Re: This is a VIRUS - how does it works?

From	Stefan Weiss <krewecherl@gmail.com>
Newsgroups	comp.lang.javascript
Subject	Re: This is a VIRUS - how does it works?
Date	2017-04-04 02:51 +0200
Organization	albasani.net
Message-ID	<obuqma$99a$1@news.albasani.net> (permalink)
References	<qtupdcda9p594dvj6aos78nhg4kp2b493f@4ax.com> <obpbrk$d0i$1@news.albasani.net> <fri2ecpnjnc6u3ofkhlav1pl5h5ndig6es@4ax.com> <obs71f$d2k$1@news.albasani.net> <hri5ecd31mfgr06l7t09efvjhf1i6kmuju@4ax.com>

Show all headers | View raw

a wrote:
> now the focus is on what the .exe file
> executed in the fifth to last row of the posted code
> executeFile(exePath);
> could have done...
> 
> it will take me several days to try to discover it,
> but I'll be back 
> 
> Note:
> in the meanwhile
> I copy/pasted/launched 
> in my Firefox browser 
> the "bbb.png" url
> but I received an error, here it is:
> 404 - View not found [name, type, prefix]: category, png, contentView

You're right, they actually did remove it. That's great!

But who am I to stand in the way of dangerously reckless experiments...
Here's a copy:

  http://foo.at/paste/2017/bbb.png.bin

Just to be perfectly clear: this is a Windows executable file, very likely
containing malware. In addition, you only have my word that this is the same
file your .jse originally downloaded. It could be anything. You're about to
execute code a random stranger posted on the Internet. Good luck :)

I will be removing this file in the next day or two. Seems a little
hypocritical to send a dire warning mail to the webmaster of the original
server, and then host the file myself.

Now that we're done with the JS part of this little mystery, there are other
groups better suited for discussions about IT security and reverse engineering.

- stefan

Thread

This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 14:37 +0200
  Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 14:43 +0200
    Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-30 18:32 +0200
  Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-30 18:31 +0200
    Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 21:22 +0200
      Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-03-30 23:20 +0200
        Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-31 14:00 +0200
          Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-03-31 17:26 +0200
            Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-01 22:00 +0200
              Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-01 22:11 +0200
                Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-02 21:02 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-02 22:50 +0200
                Re: This is a VIRUS - how does it works? a <a@inwind.it> - 2017-04-03 23:18 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-03 23:22 +0200
                Re: This is a VIRUS - how does it works? Tim Streater <timstreater@greenbee.net> - 2017-04-03 22:41 +0100
                Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:58 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-04 09:31 +0200
                Re: This is a VIRUS - how does it works? Flippie Flink <flip@flink.not> - 2017-04-04 12:09 +0200
                Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:50 +0200
      Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-31 00:51 +0200
        Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-31 14:05 +0200
          Re: This is a VIRUS - how does it works? Wally W. <ww84wa@aim.com> - 2017-03-31 11:54 -0400
            Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-01 21:56 +0200
  Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-02 01:07 +0200
    Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-04-02 14:31 +0200
      Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-02 15:07 +0200
        Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-04-14 22:10 +0200
    Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-02 21:45 +0200
      Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-03 03:03 +0200
        Re: This is a VIRUS - how does it works? a <a@inwind.it> - 2017-04-04 00:45 +0200
          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:50 +0200
          Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-04 02:51 +0200
            Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-06 23:54 +0200
              Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-07 09:03 +0200
                Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-07 23:05 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-07 23:48 +0200
                Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-08 14:09 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-08 14:32 +0200
  Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 14:31 -0700
    Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-03 23:34 +0200
      Re: This is a VIRUS - how does it works? Andrew Poulos <ap_prog@hotmail.com> - 2017-04-04 11:35 +1000
        Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-04 09:36 +0200
    Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:59 +0200
      Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 16:08 -0700
        Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 16:17 -0700
        Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-05 13:58 -0700
      Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-19 12:59 -0700
        Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-20 00:13 +0200
          Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-19 16:59 -0700
            Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-20 08:49 +0200
              Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-05-01 13:40 -0700
  Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 14:06 +0200
    Re: This is a VIRUS - how does it works? <cyber@2trom.com> - 2017-04-12 13:59 +0000
      Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 22:23 +0200
        Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 22:28 +0200
        Re: This is a VIRUS - how does it works? <cyber@2trom.com> - 2017-04-12 21:55 +0000
        Re: This is a VIRUS - how does it works? "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2017-04-14 12:34 -0700
          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-14 22:42 +0200

csiph-web