A student at our academy has created a seeminlgy malicious script and saved it in his home folder:
(Corrupt File)(error 0x983le)
(MKS.message ("Your Computer Has Been Reset")
Does anyone recognize the language and can tell me what script engine it is for?
Looks like pseudocode to be honest, that is code that is kind of a plan of what is going to happen, but in terminology that is readable, as oppose to actual coding.
Looks made up to me.
It sort of references things, but I can't find any scripting language that looks like that.
Shutdown.ISD for example.
ISD, from what I know is Overcurrent shutdown.
Source. [Page 5.]Overcurrent shutdown (ISD)
Each phase has an overcurrent shutdown circuit, which turns off the corresponding outputs when the output current exceeds the shutdown trip threshold (above the maximum current rating: 2.0 A minimum). The TB62208FTG exits ISD mode and resumes normal operation when the STANDBY pin is changed from High to Low and then to High. This circuit provides protection against short-circuit by temporarily disabling the device. Important notes on this feature will be provided later.
Le EDIT: Took too long... stupid work distracting me.
Last edited by X-13; 24th October 2012 at 02:25 PM.
Well the easiest bit "imo" is this "0x983le" if it's hex, then L can't exist in it....
lol, comical low of the low, a wannabe script kiddy.
How did you find it out of curiosity?
The student was caught typing and saving it whilst being secretly monitored using Impero.
As for its content, I was hoping someone would recogize the general syntax - especially the parentesis around every command. The details are system specific - ISD is a local user name (it is the initials of our support department).
Thanks for the replies so far.
russdev (24th October 2012)
The code would not do that without some major help from a very specific interpreter which probably does not exist and if it does should be an exe blocked by your policies.
Is it possible the student is just showing this to her/his mates to show off rather than it doing anything.
it is not a language I recognize, in addition to the "l" in the hex he has a few mis-matched quotes and parentheses.
I agree it looks like it is a joke / showing off.
What was the file name and extension, the extension will give you a clue to what language he thought it was.
There are currently 1 users browsing this thread. (0 members and 1 guests)