CF小苹果活动助手

显示全部楼层 · 发表于 2018-8-4 13:28:41

链接：https://pan.baidu.com/s/1gqx6h21Gl0IWCHOvcJBLww 密码：yhzl，我猜肯定有人用过这东西。

显示全部楼层 · 发表于 2018-8-4 13:32:36

BD miss

显示全部楼层 · 发表于 2018-8-4 13:37:50

本帖最后由 1094947421 于 2018-8-4 13:39 编辑

wd报，智量报

显示全部楼层 · 发表于 2018-8-4 14:44:23

360报高风险

显示全部楼层 · 发表于 2018-8-4 14:47:07

http://117.21.173.211:3322/
http://103.214.143.177:3322/
http://122.114.124.88/
样本里的，我只能打开2个
https://s.threatbook.cn/report/f ... p1_enx86_office2013

显示全部楼层 · 发表于 2018-8-4 14:49:01

看分析挺正常

显示全部楼层 · 发表于 2018-8-4 15:27:20

用工具脱了下壳，列出软件内包含的URL

脱壳附件:https://www.lanzous.com/i1khrhc

复制代码

http://apps.game.qq.com/
http://
https://
http://apps.game.qq.com/cf/a20170210information/getCfcashInfo.php?action=getMycas
www.123xpg.com
http://cf.ams.game.qq.com/ams/ame/amesvr?ameVersion=0.3
http://cf.ams.game.qq.com/ams/ame/amesvr?ameVersion=0.3
http://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3
http://x1m1.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3
http://x6m5.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3
http://x6m5.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3
http://comm.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3
http://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3
http://xui.ptlogin2.qq.com/cgi-bin/xlogin?appid=21000124
http://apps.game.qq.com
http://dr.game.qq.com/dr.php
http://www.baidu.com/
https://www.immomo.com/login?action=captcha
http://www.114time.com/api/clock.php
http://xui.ptlogin2.qq.com/cgi-bin/xlogin?appid=21000124
http://apps.game.qq.com
http://xui.ptlogin2.qq.com/cgi-bin/xlogin?appid=21000124
http://apps.game.qq.com
http://117.21.173.211:3322/
http://122.114.124.88/
http://103.214.143.177:3322/
http://www.123xpg.com/qiangling/
www.123xpg.com
http://love.zuhaowan.cn
http://www.123xpg.com/taobao/
http://aq.qq.com/007
http://www.cfhuodongzhushou.cn
http://www.123xpg.com/taobao/
http://www.123xpg.com
http://love.zuhaowan.cn
http://txwz.qq.com/lib/index.php?m=check
https://xui.ptlogin2.qq.com/cgi-bin/xlogin?proxy_url=https
http://check.ptlogin2.qq.com/check?regmaster=
https://ssl.captcha.qq.com/cap_union_prehandle?aid=
https://ssl.captcha.qq.com/cap_union_new_show?aid=
http://captcha.qq.com/cap_union_new_getcapbysig?aid=
https://ssl.captcha.qq.com/cap_union_new_verify
https://ssl.captcha.qq.com/cap_union_new_getsig
https://ssl.ptlogin2.qq.com/login?u=
http://i2.fuimg.com/594172/fe03c7edd75a990e.jpg
www.123xpg.com】
www.123xpg.com?
http://www.123xpg.com|
http://www.123xpg.com/ql.html?
www.dywt.com.cn
http://
http://www.baidu.com
http://www.google.com.hk
http://www.sina.com.cn
http://www.163.com
http://www.sohu.com
http://www.sogou.com
http://www.soso.com
http://www.qq.comHEAD
www.123xpg.com

复制代码

显示全部楼层 · 发表于 2018-8-4 22:33:39

显示全部楼层 · 发表于 2018-8-4 23:04:52

ESET miss

显示全部楼层 · 发表于 2018-8-5 15:04:56

https://s.threatbook.cn/report/f ... p1_enx86_office2013看来有问题啊

[可疑文件] CF小苹果活动助手

本帖子中包含更多资源

本帖子中包含更多资源