Google Malware Search - .:: HVAOnline ::.

English | Vietnamese

Rules

Main Forum

Portal

Member Listing

Statistics

Search

Reading Room
[Register]

Login [ | https ]

Forum Index

Thảo luận virus, trojan, spyware, worm...

Google Malware Search

[Question] Google Malware Search	27/07/2006 01:39:11 (+0700) \| #1 \| 10198

ketusa
Member

Joined: 11/04/2006 12:39:49
Messages: 3
Offline

Trước tiên đọc tại đây để biết thông tin đã nhe
http://vietnamnet.vn/cntt/2006/07/594778/

I was thinking on different lines, possibly one can use magic values of
different types of executables along with "filetype:" keyword.

For Example:
EXE -- 0x5A4D
NT -- 0x4550
OS2 -- 0x454E
OS2 LE -- 0x454C
VXD -- 0x454C

Now, if one has to search for malicious binaries in the form of .scr, .com
or .pif etc then (s)he can issue the following search keywords -

"intext: signature: 5A4D" filetype:scr
"intext: signature: 5A4D" filetype:pif
"intext: signature: 5A4D" filetype:doc

or (without using "intext")

signature: 00004550 filetype:scr
signature: 00004550 filetype:doc

The results can be narrowed down using a signature database like the one
being used here

http://metasploit.com/research/misc/mwsearch/index.html

Similar results can also be achieved using search keywords for specific
details in a PE / LE header. For example -

Search for ["intext: Image File Header" filetype:scr] gives almost the same
result as ["intext: signature: 5A4D" filetype:scr]

Found by : ketusa

[Question] Google Malware Search	27/07/2006 10:29:35 (+0700) \| #2 \| 10278

t0ny4n
Member

Joined: 03/07/2006 10:47:01
Messages: 40
Offline

Thx bro for share ^^
Để kiếm mí con về nghiên cứu.
Nhưng kô bít có decode đc code của chúng nó để nghiên cứu kô nữa

Go to:

Users currently in here
1 Anonymous