[Xylitol]

VT: 0/46 ( :| )
https://www.virustotal.com/file/924e769 ... 359795787/

Code: Select all

2013-02-01 00:06     114     112  b7849a40  META-INF\MANIFEST.MF
2013-02-01 00:06     319     252  3f79c021  META-INF\READER.SF
2013-02-01 00:06    1061     796  f6fa5839  META-INF\READER.DSA
2013-01-31 23:51    2646    1532  9fc215b7  FlashReader.class

Code: Select all

hxtp://94.23.116.220/z/JavaPlayer.jar

[EP_X0FF]

svchost.exe, what it was? Seems unavailable.

[Xylitol]

In attach.
svchost: https://www.virustotal.com/file/727e5e9 ... 359809117/ (19/46)
Dll: https://www.virustotal.com/file/71bf787 ... 359809080/ (3/46)

Code: Select all

C:\Users\FloppyBomb\Desktop\Kernel32\Kernel32\Kernel32\obj\Release\Kernel32.pdb

FileVersion: 1.3.3.7
At least they have a sense of humor.
http://malwaredb.malekal.com/index.php? ... 23.116.220

[EP_X0FF]

Yes, script kiddie dotnet trash. HF mad skillz level.

Code: Select all

call     bool [mscorlib]System.Diagnostics.Debugger::get_IsAttached()
or
call     bool [mscorlib]System.Diagnostics.Debugger::IsLogging()
or
brfalse.s loc_29B
ldstr    "FUCKYOU@DEBUG1"

Code: Select all

ldstr    "IsDebuggerPresent"
ldstr    "FUCKYOU@DEBUG2"

Code: Select all

System.AppDomain::get_CurrentDomain
ldstr    "sandbox"
ldstr    "FUCKYOU@SANDBOX"