Ok I understand the "call" is calling shell32 , ExecureA (ANSI) also that if a string is in quotes it is required to be double quoted.
But what the heck does "JJCCCCJ" do " ? 
-
-
-
It's a way to declare the apifunction's signature for the "call" function. https://support.office.com/en-us/article/call-function-32d58445-e646-4ffd-8d5e-b45077a5e995 …
- Još 6 drugih odgovora
Novi razgovor -
-
-
It is also exposed via (D)COM, making it a rather fun toy in a post-exploitation scenario :)
-
CLSID {00024500-0000-0000-C000-000000000046}pic.twitter.com/5wJ31kpZ3h
- Još 1 odgovor
Novi razgovor -
-
-
thanks for sharing
@DissectMalwareHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.