VSU,

I just resolved one similar issue. follow bellow steps.

1. Download latest PAN-DB

2. Clear ur-cache googletagservices.com/tag/js/gpt.js

3. Now access, it will work.

regards,

HArdik Shah