This was captured through my honeypot, its the data sent to 3127 since I cant believe people are still scanning for doom i wondered if it might be a worm.
Anyways here's the hex data sent to my honeypot
Full Version: Worm?
| CODE |
000000 | 85 13 3C 9E A2 4D 5A 90 00 03 00 00 00 04 00 00 | ..<..MZ......... 000010 | 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 | .............@.. 000020 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000040 | 00 D0 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 | .............!.. 000050 | 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 | L.!This program 000060 | 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E | cannot be run in 000070 | 20 44 4F 53 20 6D 6F 64 65 2E 0D 0D 0A 24 00 00 | DOS mode....$.. 000080 | 00 00 00 00 00 B5 2E 24 6F F1 4F 4A 3C F1 4F 4A | .......$o.OJ<.OJ 000090 | 3C F1 4F 4A 3C 0B 6B 0A 3C F3 4F 4A 3C 0B 6C 53 | <.OJ<.k.<.OJ<.lS 0000A0 | 3C F8 4F 4A 3C F1 4F 4B 3C DE 4F 4A 3C 0B 6B 56 | <.OJ<.OK<.OJ<.kV 0000B0 | 3C F0 4F 4A 3C 0B 6B 77 3C F0 4F 4A 3C 52 69 63 | <.OJ<.kw<.OJ<Ric 0000C0 | 68 F1 4F 4A 3C 00 00 00 00 00 00 00 00 00 00 00 | h.OJ<........... 0000D0 | 00 00 00 00 00 50 45 00 00 4C 01 03 00 12 4A 16 | .....PE..L....J. 0000E0 | 40 00 00 00 00 00 00 00 00 E0 00 0F 01 0B 01 07 | @............... 0000F0 | 00 00 90 00 00 00 10 00 00 00 50 00 00 00 E7 00 | ..........P..... 000100 | 00 00 60 00 00 00 F0 00 00 00 00 40 00 00 10 00 | ..`........@.... 000110 | 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 | ................ 000120 | 00 00 00 00 00 00 00 01 00 00 10 00 00 00 00 00 | ................ 000130 | 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 | ................ 000140 | 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 | ................ 000150 | 00 00 00 00 00 00 F0 00 00 04 01 00 00 00 00 00 | ................ 000160 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000170 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000180 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000190 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0001A0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0001B0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0001C0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 | .............UPX 0001D0 | 30 00 00 00 00 00 50 00 00 00 10 00 00 00 00 00 | 0.....P......... 0001E0 | 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0001F0 | 00 80 00 00 E0 55 50 58 31 00 00 00 00 00 90 00 | .....UPX1....... 000200 | 00 00 60 00 00 00 8A 00 00 00 04 00 00 00 00 00 | ..`............. 000210 | 00 00 00 00 00 00 00 00 00 40 00 00 E0 55 50 58 | .........@...UPX 000220 | 32 00 00 00 00 00 10 00 00 00 F0 00 00 00 02 00 | 2............... 000230 | 00 00 8E 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000240 | 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 | .@.............. 000250 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000260 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000270 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000280 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000290 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0002A0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0002B0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0002C0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0002D0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0002E0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0002F0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000300 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000310 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000320 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000330 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000340 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000350 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000360 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000370 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000380 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 000390 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0003A0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0003B0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0003C0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0003D0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 0003E0 | 31 2E 32 34 00 55 50 58 21 0C 09 02 09 F9 DE A8 | 1.24.UPX!....... 0003F0 | 6E B5 5C BA 83 98 C3 00 00 FA 86 00 00 00 A8 00 | n.\............. |
Kid with too much free time or evil worm?
It coud be both you never know but you can see from report that somebody was trying to send you an exsecutable!!!!! 
Yop that Kid tried to MyDoom exploit you So you can just say, he tried to send you a windows executable and used the MyDoom.A Upload\Exec, made by me or made by kralor..... Kinda fun that kiddies use this tool, me personally used it too secure connections..
So you can just say, he tried to send you a windows executable and used the MyDoom.A Upload\Exec, made by me or made by kralor..... Kinda fun that kiddies use this tool, me personally used it too secure connections..
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
