MrSandman
@cmhacks
29a Labs hackstory.net/29A // Security Researcher @ ZDI
ID: 232412680
http://www.cmhacks.org 31-12-2010 02:39:14
2,2K Tweet
177 Followers
631 Following
Cool find by MalwareHunterTeam The DLL decrypts and loads a downloader shellcode via EnumTimeFormatsEx callback function. It retrieves payload from gouvn[.]me and runs it in memory (no payload available)