IE 0day CVE-2010-0249 – Exploiting the mass… – Part 3

SHELLCODE STAGE

As usal the shellcode has a first step decryption routine (simply xor)

followed by dll loading and finding external function reference address:

 

Then the 2nd stage malware is downloaded and stored in special local path file name f.exe

and is executed