无聊,这东西经常更新吗?
VC6写的,加壳改了下特征PEid查不出来,脱壳后发些上来,大概也知道它的行为了:
004010A6 PUSH unpacked.004075B8 ASCII "delme.bat"
004010B8 PUSH unpacked.00406D64 ASCII "kowin.exe"
00401117 PUSH unpacked.004075AC ASCII "@echo off
"
00401151 PUSH unpacked.004075A0 ASCII ":selfkill
"
00401180 PUSH unpacked.00407594 ASCII "del /F /Q ""
004011E0 PUSH unpacked.00407590 ASCII ""
"
0040120A PUSH unpacked.00407584 ASCII "if exist ""
00401260 PUSH unpacked.00407570 ASCII "" goto selfkill
"
0040128A PUSH unpacked.00407564 ASCII "del %0
"
0040133C PUSH unpacked.00407164 ASCII "kowin.dll"
00401371 PUSH unpacked.00407264 ASCII "kowin.exe"
004013D4 PUSH unpacked.00407364 ASCII "winlogon.exe"
0040146F PUSH unpacked.00407064 ASCII "kowin"
00401570 MOV ESI,unpacked.00407600 ASCII "auto.exe"
0040159E MOV EDI,unpacked.00406A64 ASCII "kowinIe"
004015B6 MOV EBX,unpacked.00406F64 ASCII "kowin"
004015C3 PUSH unpacked.00407064 ASCII "kowin"
004015F3 MOV EDI,unpacked.00406D64 ASCII "kowin.exe"
004015FF PUSH unpacked.004075F8 ASCII ".EXE"
00401627 PUSH unpacked.00407164 ASCII "kowin.dll"
00401631 PUSH unpacked.004075F0 ASCII ".DLL"
00401636 PUSH unpacked.00407164 ASCII "kowin.dll"
004016B6 PUSH unpacked.004075E8 ASCII "%c:\"
004016D6 PUSH unpacked.004075D8 ASCII "explorer.exe"
004016DB PUSH unpacked.004075D0 ASCII "open"
00401729 PUSH unpacked.004075CC ASCII "-k"
00401748 MOV DWORD PTR SS:[EBP-18],unpacked.00407 ASCII "kowin"
0040176A PUSH unpacked.004075C8 ASCII " -k"
00401789 MOV EDI,unpacked.00407064 ASCII "kowin"
0040198D PUSH unpacked.0040760C ASCII "c:\"
00401A14 PUSH unpacked.00407610 ASCII "%x"
00401ABC PUSH unpacked.00407670 ASCII "SYSTEM\CurrentControlSet\Services\"
00401AE9 MOV ESI,unpacked.00407664 ASCII "Description"
00401BC4 PUSH unpacked.00407658 ASCII "DisplayName"
00401BE7 PUSH unpacked.00407648 ASCII "ErrorControl"
00401BFB PUSH unpacked.0040763C ASCII "ImagePath"
00401C06 PUSH unpacked.00407630 ASCII "LocalSystem"
00401C11 PUSH unpacked.00407624 ASCII "ObjectName"
00401C24 PUSH unpacked.0040761C ASCII "Start"
00401C3A PUSH unpacked.00407614 ASCII "Type"
00401CD5 PUSH unpacked.00407694 ASCII "SeDebugPrivilege"
00401D36 PUSH unpacked.004076B4 ASCII "LoadLibraryA"
00401D3B PUSH unpacked.004076A8 ASCII "kernel32"
00401D7D MOV ESI,unpacked.00407708 ASCII "UnknownProcess"
00401D99 MOV ESI,unpacked.004076FC ASCII "psapi.dll"
00401DCB PUSH unpacked.004076EC ASCII "EnumProcesses"
00401DD3 PUSH unpacked.004076D8 ASCII "EnumProcessModules"
00401DDD PUSH unpacked.004076C4 ASCII "GetModuleBaseNameA"
00403158 ASCII "D0",0
004032D0 ASCII "urlmon.dll",0
004032DC ASCII "WININET.dll",0
004032E8 ASCII "WS2_32.dll",0
0040377A ASCII "SHLWAPI.dll",0
00404050 ASCII "PE",0
0040414A ASCII "/'0",0
00404172 ASCII "/'1",0
00404178 ASCII "
I",0
00404180 ASCII "R(",0
004041E0 ASCII ".text",0
00404207 ASCII "`.rdata",0
0040426E UNICODE "VS_VERSI"
0040427E UNICODE "ON_INFO",0
004042CA UNICODE "StringFi"
004042DA UNICODE "leInfo",0
004042EE UNICODE "040904E4"
004042FE UNICODE 0
00404306 UNICODE "CompanyN"
00404316 UNICODE "ame",0
00404320 UNICODE "Microsof"
00404330 UNICODE "t Corpor"
00404340 UNICODE "ation",0
00404352 UNICODE "LegalCop"
00404362 UNICODE "yright",0
00404370 UNICODE "(C) Micr"
00404380 UNICODE "osoft Co"
00404390 UNICODE "rporatio"
004043A0 UNICODE "n. All r"
004043B0 UNICODE "ights re"
004043C0 UNICODE "served.",0
004043D6 UNICODE "ProductN"
004043E6 UNICODE "ame",0
004043F0 UNICODE "Microsof"
00404400 UNICODE "t(R) Win"
00404410 UNICODE "dows(R) "
00404420 UNICODE "Operatin"
00404430 UNICODE "g System"
00404440 UNICODE 0
0040444A UNICODE "VarFileI"
0040445A UNICODE "nfo",0
0040446A UNICODE "Translat"
0040447A UNICODE "ion",0
00404488 ASCII "Z ",0
00404674 ASCII "KERNEL32.DLL",0
00404681 ASCII "URLMON.DLL",0
0040468C ASCII "WININET.DLL",0
00404698 ASCII "WS2_32.DLL",0
004046A3 ASCII "MSVCRT.DLL",0
004046AE ASCII "USER32.DLL",0
004046B9 ASCII "ADVAPI32.DLL",0
004046C6 ASCII "SHELL32.DLL",0
004046D2 ASCII "OLE32.DLL",0
004046DC ASCII "SHLWAPI.DLL",0
004046EA ASCII "LoadLibraryA",0
004046F9 ASCII "GetProcAddress",0
0040470A ASCII "VirtualProtect",0
0040471B ASCII "VirtualAlloc",0
0040472A ASCII "VirtualFree",0
00404738 ASCII "ExitProcess",0
00404746 ASCII "URLDownloadToFil"
00404756 ASCII "eA",0
0040475B ASCII "DeleteUrlCacheEn"
0040476B ASCII "try",0
00404771 ASCII "atoi",0
00404778 ASCII "CharUpperA",0
00404785 ASCII "RegDeleteKeyA",0
00404795 ASCII "SHGetSpecialFold"
004047A5 ASCII "erPathA",0
004047AF ASCII "CoCreateGuid",0
004047BE ASCII "StrCmpNIA",0
004047DB ASCII "u ",0
0040507B ASCII "U.X-.]_",0
0040512A ASCII "qq.dll",0
00405131 ASCII "_DllMain@12",0
00405EE3 ASCII "+F",0
00406078 ASCII "u$yYw",0
004064D8 ASCII ".G",0
00406569 ASCII "X6"
004069DC ASCII "nG?
00406A64 ASCII "kowinIe",0
00406B64 ASCII "kowinIeB",0
00406C64 ASCII "kowinIe",0
00406D64 ASCII "kowin.exe",0
00406E64 ASCII "kowin.exe",0
00406F64 ASCII "kowin",0
00407064 ASCII "kowin",0
00407164 ASCII "kowin.dll",0
00407264 ASCII "kowin.exe",0
00407364 ASCII "winlogon.exe",0
00407464 ASCII "explorer.exe",0
00407564 ASCII "del %0
",0
00407570 ASCII "" goto selfkill
"
00407580 ASCII "
",0
00407584 ASCII "if exist "",0
00407590 ASCII ""
",0
00407594 ASCII "del /F /Q "",0
004075A0 ASCII ":selfkill
",0
004075AC ASCII "@echo off
",0
004075B8 ASCII "delme.bat",0
004075C8 ASCII " -k",0
004075CC ASCII "-k",0
004075D0 ASCII "open",0
004075D8 ASCII "explorer.exe",0
004075E8 ASCII "%c:\",0
004075F0 ASCII ".DLL",0
004075F8 ASCII ".EXE",0
00407600 ASCII "auto.exe",0
0040760C ASCII "c:\",0
00407610 ASCII "%x",0
00407614 ASCII "Type",0
0040761C ASCII "Start",0
00407624 ASCII "ObjectName",0
00407630 ASCII "LocalSystem",0
0040763C ASCII "ImagePath",0
00407648 ASCII "ErrorControl",0
00407658 ASCII "DisplayName",0
00407664 ASCII "Description",0
00407670 ASCII "SYSTEM\CurrentCo"
00407680 ASCII "ntrolSet\Service"
00407690 ASCII "s\",0
母本未能逃过卡7的启发,那么之后的版本仅仅是加壳改特征一般是套不过的,卡7是仿真器,原理上和其他的启发是有出入的
[ 本帖最后由 pluto1313 于 2007-6-28 22:17 编辑 ] |