Recent Posts
Recent Comments
Link
- 01.Sec.Exploit_milw0rm.com
- 02.FT_moneta.co.kr
- 01.Sec.INfo_KrCERT/CC 보안공지
- 01.Sec.Portal_securityfocus.co…
- 01.Sec.Portal_packetstormsecur…
- 02.FT_삼성경제연구소
- 01.Sec.Virus_Search_virustotal…
- 01.Sec.Tool_foundstone.com
- 01.Sec.Search.attack.IP_myNetW…
- 01.Sec.Search.attack.IP_DShiel…
- 00.Sec.Refer_FIRST.Newsroom
- 00.Sec.Refer_Security.NNOV
- 00.Sec.Refer_OWASP
- 00.Sec.Refer_HITBSecConf
- 00.Sec.Refer_Metasploiit
- 00.Sec.Refer_Xcon
- 00.Sec.Refer_Shmoo
- 00.Sec.Refer_대학CERT연합
- 00.Sec.Refer_Packetstorm
- 01.Sec.Virus_bot.INfo_shadowse…
- 01.Sec.INfo_NCSC_사고사례.기타
- 02.FT_매경.시티라이프
- 03.Etc_Google.Translate.Url
- 03.Etc_Naver.japan.translate.u…
- 01.Sec.Tool_check.ip.info
- 01.Sec.Virus_ahnlab.online.cur…
- 02.FT_다음.아고라
- 02.FT_다음.오로지
- 01.Sec.INfo_KISA_연구보고서
- 02.FT_다음.세일러
- 02.FT_다음.양원석
- 02.FT_한토마.김태동.글모음
- 02.FT_한토마.경제.재테크
- 02.FT_다음.아고라.즐겨찾기
- 01.Sec.Virus_search.malwareURL
- 01.Sec.Virus_anal.script_wepaw…
- 01.Sec.Virus_anal.binary_anubi…
- 03.ETC_고도원의 아침편지
- 02.FT_세이노
- 03.Etc_MyCityLife
- 03.Etc_구본형
- 03.Etc_동국대.논문검색
- 00.Sec.MS_Update
- 01.Sec.INfo_KISA 안전진단
www.ManiaLab.com
[Analysis] some suspicious files 본문
# Analysis Encoded Script, HaiDong, 100917
// script.js
Suspicious URL is encoded by URL Encoding method, The result of decode is like below..
// www.openovation.co.kr/images/xxx.jpg
This use ms10-018
So, decode the payload > you will see hxxp://www.ticket365.co.kr/filedata/xxx/xxx.exe
k.exe is Win-Trojan/Agent in V3
thanks
'1.Sec_Vulnerability' Related Articles
more
Comments