10个flash马！【样本】

sanhu35

先发图，没人发过 我再发！
顺便问下恶意的flash怎么解
用Imperator 转fla找不到地址 或 程序崩溃
SWFDecompiler 解只能看到恶意代码

[ 本帖最后由 sanhu35 于 2008-6-9 18:17 编辑 ]

a369258147

样本呢

sbbdms

Kaspersky miss all!!!!

TO KL

[ 本帖最后由 sbbdms 于 2008-6-9 18:16 编辑 ]

aerbeisi

C:\test\flash网马.rar ?RAR ?flash网马\f16.swf - SWF/Exploit.CVE-2007-0071 木马
C:\test\flash网马.rar ?RAR ?flash网马\f28.swf - SWF/Exploit.CVE-2007-0071 木马
C:\test\flash网马.rar ?RAR ?flash网马\f45.swf - SWF/Exploit.CVE-2007-0071 木马
C:\test\flash网马.rar ?RAR ?flash网马\f47.swf - SWF/Exploit.CVE-2007-0071 木马
C:\test\flash网马.rar ?RAR ?flash网马\i115.swf - SWF/Exploit.CVE-2007-0071 木马
C:\test\flash网马.rar ?RAR ?flash网马\i16.swf - SWF/Exploit.CVE-2007-0071 木马
C:\test\flash网马.rar ?RAR ?flash网马\i28.swf - SWF/Exploit.CVE-2007-0071 木马
C:\test\flash网马.rar ?RAR ?flash网马\i45.swf - SWF/Exploit.CVE-2007-0071 木马
C:\test\flash网马.rar ?RAR ?flash网马\i47.swf - SWF/Exploit.CVE-2007-0071 木马
C:\test\flash网马.rar ?RAR ?flash网马\i64.swf - SWF/Exploit.CVE-2007-0071 木马
已扫描的文件数目：10
已发现的病毒数目：10
完成时间： 18:16:29 总扫描时间：0 秒 (00:00:00)

a750828

McAfee Exploit-CVE2007-0071

hahacomcn

Begin scan in 'C:\Documents and Settings\haha\桌面\flash网马.rar'
C:\Documents and Settings\haha\桌面\flash网马.rar
  [0] Archive type: RAR
发表帖子[完成    --> flashￍ?ￂ￭\f16.swf
      [1] Archive type: SWC
      --> Object
          [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
后可按 Ctrl+Ente    --> flashￍ?ￂ￭\f28.swf
      [1] Archive type: SWC
      --> Object
          [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
r 发布]  预览帖子    --> flashￍ?ￂ￭\f45.swf
      [1] Archive type: SWC
      --> Object
          [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
  恢复数据  清空    --> flashￍ?ￂ￭\f47.swf
      [1] Archive type: SWC
      --> Object
          [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
内容 默    --> flashￍ?ￂ￭\i115.swf
      [1] Archive type: SWC
      --> Object
          [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
认表情     --> flashￍ?ￂ￭\i16.swf
      [1] Archive type: SWC
      --> Object
          [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
    --> flashￍ?ￂ￭\i28.swf
      [1] Archive type: SWC
      --> Object
          [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
    --> flashￍ?ￂ￭\i45.swf
      [1] Archive type: SWC
      --> Object
          [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
    --> flashￍ?ￂ￭\i47.swf
      [1] Archive type: SWC
      --> Object
          [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
    --> flashￍ?ￂ￭\i64.swf
      [1] Archive type: SWC
      --> Object
          [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
      [NOTE]      A backup was created as '48ae043c.qua'  ( QUARANTINE )


End of the scan: 2008年6月9日  18:20
Used time: 00:02 min

The scan has been done completely.

      0 Scanning directories
     11 Files were scanned
     10 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      1 Archives were scanned
      0 Warnings
      1 Notes

qigang

RS20.48未杀！

N3Hp

终于有样本了
看看

wuyuqi

卡巴没用了。什么都扫描不出来

change_018

卡巴飘