Download IMG 6561 MOV REPACK

In this blog, we reviewed a campaign that shows how Brazilian cybercriminals target the customers of financial institutions. While abusing legitimate binaries with code injection, DLL hijacking, RTF exploits and PowerShell downloaders, are not new techniques, using them together along with elaborate social engineering creates a very effective multi-stage infection chain.

Download IMG 6561 MOV

AS11-40-5965 ( 94k ) 111:27:05 This image is either the first of those film advances or an accicental frame taking while Neil was getting ready to advance the film. It gives a view to the southeast, with some deeply shadowed Mylar - possibly part of the MESA blanket - on the left. On the surface, we see the parallel shadows of the minus-Y (south) strut and probe. Compare with 5850. AS11-40-5966 ( 113k ) 111:27:05 Similar to 5965. AS11-40-5966A ( 160k ) 111:27:05 View into the MESA shadow. Image enhanced to show detail similar to that seen in the deep shadow of 5965 and 5966. Thanks to Paolo Attivissimo for callling attention to the existence of this image. Scan downloaded from the LPI Apollo Image Atlas.] AS11-40-5967 (OF300) ( 185k or 1088k ) 111:27:05 Image taken as Neil advances the film prior to removing the magazine. View to the northwest showing the TV camera and the SWC pole. Andrew Vignaux suggests that the fuzzy area at the lower left is part of Neil's suit - probably Neil's left arm - which, because it is so close to the camera, is out of focus. AS11-40-5967/8 Red-Blue Anaglyph ( 943k or 228k ) Red-blue anaglyph by Erwin D'Hoore. AS11-40-5968 (OF300) ( 185k or 1088k ) 111:27:05 Similar to 5967. AS11-40-5969 (OF300) ( 126k or 910k ) 111:27:05 This frame captures more of Neil's suit. AS11-40-5970 (OF300) ( 133k ) 111:27:05 Similar to 5969. Sunstruck after the magazine was removed from the camera. The blocky object at the top of the "suit" may be Neil's OPS, as indicated in a labeled detail. Magazine 41/P (B & W) Frames 5971-6159

AS11-41-6121 ( 158k or 771k ) Hypatia Rille and Craters Sabine, Ritter and Schmidt from lunar orbit. Scans by Kipp Teague. See, also, a labeled version. AS11-41-6123 ( 2.4 Mb ) Hypatia Rille and Craters Sabine, Ritter and Schmidt from a a bit farther west in the same lunar orbit. Photo downloaded from the Apollo Image Atlas. See, also, a labeled version. AS11-41-6156 ( 158k or 890k ) View of area west of Crater 308 from lunar orbit. Scans by Kipp Teague. Magazine 42/U (B & W) Frames 6160-6348

AS11-42-6304 ( 2.9 Mb ) Messier Crater (left) and Messier A. Messier was probbly formed by an impactor which struck the Moon at a very shallow angle. Messier is located at 47.6 E and 1.9 S and is about 9 x 11 km and 1.3 km deep. Scan downloaded from the LPI Apollo Image Atlas. AS11-42-6304-05 Red-Blue Anaglyph ( 1.2 Mb ) Red-blue anaglyph by Patrick Vantuyne. AS11-42-6305 ( 3.0 Mb ) Scan downloaded from the LPI Apollo Image Atlas. Magazine 43/T (B & W) Frames 6349-6539

AS11-43-6437 ( 185k ) Mendeleev Crater, located at 140.9 E and 5.7 N. Diameter 313 km. Part of the northern rim of Mendeleev is on the left. The fresh crater at top center is Richards, located at 1401 E and 7.7 N. Diameter 16 km. The crater chain ends just below Richards is Catena Mendeleev. Scan downloaded from the LPI Apollo Image Atlas. AS11-43-6437-39 Red-Blue Anaglyph ( 3 Mb or 240k ) Red-blue anaglyph by Patrick Vantuyne. AS11-43-6439 (OF300) ( 2.8 Mb ) Similar to 6437. Scan downloaded from the LPI Apollo Image Atlas. Magazine 44/V (Color) Frames 6540-6696

Journal Contributor Paul White has made detailed comparisons of cloud patterns seen in a large number of Apollo images with imagery taken at close to the same time by various meteorlogical satellites. AS11-44-6548 (OF300) ( 68k or 640k ) Taken seconds after 6547. Scan by NASA Johnson. AS11-44-6549 (OF300) ( 68k or 624k ) View of the Earth from the Command Module Columbia. at AOS. The sequence of images indicate that 6549 has to have been taken before separation from the LM, which happened on Rev 12. Journal Contributor Scott Cruickshank notes that, using Celestia, the position of Australia indicates that 6549 was taken soon after AOS on Rev 6, which occurred at about 04:03 UTC on 20 July 1969. A Celestia view of Earth from the Moon at that time provides confirmation . As seen from the Moon, the angular diameter of Earth is about 1.9 degrees. Between the times that 6547 and 6549 are taken, the Earth rises about 0.37 diameters or about 0.7 degrees and, with an orbital period of two hours, the interval between 6547 and 6549 can be estimated as 14 seconds. 20 July 1969. Scan by NASA Johnson. AS11-44-6550 (OF300) ( 200k or 648k ) Earthrise. Mick Hyde notes that the portion of Mare Smythii seen in this image can also be seen in Clementine image bi03n087, which can also be found on the WWW via the Clementine Image Browser. Markus Mehring provides a labeled comparison between the two images. Scan by NASA Johnson. AS11-44-6551 (OF300) ( 82k or 481k ) Earthrise. Detailed captions available in the Apollo 11 Flight Journal. Scan by NASA Johnson. AS11-44-6553 (OF300) ( 68k or 632k ) Earthrise. Scan by NASA Johnson. AS11-44-6554 (OF300) ( 64k or 704k ) Earthrise. Scan by NASA Johnson. AS11-44-6555 (OF300) ( 68k or 712k ) Earthrise. Scan by NASA Johnson. AS11-44-6556 (OF300) ( 68k or 704k ) Earthrise. Scan by NASA Johnson. AS11-44-6557 (OF300) ( 68k or 612k ) Earthrise. Scan by NASA Johnson. AS11-44-6558 (OF300) ( 64k or 592k ) Earthrise. Scan by NASA Johnson. AS11-44-6559 (OF300) ( 64k or 564k ) Earthrise. Since 6547 was taken, the Earth has risen about about 1.8 diameters or 3.4 degrees. The time interval is about 68 seconds. The average interval between frames is about 5 seconds. Scan by NASA Johnson. AS11-44-6560 (OF300) ( 60k or 532k ) Earthrise. Scan by NASA Johnson. AS11-44-6561 (OF300) ( 64k or 580k ) Earthrise. Scan by NASA Johnson. AS11-44-6562 (OF300) ( 68k or 600k ) Earthrise. Scan by NASA Johnson. AS11-44-6563 (OF300) ( 56k or 476k ) Earthrise. Scan by NASA Johnson. AS11-44-6564 (OF300) ( 56k or 464k ) Earthrise. Scan by NASA Johnson. Although the Apollo 11 Photography Index states that frames 6565 to 6599 were also taken with the 250-mm lens, the size of the thruster images in 6565 are similar to those is 6542, suggesting that Mike is using the 80-mm lens for this sequence.

Conficker A's agent proceeds as follows. First, it checks for thepresence of a firewall. If a firewall exists, the agent sends aUPNP message to open a local random high-order port (i.e., it asks thefirewall to open its backdoor port to the Internet). Next, itopens the samehigh-order port on its local host: its binary upload backdoor. This backdoor is used during propagation, to allow newly infectedvictims to retrieve the Conficker binary. It proceeds to one ofthe following sites to obtain its external-facing IP address www.getmyip.org, getmyip.co.uk, andcheckip.dyndns.org, andattempts to download the GeoIP database from maxmind.com. It randomlygenerates IP addresses to search for additional victims, filteringUkraine IPs based on the GeoIP database. The GeoIP information isalso used as part of MS08-67 exploit process [10]. Conficker A then sleeps for 30 minutes before starting a thread thatattempts to contact download a file called loadadv.exe. Thisthread cycles every 5 minutes.

Next, Conficker A enters an infinite loop, within which it generatesa list of 250 domain names (rendezvous points). Thename-generation function is based on a randomizing function that itseeds with the current UTC system date. The same list of 250names is generated every 3 hours, i.e., 8 times per day. AllConficker clients, with system clocks that are at minimum synchronizedto the current UTC date, will compute and attempt to contact the sameset of domains. When contacting a domain for which a valid IP addresshas been registered, Conficker clients send a URL request to TCP port80 of the target IP, and if a Windows binary is returned, it will bevalidated via a locally stored public key, stored on the victim host,and executed. If the computer is not connected to the Internet,then the malicious code will check for connectivity every 60seconds. When the computer is connected, Conficker A will executethe domain name generation subroutine, contacting every registered domain in thecurrent 250-name set to inquire if an executable is available fordownload.

Conficker B is a rewrite of Conficker A with the followingnoticeable differences. First, Conficker A incorporates aUkraine-avoidance routine that causes the process to suicide if thekeyboard language layout has been set to Ukrainian. Conficker B doesnot include this keyboard check. B also uses different mutexstrings and patches a number of Windows APIs, and attempts to disableits victim's local security defenses by terminating the execution of apredefined set of antivirus products it finds on the machine. Ithas significantly more suicide logic embedded in its code, and employsanti-debugging features to avoid reverse engineering attempts.Conficker B uses a different set of sites to query its external-facingIP address www.getmyip.org,www.whatsmyipaddress.com, www.whatismyip.org, checkip.dyndns.org. It does not download the fraudware Antivirus XP software that version Aattempts to download. Conficker's propagation methods varyamong A and B and are described in Section ConfickerPropagation. Furthermore, a recent analysis by Symantec has uncovered that the GeoIPfile is directly embedded in the Conficker B binary as a compressed RAR(Roshal archive) file encrypted using RC4 [11]. Like Conficker A, after a relatively short initialization phase followed by a scan and infect stage, Conficker B proceeds togenerate a daily list of domains to probe for the download of anadditional payload. Conficker B builds its candidate set ofrendezvous points every 2 hours, using a similar algorithm. Butit uses different seeds and also appends three additional top-leveldomains. The result is that the daily domain lists generated by Aand B do not overlap. 041b061a72