Sunday, 24 April 2016

Wenja Language: lija

Su shayar, salwa! Sa "Sushal-dajrim" Urusi ankamya warshtas dabu warshta krayba magam. Sa dajris warshta: lija. Alya kraybamansu sama lijaman hu-taticham.

Good morning, all!  This Sunday I can write a few words about an uncommon word in Oros. Today's word of the day is: lija "play, flirt". For fun, I've recorded some pick-up lines in another post.

To my knowledge, lija is a word that's rarely used in the game. I'm certain that it's not used in the main dialogue, as the only place that it could be found is in the following scene with Roshani (go to 13:29), but Roshani uses drama "run", not lija.


However,  it is hidden in some of the many barks uttered by the villagers. You can use lija to mean either "play" or "flirt". Both take -ha prepositional phrases, but whether it's one or the other depends on the object of that prepositional phrase:
  1. Karwa shash-ha lija.  "The boy plays with a rock."
  2. Karwa karwi-ha lija.  "The boy flirts with a girl."
  3. Karwa karwi-ha samsam shash-ha lija.  "The boy plays with a rock with a girl."
So to "play" you use an object; to "flirt" a person. You can see that to say "play with someone" (vs. flirt) you need to introduce samsam 'together'.  

The word derives from PIE *leid- (actually lidye > lija), a word found in English ludi-crous, from Latin ludicrum 'sport, game', ludere 'to play'. There's also a rare Greek form lízei 'plays'. The Wenja form is identical to the Greek one.


How to Speak Wenja: kwati samkwayha lija (How to flirt with someone)





  •       A waycham nawa hu-gwamam. Kwayshim ti-damsham (ti-chawham) dayshta? (I am new in town.  Can you show me the way to your home (cave)?)

  •       U kuspas shala jawpur-kwa laja.  Yacha watas, tacham tiyi manam. (Go out at night and count the stars. That’s how many years I’ll wait for you.)

  •       Ayshta dakru, naysh nakwayda tansham, hanata laykwam. (If you were a tear, I would never cry in fear of losing you.)

  •       Ku swadutis kwaymansu hu-sadata? Swada-swadu harsa hapi. (Did you sit in a pile of sugar? Cause you have a pretty sweet ass.)

  •       Ku tiyi shambipachitra?  Ti-fakwisu apashkanti buha-buham. (Do you have a map? I’m getting lost in your eyes.)

  •       Ku ti-chawhasu sasa magam?  Mi-lagas drawba. (Can I sleep at your place tonight? My bed is broken.)

  •      Na lijam. Mu war kash-kashyan, samkwayi kala-kala. (I’m not flirting. I’m just being extra nice to someone is extra attractive.)

  •       Ku-ta magu? Kwaydayshta darcham, kwaykwa mari! (Are you a magician? Because whenever I look at you, everyone else disappears!)

  •       Chalta prapata. Kum-ra kawti-way bawga walhata? (You look cold. Want to use me as a blanket?)

  •       Pash, samkway ni yaha tangayam.  Mi-janu! (Excuse me, but I think I dropped something.  My jaw!)

Thursday, 21 April 2016

Wenja's Roots: Dwani (Sounds), Part 1

Over a series of posts we'll discuss exactly what we, the creators of Wenja, do each time we create - or rather derive - a new word for the primary language of Oros. How do PIE words like *bʰere- 'to carry' and *h₂odyo 'today' become Wenja bara and shaja, respectively?

Our first post will begin with the largest class of consonants in PIE -- stops (aka occlusives). Stops are found in all of the world's languages.  When you make a stop, the air is stopped in the mouth in the initial production of the sound, and then the air is released. For this reason you can't hold a stop out like an s or an m; try holding out a p -- you'll find that it's impossible!

There are six stops in English:

VoicelessVoiced
Bilabial
p
b
Alveolar
t
d
Velar
k
g




English stops are organized according to place of articulation and voicing. Stops can either be voiced or voiceless. Voiced sounds require vibration of the vocal folds (in your throat); voiceless sounds do not. The terms bilabial, alveolar, and velar refer to the place of articulation, or where in the mouth a sound is articulated. You can see in the diagram to the left that bilabial sounds are made with the lips, alveolars just behind the top front teeth, and velars towards the back of the mouth.



(Click here for an interactive overview of English phonetics)

While there are only six basic stops in English, it's very likely that PIE had fifteen. That's a lot compared to most languages of the world!  The majority of Indo-Europeanists assume five places of articulation (bilabial, dental, palatal, velar, and labiovelar (velar consonant with lip rounding)) and three different ways to make stops (voiceless, voiced, and voiced aspirated). The voiced aspirated stops, which are perhaps better described as breathy, are characterized by a voiced puff of air following the stop in question.

VoicelessVoicedVoiced Aspirated
Bilabial
p
b
Alveolar
t
d
Palatal
ǵ
ǵʰ
Velar
k
g
Labiovelar
gʷʰ

Now let's see how all of this plays out in Wenja. In the lists below, we first give you an example of a PIE word beginning with the reconstructed stops in question (marked in bold), followed by descendant words in actual Indo-European languages. We then conclude with the Wenja derivative (marked in red).

  • Labials: 
    • PIE *ped/pod- 'foot' > Luvian pāta-, Sanskrit pad-, Greek pod-, Latin ped-, English foot, Armenian otn, Wenja padi 'foot'
    • PIE *bel- 'strong' > Sanskrit bála- ‘strength’, Greek beltíōn ‘better’, Latin dē-bilis ‘lacking strength’, Old Church Slavonic bolĭjĭ ‘bigger’, Wenja bala 'strong'
    • PIE *bʰer- 'carry' > Sanskrit bhárāmi ‘I carry’, Greek phérō, Latin ferō, Armenian berem, English bear, Old Church Slavonic berǫ ‘I take’, Old Irish ·beir, Wenja bara 'carry'
  • Dentals: 
    • PIE *ters- 'be dry, thirst' > Sanskrit tarṣáyati ‘makes thirsty’, Greek térsetai ‘becomes dry’, Latin terra ‘(dry) land’, English thirst, Albanian ter ‘I dry’, Wenja tarsa 'become dry'
    • PIE *doru '(oak) tree' > Hittite tāru ‘wood, tree’, Sanskrit dā́ru, Greek dóru, Old Irish daur, Old Church Slavonic drěvo, Albanian dru, English tree, Wenja daru 'wood'
    • PIE *dʰeh₁- 'put, do'Sanskrit dhā- ‘put, do’, Greek thē- ‘put’, Latin faciō, English do, Old Russian , Wenja daha 'do, make, put'
  • Palatals:
    • PIE *ḱerd- 'heart' Sanskrit śrad-, Old Church Slavonic srĭdĭce, Lithuanian širdìs, Hittite kard-, Greek kardíā, Latin cord- [kord], English heart, Wenja charda 'heart'
    • PIE *ǵónu 'knee' > Sanskrit jā́nu, Avestan žnum, Hittite gēnuGreek gónu, Latin genū, Eng. knee, Wenja janwa 'knee'
    • PIE *ǵʰeu- 'pour'Sanskrit hūyáte ‘is poured’, Avestan zaotar- ‘priest’, Greek khe(w)ō ‘I pour’, Tocharian B kewu ‘I will pour’, German giessen, Wenja jawa 'pour'
  • Velars:
    •  PIE *kes- 'hair' > Old Church Slavonic kosa ‘hair’, Lithuanian kasà ‘braid’, Hittite kiss-, Greek késkeon, Old English heord ‘hair’, Wenja kasa 'braid, weave'
    • PIE *gras- 'grass' > Sanskrit grásate ‘eats’, Greek grástis ‘grass’, Latin grāmen ‘grass’, Wenja grasti 'straw'
    • PIE *gʰrebʰ(hᵪ)- 'grab' > Sanskrit /ghrabh-/, Av. grab-, OCS grabiti, Eng. grab, Wenja grabasha 'grab, catch'
  • Labiovelars:
    • PIE *kʷis 'who' Sanskrit kás ‘who’, Old Church Slavonic kŭ-to ‘who, Lithuanian kàs, Hittite kuis ([kwis]), Latin quis ([kwis]), Old English hwæt, Wenja kway 'who, what'
    • PIE *gʷen- 'woman' > Sanskrit jáni-, Old Church Slavonic žena, Old Prussian genna, Hittite kuinnas ([kwinnas])Greek gunḗ, English queenWenja gwani 'woman'
    • PIE *gʷʰen- 'kill' > Sanskrit hánti ‘slays’, Avestan jaiṇti, Old Church Slavonic ženǫ ‘I hunt’, Hittite kuenzi ([kwentsi]) ‘slays’, Greek -phonos ‘slayer’, Latin dē-fen-dit, English bane, Wenja gwana 'kill'

If you've made it this far and have looked closely at the PIE & Wenja examples, you'll note two basic changes in the Wenja stop system.
  1. Voiced aspirates are pronounced as normal voiced stops in Wenja: *bʰ, dʰ, ǵʰ, gʰ, gʷʰ > b, d, j, g, gw, respectively
  2. Palatal stops are pronounced as (alveopalatal) affricates in Wenja: *ḱ, ǵ, ǵ > ch, j, j, respectively. Recall that ch  = < ch > (cheese) & j = < j > (juice).
Though there are some modifications here and there (we'll get to those), it's pretty much that simple! This leaves us with the following stop inventory for Wenja:

VoicelessVoiced
Bilabial
padi
bala
Alveolar
tarsa
daha
Palatal (Alveopalatal)
charda
jawa
Velar
kasa
grabash
Labiovelar
kway
gwana

Next time we'll talk about the fricatives - the hissy sounds - of Wenja: s, z, h, sh, and f.

Wednesday, 20 April 2016

Nemucod ransomware information



This is a quick post on the recent Nemucod ransomware. Nemucod is (normally) a downloader which uses JavaScript  JScript (thanks Katja) to enter an unsuspecting user's machine and download additional malware (depends on campaign usually).

There's a blog post by Fortinet which explains Nemucod ransomware, so I'm not going to repeat much here: Nemucod Adds Ransomware Routine

It came to our attention that a new, rather peculiar version of Nemucod has been recently landing on users. Nemucod is a well-known JavaScript malware family that arrives via spam email and downloads additional malware to PCs.

This particular campaign is using the lure of a court appeal to spread:










The mail reads:

Notice to Appear,
You have to appear in the Court on the April 22.Please, prepare all the documents relating to the case and bring them to Court on the specified date.Note: If you do not come, the case will be heard in your absence.
The Court Notice is attached to this email.
Yours faithfully,Brian Snider,District Clerk.


It seems Nemucod ransomware got another update, as it now uses 7-zip to actually encrypt the files.

Another change is the slight drop in price. Whereas before it was 0.60358 bitcoins ($267.14 or €236.43), it's now 0.49731 bitcoins ($220.11 or €194.80).

New message reads:

Nemucod ransomware message


























Nemucod encrypting a whole plethora of filetypes, appending the .crypted extension









Disinfection

If you have opened a .JS file (JScript file) from an unknown sender, open Task Manager immediately and stop all the following processes (at least in this version of Nemucod):

a0.exe (actually 7-zip disguised)
a1.exe
a2.exe
cmd.exe
wscript.exe


The faster you do this, the less files will be encrypted. Run a scan with your antivirus program and a scan with another antivirus program to verify the malware has been removed.

Note: It's always useful to keep a copy of the ransomware note handy, as it's easier to identify the ransomware and if it can be decrypted.


Decryption

I'm only briefly reporting on this for those in need, but currently, the known decryptors are suited for this version. However, Fabian from Emsisoft is already working hard to make a decryptor available, so please have patience!

If you have an older version of Nemucod, you can try one of either decryptors:
Emsisoft Decrypter for Nemucod 
nemucod_decrypter (you will need to install Python for this)

You can also try restoring files with Shadow Explorer. (alternate link)

For more information, please visit the following Bleeping Computer topic
.crypted Ransomware (Nemucod) - Decrypt.txt Support and Help Topic



Prevention

In particular for Nemucod, don't open any JScript/JavaScript files from unknown senders.

For more tips on ransomware prevention, be sure to check out this page I've set up:
Ransomware Prevention


Conclusion

Same as with all malware: don't open attachments from unknown senders!

Please find below IOCs and additional resources.



Resources

.crypted Ransomware (Nemucod) - Decrypt.txt Support and Help Topic
ID ransomware
JavaScript-toting spam emails: What should you know and how to avoid them?
JScript
Nemucod ransomware IOCs
Ransomware overview
Ransomware Prevention
TrojanDownloader: JS/Nemucod