Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon. Entire thread

VIRUS!

Name: Anonymous 2008-01-11 22:29

Ok, /prog/, let's see if anyone here is any good at all.
Here is a virus (or some sort of other windows exploit, probably to pwn your machine and add it to some asian botnet): http://59.39.66.84/test.exe

My advice would be to not run this, except maybe under vmware or something.
It's recent enough (the PE header says monday the 7th of january 2008, so only a few days old). Thats as far as I could get.. all symbols are stripped, .text section contains only the usual references to kernel32, GetProcAddress and so on. Only kernel32.dll and shell32.dll are imported. Thats about all I could find out (cause I'm a n00b at such stuff).

So, anyone in /prog/ 1337 hax0r or something and able to reverse engineer this thing? I'd love to know what it does :-P

Name: Anonymous 2008-02-24 16:39

#include <iostream>

using namespace std;

int main()
{
    float mofo;
    cout<<"Program (NAME:[VIRUS.MOFO])\n\n";
    cout<<"Program initiating...\n\n";
    cout<<"ERROR: Numeric [FLOAT.GET] code required.\n";
    cout<<"If numeric code is unavailable, please consult your compiler's std (Standard Libary)\n";
    cout<<"Numeric code; reset.\n\n";
    cout<<"Broken or incompleted algorithm detected: [LINE: 16, 19, 67]\n\n";
    cout<<"One digit input [Termination of Code]  initiated:\n\n";
    cin>> mofo;
    if (mofo == 6){cin.get();}
    else {cout<<"\nInvalid response; program initiating...\n";
    cin.get();}


}

Just thought i'd throw together this "Fake" virus, it compiled fine. Anyone ignorant of both 'viruses' and 'Programming' could proberly convince a similarly ignorant friend this was a virus and that they had to enter a number to disable it.

STEP 1: Compile
STEP 2: Send to someone (or leave it in someones startup)
STEP 3: Watch
STEP 4: ??????
STEP 5: LULZ
STEP 6: PROFIT

Newer Posts
Don't change these.
Name: Email:
Entire Thread Thread List