{"id":1887,"date":"2013-05-16T16:06:01","date_gmt":"2013-05-16T16:06:01","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=1887"},"modified":"2013-05-16T16:10:01","modified_gmt":"2013-05-16T16:10:01","slug":"uvwatauavawh-meet-the-pushy-string","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2013\/05\/16\/uvwatauavawh-meet-the-pushy-string\/","title":{"rendered":"UVWATAUAVAWH – Meet The Pushy String"},"content":{"rendered":"

The title of this post is not a secret message and I am not intoxicated.<\/p>\n

UVWATAUAVAWH happens to be the most popular string extracted from all .exe, .dll and .sys OS files on my 64-bit Windows. The string is so popular and at the same time suspicious that if you google it you will find people theorizing about it having something to do with BSODs \/ being a part of some internal ZeroAccess secret language.<\/p>\n

If you convert the characters into hex:<\/p>\n

UVWATAUAVAWH<\/pre>\n
you will get a string of bytes like these:<\/p>\n
55 56 57 41 54 41 55 41 56 41 57 48<\/pre>\n
and these can be also represented as opcodes:<\/p>\n
U  - push\u00a0\u00a0\u00a0 rbp<\/pre>\n
V  - push\u00a0\u00a0\u00a0 rsi<\/pre>\n
W  - push\u00a0\u00a0\u00a0 rdi<\/pre>\n
AT - push\u00a0\u00a0\u00a0 r12<\/pre>\n
AU - push\u00a0\u00a0\u00a0 r13<\/pre>\n
AV - push\u00a0\u00a0\u00a0 r14<\/pre>\n
AW - push\u00a0\u00a0\u00a0 r15<\/pre>\n
H  - part of sub rsp, xxx opcode<\/pre>\n
The sequence is a very typical prologue for functions\u00a0 (64-bit code) – so typical that it is all over the place together with its variants (see below); the ‘vowelized’ properties of these strings remind me an interesting paper about shellcodes that look like English text<\/a>.<\/p>\n
UVWATAUAVAWH\r\nWATAUH\r\nWATAUAVAWH\r\nSUVWATAUAVAWH\r\nSUVWATH\r\nVWATAUAVH\r\nSUVWATAUH\r\nATAUAVH\r\nUSVWATAUAVAWH\r\nUVWATAUH\r\nSUVWATAUAVH\r\nSVWATAUAVAWH\r\nUSVWATH\r\nUSVWATAUH\r\nUSVWATAUAVH\r\nVWATAUAVAWH\r\nWAVAWH\r\nATAUAVAWH\r\nVWATAUAWH\r\nWATAVH\r\nUVWATAUAVH<\/pre>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
The title of this post is not a secret message and I am not intoxicated. UVWATAUAVAWH happens to be the most popular string extracted from all .exe, .dll and .sys OS files on my 64-bit Windows. The string is so … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[28,9,18],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1887"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=1887"}],"version-history":[{"count":7,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1887\/revisions"}],"predecessor-version":[{"id":1894,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1887\/revisions\/1894"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=1887"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=1887"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=1887"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}