R3v3rs3e's Blog

Posts Tagged ‘shellcode’

Malicious domain uses old IE Vulnerability to download and install malware

Posted by Steve Espino on July 28, 2009

Visting the malicious url:

hxxp://zusojbktvo.cn/md/t.html

gives us a blank page at plain sight.

blank

However, upon careful inspection we are presented with the following:

code

Which translates to the following shellcode:

shellcode

Analyzing the shellcode basically leads us to the malware downloading

hxxp://pxciiruurw.cn/new/load.exe

which is saved and executed as:

c:\ 0xf9.exe

Microsoft already released a patch to resolve this vulnerability MS08-078

Posted in Vulnerabilities | Tagged: , , , , , , , , , | Leave a Comment »

 
Follow

Get every new post delivered to your Inbox.