收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › 疑似PUA
12
返回列表 发新帖
楼主: 白露为霜
 收起左侧

[可疑文件] 疑似PUA

[复制链接]
zl181503
发表于 2015-8-4 21:33:32 | 显示全部楼层
过360
回复

举报

开开心心卖手机
发表于 2015-8-4 21:56:24 | 显示全部楼层
avast miss
回复

举报

神迹般存在
发表于 2015-8-6 21:28:07 | 显示全部楼层
KIS missed.
KSN of 去启动框.exe:

KSN of 原版.exe:

KSN of 正式版.exe:

All first appear 2 years ago.
Have sent to KL.
文件分析结果：
去启动框.exe：
[mw_shl_code=css,true]基本信息
文件名称：       
去启动框.exe
MD5：        fc497859b8068cc542cd98ec950b3b4f
文件类型：        EXE
上传时间：        2015-08-06 21:23:47
出品公司：        中国爱代{过}{滤}理
版本：        0.0.0.1025---0.00.1025
壳或编译器信息：        COMPILER:Microsoft Visual Basic 5.0 / 6.0
关键行为
行为描述：        写权限映射文件
详情信息：       
CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.MarshalInterface.FileMap.ACI..JJOHG
MSCTF.MarshalInterface.FileMap.ACI.B.ILOHG
MSCTF.MarshalInterface.FileMap.ACI.C.ILOHG
MSCTF.MarshalInterface.FileMap.ACI.D.ILOHG
MSCTF.MarshalInterface.FileMap.ACI.E.HMOHG
MSCTF.MarshalInterface.FileMap.ACI.F.HMOHG
MSCTF.MarshalInterface.FileMap.ACI.G.HMOHG
DfSharedHeap7E498
\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFE49D.tmp
DfRoot00007E498
\WINDOWS\system32\zh-cn\ieframe.dll.mui
Local\UrlZonesSM_Administrator
MSCTF.Shared.SFM.ACI
Local\!PrivacIE!SharedMem!Counter
行为描述：        设置特殊文件夹属性
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
C:\Documents and Settings\Administrator\IETldCache
行为描述：        隐藏指定窗口
详情信息：       
[Window,Class] = [,Shell Embedding]
[Window,Class] = [版块列表,ThunderRT6Frame]
[Window,Class] = [中国爱代{过}{滤}理顶帖机-支持论坛类型Discuz和PHPwind,试用时会不定时退出,需再测试请重新运行!,ThunderRT6FormDC]
文件行为
行为描述：        写权限映射文件
详情信息：       
CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.MarshalInterface.FileMap.ACI..JJOHG
MSCTF.MarshalInterface.FileMap.ACI.B.ILOHG
MSCTF.MarshalInterface.FileMap.ACI.C.ILOHG
MSCTF.MarshalInterface.FileMap.ACI.D.ILOHG
MSCTF.MarshalInterface.FileMap.ACI.E.HMOHG
MSCTF.MarshalInterface.FileMap.ACI.F.HMOHG
MSCTF.MarshalInterface.FileMap.ACI.G.HMOHG
DfSharedHeap7E498
\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFE49D.tmp
DfRoot00007E498
\WINDOWS\system32\zh-cn\ieframe.dll.mui
Local\UrlZonesSM_Administrator
MSCTF.Shared.SFM.ACI
Local\!PrivacIE!SharedMem!Counter
行为描述：        设置特殊文件夹属性
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
C:\Documents and Settings\Administrator\IETldCache
行为描述：        修改文件内容
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\navcancl[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\navcancl[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\ErrorPageTemplate[2]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\errorPageStrings[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\httpErrorPagesScripts[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\background_gradient[2]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\info_48[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\bullet[3]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\ErrorPageTemplate[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\errorPageStrings[2]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\httpErrorPagesScripts[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\background_gradient[3]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\info_48[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\bullet[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\dnserrordiagoff_webOC[1]---> Offset = 0
行为描述：        查找文件
详情信息：       
FileName = C:\Documents and Settings
FileName = C:\Documents and Settings\Administrator
FileName = C:\Documents and Settings\Administrator\Local Settings
FileName = C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
FileName = C:\WINDOWS\system32\Ras\*.pbk
FileName = C:\Documents and Settings\Administrator\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
FileName = c:\monitor\max.txt
FileName = c:\monitor\帖子列表.txt
FileName = c:\monitor\回复内容.txt
FileName = C:\WINDOWS
FileName = C:\WINDOWS\system32
FileName = C:\WINDOWS\system32\ieframe.dll
FileName = c:\monitor\idaili.txt
FileName = c:\monitor\idaili2.txt
FileName = C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012015070820150709\*.*
网络行为
行为描述：        连接指定站点
详情信息：       
InternetConnectA: ServerName = www.yichunz.com, PORT = 80
InternetConnectA: ServerName = www.idaili.cn, PORT = 80
InternetConnectA: ServerName = www.time.ac.cn, PORT = 80
行为描述：        建立到一个指定的套接字连接
详情信息：       
127.0.0.1:1034
行为描述：        打开HTTP请求
详情信息：       
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x0000048c
HttpOpenRequestA: www.idaili.cn:80/soft/wc.asp?ver=1025, hConnect = 0x0000032c
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x0000032c
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x0000041c
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x00000304
HttpOpenRequestA: www.time.ac.cn:80/stime.asp, hConnect = 0x00000330
HttpOpenRequestA: www.time.ac.cn:80/stime.asp, hConnect = 0x00000304
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x000002e4
注册表行为
行为描述：        修改注册表
详情信息：       
\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
行为描述：        删除注册表键值_IE连接设置
详情信息：       
\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
其他行为
行为描述：        创建互斥体
详情信息：       
CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
RasPbFile
MSCTF.Shared.MUTEX.AEH
Local\ZonesCounterMutex
Local\ZoneAttributeCacheCounterMutex
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
MSCTF.Shared.MUTEX.ACI
Local\!PrivacIE!SharedMemory!Mutex
MSIMGSIZECacheMutex
行为描述：        隐藏指定窗口
详情信息：       
[Window,Class] = [,Shell Embedding]
[Window,Class] = [版块列表,ThunderRT6Frame]
[Window,Class] = [中国爱代{过}{滤}理顶帖机-支持论坛类型Discuz和PHPwind,试用时会不定时退出,需再测试请重新运行!,ThunderRT6FormDC]
行为描述：        查找指定窗口
详情信息：       
NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
NtUserFindWindowEx: [Class,Window] = [MS_AutodialMonitor,]
NtUserFindWindowEx: [Class,Window] = [MS_WebCheckMonitor,]
NtUserFindWindowEx: [Class,Window] = [OleMainThreadWndClass,]
行为描述：        获取TickCount值
详情信息：       
TickCount = 489078, SleepMilliseconds = 60000.
TickCount = 489093, SleepMilliseconds = 60000.
行为描述：        窗口信息
详情信息：       
Pid = 2076, Hwnd=0x50230, Text = 确定, ClassName = Button.
Pid = 2076, Hwnd=0x501bc, Text = 软件已经到期，功能受限，请联系中国爱代{过}{滤}理客服qq15340554重新下载或者购买！, ClassName = Static.
Pid = 2076, Hwnd=0x40250, Text = 中国爱代{过}{滤}理, ClassName = #32770.
Pid = 2076, Hwnd=0x103a2, Text = 确定, ClassName = Button.
Pid = 2076, Hwnd=0x103a4, Text = 请解压缩到文件夹运行，补齐其它配置文件！ , ClassName = Static.
Pid = 2076, Hwnd=0x5036e, Text = 中国爱代{过}{滤}理, ClassName = #32770.
Pid = 2076, Hwnd=0x3021a, Text = Command16, ClassName = ThunderRT6CommandButton.
Pid = 2076, Hwnd=0x301e0, Text = Text5, ClassName = ThunderRT6TextBox.
Pid = 2076, Hwnd=0x30220, Text = Text4, ClassName = ThunderRT6TextBox.
Pid = 2076, Hwnd=0x30238, Text = 关网页提示, ClassName = ThunderRT6CheckBox.
Pid = 2076, Hwnd=0x4022e, Text = 提取模式不重复提取, ClassName = ThunderRT6CheckBox.
Pid = 2076, Hwnd=0x30244, Text = 定位到上一次位置, ClassName = ThunderRT6CommandButton.
Pid = 2076, Hwnd=0x301de, Text = 08:00:00, ClassName = ThunderRT6TextBox.
Pid = 2076, Hwnd=0x901b0, Text = 定时启动, ClassName = ThunderRT6CheckBox.
Pid = 2076, Hwnd=0x50254, Text = 0, ClassName = ThunderRT6TextBox.
行为描述：        调用Sleep函数
详情信息：       
[1]: MilliSeconds = 60000.
[2]: MilliSeconds = 0.
[3]: MilliSeconds = 0.
[4]: MilliSeconds = 0.
[5]: MilliSeconds = 0.
[6]: MilliSeconds = 0.
[7]: MilliSeconds = 0.
[8]: MilliSeconds = 0.
异常崩溃
异常崩溃：        程序异常崩溃信息
详情信息：       
EAX=0x00000000, EBX=0x00000000, ECX=0x00000000, EDX=0x80020004,ESI=0x01151E94, EDI=0x00000001, EBP=0x0012FD94, ESP=0x0012FA34,EIP=0x0046081F, ExceptionCode=0xC0000005(ACCESS_VIOLATION),ExceptionModule=c:\%temp%\1438867479.116141.exe
Disassembly:
0x0046081F: mov edx, dword ptr [ecx]
0x00460821: mov eax, dword ptr [ebp-000001D4h]
0x00460827: push eax
0x00460828: call dword ptr [edx+000002B0h]
0x0046082E: fnclex
0x00460830: mov dword ptr [ebp-000001D8h], eax
0x00460836: cmp dword ptr [ebp-000001D8h], 00000000h
0x0046083D: jnl 00460865h
0x0046083F: push 000002B0h
0x00460844: push 0040B344h
0x00460849: mov ecx, dword ptr [ebp-000001D4h]
0x0046084F: push ecx
[/mw_shl_code]
运行截图

原版.exe：
[mw_shl_code=css,true]基本信息
文件名称：       
原版.exe
MD5：        491cd5c2580dcf19b4b39e4dca7de83e
文件类型：        EXE
上传时间：        2015-08-06 21:23:53
出品公司：        中国爱代{过}{滤}理
版本：        0.0.0.1025---0.00.1025
壳或编译器信息：        COMPILER:Microsoft Visual Basic 5.0 / 6.0
关键行为
行为描述：        写权限映射文件
详情信息：       
CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.MarshalInterface.FileMap.ACI..HMOHG
MSCTF.MarshalInterface.FileMap.ACI.B.HMOHG
MSCTF.MarshalInterface.FileMap.ACI.C.HMOHG
MSCTF.MarshalInterface.FileMap.ACI.D.HMOHG
MSCTF.MarshalInterface.FileMap.ACI.E.HMOHG
MSCTF.MarshalInterface.FileMap.ACI.F.HMOHG
MSCTF.MarshalInterface.FileMap.ACI.G.HNOHG
DfSharedHeap7E488
\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFE48B.tmp
DfRoot00007E488
\WINDOWS\system32\zh-cn\ieframe.dll.mui
Local\UrlZonesSM_Administrator
MSCTF.Shared.SFM.ACI
Local\!PrivacIE!SharedMem!Counter
行为描述：        设置特殊文件夹属性
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
C:\Documents and Settings\Administrator\IETldCache
行为描述：        隐藏指定窗口
详情信息：       
[Window,Class] = [,Shell Embedding]
[Window,Class] = [版块列表,ThunderRT6Frame]
[Window,Class] = [中国爱代{过}{滤}理顶帖机-支持论坛类型Discuz和PHPwind,试用时会不定时退出,需再测试请重新运行!,ThunderRT6FormDC]
文件行为
行为描述：        写权限映射文件
详情信息：       
CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.MarshalInterface.FileMap.ACI..HMOHG
MSCTF.MarshalInterface.FileMap.ACI.B.HMOHG
MSCTF.MarshalInterface.FileMap.ACI.C.HMOHG
MSCTF.MarshalInterface.FileMap.ACI.D.HMOHG
MSCTF.MarshalInterface.FileMap.ACI.E.HMOHG
MSCTF.MarshalInterface.FileMap.ACI.F.HMOHG
MSCTF.MarshalInterface.FileMap.ACI.G.HNOHG
DfSharedHeap7E488
\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFE48B.tmp
DfRoot00007E488
\WINDOWS\system32\zh-cn\ieframe.dll.mui
Local\UrlZonesSM_Administrator
MSCTF.Shared.SFM.ACI
Local\!PrivacIE!SharedMem!Counter
行为描述：        设置特殊文件夹属性
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
C:\Documents and Settings\Administrator\IETldCache
行为描述：        修改文件内容
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\navcancl[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\navcancl[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\ErrorPageTemplate[2]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\errorPageStrings[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\httpErrorPagesScripts[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\background_gradient[2]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\info_48[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\ErrorPageTemplate[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\errorPageStrings[2]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\httpErrorPagesScripts[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\background_gradient[3]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\info_48[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\bullet[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\bullet[2]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\dnserrordiagoff_webOC[1]---> Offset = 0
行为描述：        查找文件
详情信息：       
FileName = C:\Documents and Settings
FileName = C:\Documents and Settings\Administrator
FileName = C:\Documents and Settings\Administrator\Local Settings
FileName = C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
FileName = C:\WINDOWS\system32\Ras\*.pbk
FileName = C:\Documents and Settings\Administrator\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
FileName = c:\monitor\max.txt
FileName = c:\monitor\帖子列表.txt
FileName = c:\monitor\回复内容.txt
FileName = C:\WINDOWS
FileName = C:\WINDOWS\system32
FileName = C:\WINDOWS\system32\ieframe.dll
FileName = c:\monitor\idaili.txt
FileName = c:\monitor\idaili2.txt
FileName = C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012015070820150709\*.*
网络行为
行为描述：        连接指定站点
详情信息：       
InternetConnectA: ServerName = www.yichunz.com, PORT = 80
InternetConnectA: ServerName = www.idaili.cn, PORT = 80
InternetConnectA: ServerName = www.time.ac.cn, PORT = 80
行为描述：        建立到一个指定的套接字连接
详情信息：       
127.0.0.1:1034
行为描述：        打开HTTP请求
详情信息：       
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x000004a4
HttpOpenRequestA: www.idaili.cn:80/soft/wc.asp?ver=1025, hConnect = 0x00000374
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x00000374
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x0000041c
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x0000037c
HttpOpenRequestA: www.time.ac.cn:80/stime.asp, hConnect = 0x000004e4
HttpOpenRequestA: www.time.ac.cn:80/stime.asp, hConnect = 0x0000037c
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x000002e8
注册表行为
行为描述：        修改注册表
详情信息：       
\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
行为描述：        删除注册表键值_IE连接设置
详情信息：       
\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
其他行为
行为描述：        创建互斥体
详情信息：       
CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
RasPbFile
MSCTF.Shared.MUTEX.AEH
Local\ZonesCounterMutex
Local\ZoneAttributeCacheCounterMutex
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
MSCTF.Shared.MUTEX.ACI
Local\!PrivacIE!SharedMemory!Mutex
Local\c:!documents and settings!administrator!ietldcache!
行为描述：        隐藏指定窗口
详情信息：       
[Window,Class] = [,Shell Embedding]
[Window,Class] = [版块列表,ThunderRT6Frame]
[Window,Class] = [中国爱代{过}{滤}理顶帖机-支持论坛类型Discuz和PHPwind,试用时会不定时退出,需再测试请重新运行!,ThunderRT6FormDC]
行为描述：        查找指定窗口
详情信息：       
NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
NtUserFindWindowEx: [Class,Window] = [MS_AutodialMonitor,]
NtUserFindWindowEx: [Class,Window] = [MS_WebCheckMonitor,]
NtUserFindWindowEx: [Class,Window] = [OleMainThreadWndClass,]
行为描述：        获取TickCount值
详情信息：       
TickCount = 489218, SleepMilliseconds = 60000.
TickCount = 489234, SleepMilliseconds = 60000.
行为描述：        窗口信息
详情信息：       
Pid = 2076, Hwnd=0x50230, Text = 确定, ClassName = Button.
Pid = 2076, Hwnd=0x501bc, Text = 软件已经到期，功能受限，请联系中国爱代{过}{滤}理客服qq15340554重新下载或者购买！, ClassName = Static.
Pid = 2076, Hwnd=0x40250, Text = 中国爱代{过}{滤}理, ClassName = #32770.
Pid = 2076, Hwnd=0x103a2, Text = 确定, ClassName = Button.
Pid = 2076, Hwnd=0x103a4, Text = 请解压缩到文件夹运行，补齐其它配置文件！ , ClassName = Static.
Pid = 2076, Hwnd=0x5036e, Text = 中国爱代{过}{滤}理, ClassName = #32770.
Pid = 2076, Hwnd=0x601bc, Text = 注意：出现此窗口时为程序授权已经失效，程序会不定时退出且回复加插广告，原因可能是更换了电脑、网卡等,请联系客服重新授权QQ：15340554, ClassName = ThunderRT6TextBox.
Pid = 2076, Hwnd=0x4023c, Text = 免费试用, ClassName = ThunderRT6CommandButton.
Pid = 2076, Hwnd=0x60214, Text = 论坛帮助, ClassName = ThunderRT6CommandButton.
Pid = 2076, Hwnd=0x5020a, Text = 软件注册, ClassName = ThunderRT6CommandButton.
Pid = 2076, Hwnd=0x50208, Text = 复制机器码, ClassName = ThunderRT6CommandButton.
Pid = 2076, Hwnd=0x60212, Text = <复制上面的机器码>发给作者,获得注册码！, ClassName = ThunderRT6TextBox.
Pid = 2076, Hwnd=0x301f0, Text = 10327041821213313107, ClassName = ThunderRT6TextBox.
Pid = 2076, Hwnd=0x50250, Text = 中国爱代{过}{滤}理顶帖机-支持论坛类型Discuz和PHPwind,试用时会不定时退出,需再测试请重新运行!, ClassName = ThunderRT6FormDC.
Pid = 2076, Hwnd=0x3021a, Text = Command16, ClassName = ThunderRT6CommandButton.
行为描述：        调用Sleep函数
详情信息：       
[1]: MilliSeconds = 60000.
[2]: MilliSeconds = 0.
[3]: MilliSeconds = 0.
[4]: MilliSeconds = 0.
[5]: MilliSeconds = 0.
[6]: MilliSeconds = 0.
[7]: MilliSeconds = 0.
[/mw_shl_code]
运行截图

正式版.exe：
[mw_shl_code=css,true]基本信息
文件名称：       
正式版.exe
MD5：        7a11da5f0f35883ab00209fbc9ccd9e2
文件类型：        EXE
上传时间：        2015-08-06 21:24:03
出品公司：        中国爱代{过}{滤}理
版本：        0.0.0.1025---0.00.1025
壳或编译器信息：        COMPILER:Microsoft Visual Basic 5.0 / 6.0
关键行为
行为描述：        写权限映射文件
详情信息：       
CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.MarshalInterface.FileMap.ACI..KGOHG
MSCTF.MarshalInterface.FileMap.ACI.B.JHOHG
MSCTF.MarshalInterface.FileMap.ACI.C.JHOHG
MSCTF.MarshalInterface.FileMap.ACI.D.JHOHG
MSCTF.MarshalInterface.FileMap.ACI.E.JHOHG
MSCTF.MarshalInterface.FileMap.ACI.F.JHOHG
MSCTF.MarshalInterface.FileMap.ACI.G.JHOHG
DfSharedHeap7E4BC
\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFE4BF.tmp
DfRoot00007E4BC
\WINDOWS\system32\zh-cn\ieframe.dll.mui
Local\UrlZonesSM_Administrator
MSCTF.Shared.SFM.ACI
Local\!PrivacIE!SharedMem!Counter
行为描述：        设置特殊文件夹属性
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
C:\Documents and Settings\Administrator\IETldCache
行为描述：        隐藏指定窗口
详情信息：       
[Window,Class] = [,Shell Embedding]
[Window,Class] = [版块列表,ThunderRT6Frame]
[Window,Class] = [中国爱代{过}{滤}理顶帖机-支持论坛类型Discuz和PHPwind,试用时会不定时退出,需再测试请重新运行!,ThunderRT6FormDC]
文件行为
行为描述：        写权限映射文件
详情信息：       
CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.MarshalInterface.FileMap.ACI..KGOHG
MSCTF.MarshalInterface.FileMap.ACI.B.JHOHG
MSCTF.MarshalInterface.FileMap.ACI.C.JHOHG
MSCTF.MarshalInterface.FileMap.ACI.D.JHOHG
MSCTF.MarshalInterface.FileMap.ACI.E.JHOHG
MSCTF.MarshalInterface.FileMap.ACI.F.JHOHG
MSCTF.MarshalInterface.FileMap.ACI.G.JHOHG
DfSharedHeap7E4BC
\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFE4BF.tmp
DfRoot00007E4BC
\WINDOWS\system32\zh-cn\ieframe.dll.mui
Local\UrlZonesSM_Administrator
MSCTF.Shared.SFM.ACI
Local\!PrivacIE!SharedMem!Counter
行为描述：        设置特殊文件夹属性
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
C:\Documents and Settings\Administrator\IETldCache
行为描述：        修改文件内容
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\navcancl[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\navcancl[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\ErrorPageTemplate[2]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\errorPageStrings[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\httpErrorPagesScripts[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\ErrorPageTemplate[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\errorPageStrings[2]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\httpErrorPagesScripts[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\background_gradient[2]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\info_48[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\bullet[3]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\background_gradient[3]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\info_48[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\bullet[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\dnserrordiagoff_webOC[1]---> Offset = 0
行为描述：        查找文件
详情信息：       
FileName = C:\Documents and Settings
FileName = C:\Documents and Settings\Administrator
FileName = C:\Documents and Settings\Administrator\Local Settings
FileName = C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
FileName = C:\WINDOWS\system32\Ras\*.pbk
FileName = C:\Documents and Settings\Administrator\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
FileName = c:\monitor\max.txt
FileName = c:\monitor\帖子列表.txt
FileName = c:\monitor\回复内容.txt
FileName = C:\WINDOWS
FileName = C:\WINDOWS\system32
FileName = C:\WINDOWS\system32\ieframe.dll
FileName = c:\monitor\idaili.txt
FileName = c:\monitor\idaili2.txt
FileName = C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012015070820150709\*.*
网络行为
行为描述：        连接指定站点
详情信息：       
InternetConnectA: ServerName = www.yichunz.com, PORT = 80
InternetConnectA: ServerName = www.idaili.cn, PORT = 80
InternetConnectA: ServerName = www.time.ac.cn, PORT = 80
行为描述：        建立到一个指定的套接字连接
详情信息：       
127.0.0.1:1034
行为描述：        打开HTTP请求
详情信息：       
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x0000048c
HttpOpenRequestA: www.idaili.cn:80/soft/wc.asp?ver=1025, hConnect = 0x00000364
HttpOpenRequestA: www.idaili.cn:80/soft/wc.asp?ver=1025, hConnect = 0x000003f0
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x000003f0
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x0000041c
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x0000032c
HttpOpenRequestA: www.time.ac.cn:80/stime.asp, hConnect = 0x000003c8
HttpOpenRequestA: www.time.ac.cn:80/stime.asp, hConnect = 0x0000032c
HttpOpenRequestA: www.yichunz.com:80/seo2.asp, hConnect = 0x000002e8
注册表行为
行为描述：        修改注册表
详情信息：       
\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
行为描述：        删除注册表键值_IE连接设置
详情信息：       
\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
其他行为
行为描述：        创建互斥体
详情信息：       
CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
RasPbFile
MSCTF.Shared.MUTEX.AEH
Local\ZonesCounterMutex
Local\ZoneAttributeCacheCounterMutex
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
MSCTF.Shared.MUTEX.ACI
Local\!PrivacIE!SharedMemory!Mutex
Local\c:!documents and settings!administrator!ietldcache!
行为描述：        隐藏指定窗口
详情信息：       
[Window,Class] = [,Shell Embedding]
[Window,Class] = [版块列表,ThunderRT6Frame]
[Window,Class] = [中国爱代{过}{滤}理顶帖机-支持论坛类型Discuz和PHPwind,试用时会不定时退出,需再测试请重新运行!,ThunderRT6FormDC]
行为描述：        查找指定窗口
详情信息：       
NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
NtUserFindWindowEx: [Class,Window] = [MS_AutodialMonitor,]
NtUserFindWindowEx: [Class,Window] = [MS_WebCheckMonitor,]
NtUserFindWindowEx: [Class,Window] = [OleMainThreadWndClass,]
行为描述：        获取TickCount值
详情信息：       
TickCount = 489015, SleepMilliseconds = 60000.
TickCount = 489031, SleepMilliseconds = 60000.
TickCount = 489046, SleepMilliseconds = 60000.
TickCount = 489062, SleepMilliseconds = 60000.
TickCount = 489078, SleepMilliseconds = 60000.
TickCount = 489093, SleepMilliseconds = 60000.
TickCount = 489109, SleepMilliseconds = 60000.
行为描述：        获取光标位置
详情信息：       
CursorPos = (44,18468), SleepMilliseconds = 60000.
CursorPos = (6337,26501), SleepMilliseconds = 60000.
行为描述：        窗口信息
详情信息：       
Pid = 2076, Hwnd=0x50230, Text = 确定, ClassName = Button.
Pid = 2076, Hwnd=0x501bc, Text = 软件已经到期，功能受限，请联系中国爱代{过}{滤}理客服qq15340554重新下载或者购买！, ClassName = Static.
Pid = 2076, Hwnd=0x40250, Text = 中国爱代{过}{滤}理, ClassName = #32770.
Pid = 2076, Hwnd=0x103a2, Text = 确定, ClassName = Button.
Pid = 2076, Hwnd=0x103a4, Text = 请解压缩到文件夹运行，补齐其它配置文件！ , ClassName = Static.
Pid = 2076, Hwnd=0x5036e, Text = 中国爱代{过}{滤}理, ClassName = #32770.
Pid = 2076, Hwnd=0x3021a, Text = Command16, ClassName = ThunderRT6CommandButton.
Pid = 2076, Hwnd=0x301e0, Text = Text5, ClassName = ThunderRT6TextBox.
Pid = 2076, Hwnd=0x30220, Text = Text4, ClassName = ThunderRT6TextBox.
Pid = 2076, Hwnd=0x30238, Text = 关网页提示, ClassName = ThunderRT6CheckBox.
Pid = 2076, Hwnd=0x4022e, Text = 提取模式不重复提取, ClassName = ThunderRT6CheckBox.
Pid = 2076, Hwnd=0x30244, Text = 定位到上一次位置, ClassName = ThunderRT6CommandButton.
Pid = 2076, Hwnd=0x301de, Text = 08:00:00, ClassName = ThunderRT6TextBox.
Pid = 2076, Hwnd=0x901b0, Text = 定时启动, ClassName = ThunderRT6CheckBox.
Pid = 2076, Hwnd=0x50254, Text = 0, ClassName = ThunderRT6TextBox.
行为描述：        调用Sleep函数
详情信息：       
[1]: MilliSeconds = 60000.
[2]: MilliSeconds = 0.
[3]: MilliSeconds = 0.
[4]: MilliSeconds = 0.
[5]: MilliSeconds = 0.
[6]: MilliSeconds = 0.
[7]: MilliSeconds = 0.
[8]: MilliSeconds = 0.
异常崩溃
异常崩溃：        程序异常崩溃信息
详情信息：       
EAX=0x00000000, EBX=0x00000000, ECX=0x00000000, EDX=0x80020004,ESI=0x01151E94, EDI=0x00000001, EBP=0x0012FD94, ESP=0x0012FA34,EIP=0x0046081F, ExceptionCode=0xC0000005(ACCESS_VIOLATION),ExceptionModule=c:\%temp%\1438867501.899942.exe
Disassembly:
0x0046081F: mov edx, dword ptr [ecx]
0x00460821: mov eax, dword ptr [ebp-000001D4h]
0x00460827: push eax
0x00460828: call dword ptr [edx+000002B0h]
0x0046082E: fnclex
0x00460830: mov dword ptr [ebp-000001D8h], eax
0x00460836: cmp dword ptr [ebp-000001D8h], 00000000h
0x0046083D: jnl 00460865h
0x0046083F: push 000002B0h
0x00460844: push 0040B344h
0x00460849: mov ecx, dword ptr [ebp-000001D4h]
0x0046084F: push ecx[/mw_shl_code]
运行截图

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

12
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-5-21 23:24 , Processed in 0.101195 second(s), 15 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表