安装.exe

ssama

SHA1: 34ECF5B3BB51D373AB1F65FD6ED2CEF3A78F27C1

静影沉璧

www-tekeze 发表于 2018-10-6 23:14
连下几次，还是损坏。。

蓝奏云来了

https://www.lanzous.com/i21a61a

静影沉璧

BD2019：Gen:Variant.Graftor.519398
SEP：Heur.AdvML.C
微步云沙箱：https://s.threatbook.cn/report/f ... p1_enx86_office2013

心醉咖啡

火绒

3801187

个人感觉可能是误报

BE_HC

看了看感觉是搞QQkey（[ANSI] 0x000964c6）来盗号
这个IP:43.227.198.101详情（https://x.threatbook.cn/nodev4/ip/43.227.198.101）

1. [ANSI] 0x000960b0: account":"(.*?)","client_type":.*?,"face_index":.*?,"gender":.*?,"nickname":"(.*?),"uin":"(.*?)","uin
   
2. [ANSI] 0x00096121: 0002XM#
   
3. [ANSI] 0x00096129: 410509207
   
4. [ANSI] 0x00096164: http://localhost.ptlogin2.qq.com:4300/pt_get_uins?callback=ptui_getuins_CB&r=0.7478418888058513&pt_local_tk=0.3858416392467916
   
5. [ANSI] 0x000961e3: pt_local_token=0.3858416392467916;
   
6. [ANSI] 0x0009620d: ?GET
   
7. [ANSI] 0x00096212: POST
   
8. [ANSI] 0x00096217: HEAD
   
9. [ANSI] 0x00096228: https://
   
10. [ANSI] 0x00096231: User-Agent:
    
11. [ANSI] 0x00096240: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
    
12. [ANSI] 0x00096273: http=
    
13. [ANSI] 0x00096279: HTTP/1.1
    
14. [ANSI] 0x00096282: Accept: */*
    
15. [ANSI] 0x0009628e: Accept:
    
16. [ANSI] 0x00096298: Accept: */*
    
17. [ANSI] 0x000962a4: Referer:
    
18. [ANSI] 0x000962af: Referer:
    
19. [ANSI] 0x000962b9: Accept-Language:
    
20. [ANSI] 0x000962cc: Accept-Language: zh-cn
    
21. [ANSI] 0x000962e3: Content-Type:
    
22. [ANSI] 0x000962f3: Content-Type: application/x-www-form-urlencoded
    
23. [ANSI] 0x00096323: Cookie:
    
24. [ANSI] 0x0009632d: Cookie:
    
25. [ANSI] 0x00096336: Set-Cookie
    
26. [ANSI] 0x00096343: Set-Cookie:
    
27. [ANSI] 0x0009635c: #òyoÅ
    
28. [ANSI] 0x00096366: http://
    
29. [ANSI] 0x00096370: https
    
30. [ANSI] 0x00096376: =deleted
    
31. [ANSI] 0x00096381: &callback=ptui_getst_CB&r=0.15739138866774738&pt_local_tk=0.3858416392467916
    
32. [ANSI] 0x000963ce: http://localhost.ptlogin2.qq.com:4300/pt_get_st?clientuin=
    
33. [ANSI] 0x00096409: clientkey
    
34. [ANSI] 0x0009642f: @qq.com
    
35. [ANSI] 0x000964c6: umber/&clientkey=/QQkey/&ptlang=2052&httptype=0&ADUIN=/QQnumber/&ADSESSION=1523533342&ADTAG=CLIENT.QQ.5569_Mysrv.0&ADPUBNO=26776
    
36. [ANSI] 0x00096547: /QQnumber/
    
37. [ANSI] 0x00096552: /QQkey/
    
38. [ANSI] 0x0009655a: &r=0.2074233236566705
    
39. [ANSI] 0x00096594: 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.104 Safari/537.36 Core/1.53.4549.400 QQBrowser/9.7.12900.400
    
40. [ANSI] 0x00096615: https://mail.qq.com/cgi-bin/getverifyimage?sid=
    
41. [ANSI] 0x00096645: mail.qq.com
    
42. [ANSI] 0x00096651: &url
    
43. [ANSI] 0x00096656: &sid=
    
44. [ANSI] 0x0009665c: &fun=list&loc=frame_html,,,3
    
45. [ANSI] 0x00096679: https://mail.qq.com/cgi-bin/setting1?sid=
    
46. [ANSI] 0x000966a5: upgrade-insecure-requests:1
    
47. [ANSI] 0x000966e5: 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.104 Safari/537.36 Core/1.53.4549.400 QQBrowser/9.7.12900.400
    
48. [ANSI] 0x00096766: referer:https://mail.qq.com/cgi-bin/frame_html?sid=
    
49. [ANSI] 0x0009679a: &r=0.2074233236566705
    
50. [ANSI] 0x0009680c: penadvertsyn=1&txtformat=0&IsValid=0&atcpsubject=0&autoaddaddress=0&savesendbox=0&sendmailunicode=0&bgsend=0&QQlight=0&plpopen=1
    
51. [ANSI] 0x0009688d: &fwdbackup=0&fwaddrverifycode=
    
52. [ANSI] 0x00096ab1: fontid=0&defaultsizeid=0&defaultcolor=default&listmode=1&delflag=0&selectSign=-1&noinclude=0&titlePrefix=0&autofwd=2&fwdaddress=
    
53. [ANSI] 0x00096b32: sid=
    
54. [ANSI] 0x00096b5c: 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.104 Safari/537.36 Core/1.53.4549.400 QQBrowser/9.7.12900.400
    
55. [ANSI] 0x00096bdd: deleted
    
56. [ANSI] 0x00096c0d: [url=home.php?mod=space&uid=471048]@707[/url] éèÖÃ′úàíƾ֤꧰ü!
    
57. [ANSI] 0x00096c24: 708 ½ûÖ1×Ô¶ˉéèÖÃCookies꧰ü!
    
58. [ANSI] 0x00096c41: 709 Öض¨ÏòéèÖÃ꧰ü!
    
59. [ANSI] 0x00096c55: User-Agent:
    
60. [ANSI] 0x00096c62: User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
    
61. [ANSI] 0x00096cb7: Accept:
    
62. [ANSI] 0x00096cc0: Accept: text/html, application/xhtml+xml, */*
    
63. [ANSI] 0x00096cf0: Accept-Encoding:
    
64. [ANSI] 0x00096d02: Accept-Encoding: gbk, GB2312
    
65. [ANSI] 0x00096d21: Accept-Language:
    
66. [ANSI] 0x00096d33: Accept-Language: zh-cn
    
67. [ANSI] 0x00096d4c: Content-Type: application/x-www-form-urlencoded
    
68. [ANSI] 0x00096d7e: Cache-Control:
    
69. [ANSI] 0x00096d8e: Cache-Control: no-cache
    
70. [ANSI] 0x00096da8: Cookie:
    
71. [ANSI] 0x00096db1: 713 ¶áè¡êy¾Y꧰ü!
    
72. [ANSI] 0x00096dc9: "@Location:
    
73. [ANSI] 0x00096ddc: $@<meta.+?charset=[^\w]?([-\w]+)
    
74. [ANSI] 0x00096e01: gb2312
    
75. [ANSI] 0x00096e08: Adodb.Stream
    
76. [ANSI] 0x00096e15: Type
    
77. [ANSI] 0x00096e1a: Mode
    
78. [ANSI] 0x00096e1f: Open
    
79. [ANSI] 0x00096e24: Write
    
80. [ANSI] 0x00096e2a: Position
    
81. [ANSI] 0x00096e33: Charset
    
82. [ANSI] 0x00096e3b: ReadText
    
83. [ANSI] 0x00096e44: Close
    
84. [ANSI] 0x00096e4a: 712 ·tÎñÆ÷Î′Ïìó|!
    
85. [ANSI] 0x00096e5c: 711 ·￠ËíÇëÇó꧰ü!
    
86. [ANSI] 0x00096e6e: 710 éèÖÃD-òéí·ê§°ü!
    
87. [ANSI] 0x00096e82: 705 éèÖÃ3¬ê±ê±¼ä꧰ü!
    
88. [ANSI] 0x00096e98: 704 ′′½¨WinHttpÇëÇó꧰ü!
    
89. [ANSI] 0x00096eb1: 703 ′′½¨WinHttpᬽó꧰ü!
    
90. [ANSI] 0x00096eca: 702 ′′½¨WinHttp»á»°ê§°ü!
    
91. [ANSI] 0x00096ee3: 701 ½aÎöURLμØַ꧰ü!
    
92. [ANSI] 0x00096ef8: 700 μ±Ç°Ïμí32»Ö§3ÖWinHttp·tÎñ!
    
93. [ANSI] 0x00096f4f: ò×z>43.227.198.101
    
94. [ANSI] 0x00096f62: xyz2393413
    
95. [ANSI] 0x00096f6f: =Heyl=
    
96. [ANSI] 0x00096f76: \syenm.exe
    
97. [ANSI] 0x00096fd9: This program must be run under Win32

复制代码

----------
以下由PortEX-Master自动生成

1. PEID Signatures
   
2. ***************
   
3. 
   
4. [UPX v0.89.6 - v1.02 / v1.05 - v1.22] bytes matched: 43 at address: 0x683a20
   
5. pattern:  ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8a 06 46 88 07 47 01 db 75 07 8b 1e 83 ee fc 11 db 72 ed b8 01 ?? ?? ?? 01 db 75 07 8b 1e 83 ee fc 11 db 11 c0 01 db 73 ?? 75 ?? 8b 1e 83 ee fc
   
6. [UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser] bytes matched: 55 at address: 0x683a20
   
7. pattern:  60 be ?? ?? ?? ?? 8d be ?? ?? ?? ?? 57 83 cd ff eb 10 90 90 90 90 90 90 8a 06 46 88 07 47 01 db 75 07 8b 1e 83 ee fc 11 db 72 ed b8 01 00 00 00 01 db 75 07 8b 1e 83 ee fc 11 db 11 c0 01 db
   
8. [UPX v1.25 (Delphi) Stub] bytes matched: 8 at address: 0x683a20
   
9. pattern:  60 be 00 ?? ?? 00 8d be 00 ?? ?? ff

复制代码

Luca.l

aboringman

Dr.Web：miss.

天道酬善

EIS V11 下载kill

www-tekeze

连下几次，还是损坏。。