未知样本一个

显示全部楼层 · 发表于 2008-12-21 23:52:21

DOWN 下载时候发现一个网址带的

显示全部楼层 · 发表于 2008-12-22 00:02:19

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang='en' xml:lang='en' xmlns='http://www.w3.org/1999/xhtml'>
  <head>
<link href="https://www.ohloh.net/stylesheets/n/dl/file.css?1229560018" media="screen" rel="stylesheet" type="text/css" />
<script src="https://www.ohloh.net/javascripts/jquery-1.2.6.min.js?1229558592" type="text/javascript"></script>
<title>FileZilla Download</title>
<meta content='Ohloh, FileZilla, download, bits, open source, software, technology, developers' name='keywords' />
<meta content='Ohloh is an open source networking, connecting people through the software they write and use. Ohloh is the best place to discover, evaluate and discuss open source projects.' name='description' />
<script src="https://www.ohloh.net/javascripts/dl/main.js?1229558592" type="text/javascript"></script>

  </head>
  <body>
<div id='page'>
   <div id='compact_mast'>
      <div class='row'>
      <a class='oh' href='/'></a>
      <ul>
         <li>
            <a class='item' href='/projects'>Projects</a>
         </li>
         <li class='spc'>|</li>
         <li>
            <a class='item' href='/people'>People</a>
         </li>
         <li class='spc'>|</li>
         <li>
            <a class='item' href='/forums'>Forums</a>
         </li>
         <li class='spc'>|</li>
         <li>
            <a href="https://www.ohloh.net/accounts/new" class="session">Register</a>
         </li>
         <li class='spc'>|</li>
         <li>
            <a href="https://www.ohloh.net/sessions/new" class="session">Login</a>
         </li>
      </ul>
      </div>
   </div>
   <div class='row'>
      <script type="text/javascript">
      //<![CDATA[
      window.delayed_iframe = "<iframe id='file_download' frameborder='0' height='0' width='0' scrolling='no' src='http://d10xg45o6p6dbl.cloudfront.net/projects/f/filezilla/FileZilla_Server-0_9_29.exe'></iframe>";
      //]]>
      </script>
      <noscript>
      <iframe frameborder='0' height='0' width='0' scrolling='no' src='http://d10xg45o6p6dbl.cloudfront.net/projects/f/filezilla/FileZilla_Server-0_9_29.exe'></iframe>
      <div class='inset' id='download_notice_no_js'>
         <div class='begin_msg'>
            Your
            <span class='filename'>FileZilla_Server-0_9_29.exe</span>
            has begun.
         </div>
         <div class='manual'>
            <a href='http://d10xg45o6p6dbl.cloudfront.net/projects/f/filezilla/FileZilla_Server-0_9_29.exe'>Click here</a>
            to download manually.
         </div>
      </div>
      </noscript>
      <div class='inset' id='download_notice'>
      <div class='begin_msg'>
         Your
         <span class='filename'>FileZilla_Server-0_9_29.exe</span>
         download will start in
         <span id='delay_time_span'>3</span>
         seconds.
      </div>
      <div class='manual'>
         <a href='http://d10xg45o6p6dbl.cloudfront.net/projects/f/filezilla/FileZilla_Server-0_9_29.exe'>Click here</a>
         to download manually.
      </div>
      </div>
      <div class='h1_bar clear'>
      <img alt="Fzlogo_med" class="logo" src="https://s3.amazonaws.com/bits.ohloh.net/attachments/789/fzlogo_med.png" />
      <h1>Downloading FileZilla</h1>
      </div>
      <div class='col span_9'>
      <div class='inset project_container'>
         <div class='disclaimer'>A message from FileZilla.</div>
         <div class='project'>
            <p><br /></p>
            <h4>Thank you for downloading FileZilla.</h4>

            <p>If you have questions how to use FileZilla, please have a look at the <a href="http://wiki.filezilla-project.org/FAQ">FAQ</a> and visit our <a href="http:/forum.filezilla-project.org/">forums</a></p>
         </div>
      </div>
      </div>
      <div class='col span_7 last'>
      <div class='advert_container'>
         <div class='disclaimer'>A message from Ohloh sponsors.</div>
         <script type="text/javascript">
         </script>
         <script type="text/javascript"
            src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
         </script>
      </div>
      </div>
      <hr class='three' />
      <hr class='three' />
      <hr class='three' />
      <hr class='three' />
      <hr class='three' />
      <hr class='three' />
      <div></div>
   </div>
</div>
<div class='row small_footer'>
   <ul>
      <li>
      <a href='https://www.ohloh.net/about/us'>About</a>
      </li>
      <li>|</li>
      <li>
      <a href='https://www.ohloh.net/help/faq'>FAQ</a>
      </li>
      <li>|</li>
      <li>
      <a href="https://www.ohloh.net/forums">Forums</a>
      </li>
   </ul>
</div>
<script type="text/javascript">
   var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
   document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
   var pageTracker = _gat._getTracker("UA-449914-1");
   pageTracker._initData();
   pageTracker._trackPageview();
</script>
  </body>
</html>

显示全部楼层 · 发表于 2008-12-22 00:38:07

File ID Filename Size (Byte) Result
25216586 29.exe 5.88 KB UNDER ANALYSIS

红伞上报分析。

显示全部楼层 · 发表于 2008-12-22 20:45:40

McAfee Suspicious IFrame.b

显示全部楼层 · 发表于 2008-12-22 20:55:19

上报ESET

[病毒样本] 未知样本一个

本帖子中包含更多资源