VML vulnerability - code

Discussion in 'malware problems & news' started by Mrkvonic, Jan 18, 2007.

Thread Status:
Not open for further replies.
  1. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    10,224
    Hello,
    I believe I have caught an html email with VML exploit.
    I would like to share this with people who really know their stuff. Who can I send this for analysis?
    Mrk

    P.S. I wonder if testing it with IE4fs in Linux will work??
     
    Mrkvonic, Jan 18, 2007
    #1
  2. lucas1985

    lucas1985 Retired Moderator

    Joined:
    Nov 9, 2006
    Posts:
    4,047
    Location:
    France, May 1968
    TNT comes to my mind. I´m sure that the folks at PrevX and antivirus researchers will appreciate it too.
     
    lucas1985, Jan 18, 2007
    #2
  3. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    10,224
    Hello,
    Got any links, I'm too lazy to search...
    Mrk
     
    Mrkvonic, Jan 18, 2007
    #3
  4. TNT

    TNT Registered Member

    Joined:
    Sep 4, 2005
    Posts:
    948
    Yes, please if you can you please save the original message and e-mail it to me at 4kibqc702@sneakemail.com zipped with password "infected".

    Thanks.

    NB: I'm gonna close this e-mail address as soon as I get the message. :)
     
    TNT, Jan 18, 2007
    #4
  5. lucas1985

    lucas1985 Retired Moderator

    Joined:
    Nov 9, 2006
    Posts:
    4,047
    Location:
    France, May 1968
    lucas1985, Jan 18, 2007
    #5
  6. EraserHW

    EraserHW Malware Expert

    Joined:
    Oct 19, 2005
    Posts:
    588
    Location:
    Italy
    Me too please ;)

    Contact me in pvt

    Marco
     
    EraserHW, Jan 18, 2007
    #6
  7. fcukdat

    fcukdat Registered Member

    Joined:
    Feb 20, 2005
    Posts:
    569
    Location:
    England,UK
    fcukdat, Jan 19, 2007
    #7
  8. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    10,224
    Hello,
    Before I make too much wind, I wanted to see how other people analyze it. I could be absolutely wrong of course...
    MIRT is not loading for me right now.... Do you want it?
    Mrk
     
    Mrkvonic, Jan 19, 2007
    #8
  9. lucas1985

    lucas1985 Retired Moderator

    Joined:
    Nov 9, 2006
    Posts:
    4,047
    Location:
    France, May 1968
    I think that CastleCops is receiving a DDoS caused by hosting of Gmer. The entire site loads too slowly here.
     
    lucas1985, Jan 19, 2007
    #9
  10. fcukdat

    fcukdat Registered Member

    Joined:
    Feb 20, 2005
    Posts:
    569
    Location:
    England,UK

    Yes please.I have PM'ed you an addy and will put it up on MIRT with a link back to this topic.

    TIA:)
     
    fcukdat, Jan 19, 2007
    #10
  11. Cretemonster

    Cretemonster Registered Member

    Joined:
    Mar 31, 2005
    Posts:
    79
    Curious?

    Whats so special about this particular exploit?

    I have been looking at 5 different htm files with varying exploits and was wondering is the one circulating in emails somehow different?

    Exploit.JS.XMLCore.a

    Exploit.HTML.VML.d

    Exploit.HTML.IESlice.d

    Downloader.JS.Agent.bx

    Downloader.JS.Agent.cd
     
    Cretemonster, Jan 20, 2007
    #11
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...