[prev in list] [next in list] [prev in thread] [next in thread] 

List:       snort-sigs
Subject:    [Snort-sigs] SHELLCODE base64 x86 NOOP
From:       yew chuan Ong <yewchuan_23 () yahoo ! com>
Date:       2012-06-06 3:04:22
Message-ID: 1338951862.94565.YahooMailNeo () web39404 ! mail ! mud ! yahoo ! com
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]


Hi All,

Understand this sig is to tackle the possibility of no-op sled.
But, why the content is just limited to the following repeating characters? Any ideas?

"QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB"
"QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJC"
"Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0ND"
"kJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQ"
"RERERERERERERERERERERERERERERERER"

Thanks!

Regards
YC
[Attachment #5 (text/html)]

<html><body><div style="color:#000; background-color:#fff; font-family:verdana, \
helvetica, sans-serif;font-size:10pt"><div><div><font face="verdana, helvetica, \
sans-serif" size="2">Hi All,</font></div><div><font face="verdana, helvetica, \
sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, \
sans-serif" size="2">Understand this sig is to tackle the possibility of no-op \
sled.</font></div><div><font face="verdana, helvetica, sans-serif" size="2">But, why \
the content is just limited to the following repeating characters? Any \
ideas?</font></div><div><font face="verdana, helvetica, sans-serif" \
size="2"><br></font></div><div><font face="verdana, helvetica, sans-serif" \
size="2">"QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB"</font></div><div><font face="verdana, \
helvetica, sans-serif" \
size="2">"QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJC"</font></div><div><font face="verdana, \
helvetica, sans-serif" \
size="2">"Q0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0ND"</font></div><div><font  face="verdana, \
helvetica, sans-serif" \
size="2">"kJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQ"</font></div><div><font face="verdana, \
helvetica, sans-serif" \
size="2">"RERERERERERERERERERERERERERERERER"</font></div><div><font face="verdana, \
helvetica, sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, \
sans-serif" size="2">Thanks!</font></div><div><font face="verdana, helvetica, \
sans-serif" size="2"><br></font></div><div><font face="verdana, helvetica, \
sans-serif" size="2">Regards</font></div><div><font face="verdana, helvetica, \
sans-serif" size="2">YC</font></div></div></div></body></html>



------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!

[prev in list] [next in list] [prev in thread] [next in thread]

Configure | About | News | Add a list | Sponsored by KoreLogic