Anti-Sandboxing: Wait for Mouse Click

[123456]

Overview
The Trojan Upclicker (as reported by eEye) uses the SetWindowsHookExA API with the WH_MOUSE_LL parameter to wait until the user lets up the left mouse button (WM_LBUTTONUP) before performing any malicious functionality (then it injects into Explorer.exe).

A sandbox environment that does not mimic mouse actions (probably most of them) will never execute the malicious behavior. This is probably effective against Kaspersky and others.

https://wikileaks.org/ciav7p1/cms/page_20873368.html


is sandboxie affects this vulnerability?

[Barb@Invincea]

Hello 123456,

This might help:

http://forums.sandboxie.com/phpBB3/view ... ker#p86411

Regards,
Barb.-