http://shiruizhileng.com

显示全部楼层 · 发表于 2009-8-13 17:27:02

原始 - http://shiruizhileng.com
原始 - http://%62%73%6C%6B%2E%78%6F%72%67%2E%70%6C/x.js?google_ad=55x30_ad
原始 - http://%6D%61%70%2E%78%6F%72%67%2E%70%6C/x.js?google_ad=95x30_ad
原始 - http://myaa.kmip.net/aa/360.htm
原始 - http://myaa.kmip.net/aa/iie.swf
原始 - http://myaa.kmip.net/aa/fff.swf
原始 - http://myaa.kmip.net/aa/aa.js
原始 - http://myaa.kmip.net/aa/yt.htm
原始 - http://myaa.kmip.net/aa/yt.js
原始 - http://myaa.kmip.net/aa/xie.htm
原始 - http://myaa.kmip.net/aa/office.htm
原始 - http://myaa.kmip.net/aa/newlz.htm
原始 - http://myaa.kmip.net/aa/of.htm
原始 - http://myaa.kmip.net/aa/bf.htm
合并Javascript - [virtual] - http://myaa.kmip.net/aa/of.htm
自动寻找Shellcode - Shellcode (CALL STUB) 入口 +0x56F
虚拟机 - http://myaa.kmip.net/aa/qq.exe

显示全部楼层 · 发表于 2009-8-13 17:30:28

hxxp://myaa.kmip.net/aa/qq.exe

显示全部楼层 · 发表于 2009-8-13 17:49:54

关于:hxxp://shiruizhileng.com/解密的日志(全体输出 -  40):

Level  0>http://shiruizhileng.com/
Level  1>http://%62%73%6c%6b%2e%78%6f%72%67%2e%70%6c/x.js?google_ad=55x30_ad
Level  2>http://myaa.kmip.net/aa/360.htm
Level  3>http://myaa.kmip.net/aa/aa.js
Level  4>http://myaa.kmip.net/aa/aa.htm
Level  5>http://myaa.kmip.net/aa/ff.html
Level  6>http://myaa.kmip.net/aa/qqq.exe  ●
Level  5>http://myaa.kmip.net/aa/ie.html
Level  6>http://myaa.kmip.net/aa/qqq.exe  ●
Level  3>http://myaa.kmip.net/aa/yt.htm
Level  4>http://myaa.kmip.net/aa/bf.htm
Level  5>http://myaa.kmip.net/aa/bf.js
Level  5>http://myaa.kmip.net/aa/2.css
Level  6>http://myaa.kmip.net/aa/qq.exe  ●
Level  4>http://myaa.kmip.net/aa/of.htm
Level  5>http://myaa.kmip.net/aa/of.css
Level  6>http://myaa.kmip.net/aa/qq.exe  ●
Level  4>http://myaa.kmip.net/aa/newlz.htm
Level  5>http://myaa.kmip.net/aa/newlz.css
Level  6>http://myaa.kmip.net/aa/qq.exe  ●
Level  4>http://myaa.kmip.net/aa/office.htm
Level  5>http://myaa.kmip.net/aa/office.css
Level  6>http://myaa.kmip.net/aa/qq.exe  ●
Level  4>http://myaa.kmip.net/aa/xie.htm
Level  5>http://myaa.kmip.net/aa/av2.swf
Level  5>http://myaa.kmip.net/aa/av3.swf
Level  5>http://myaa.kmip.net/aa/av1.swf
Level  6>http://myaa.kmip.net/a/qq.exe  ●
Level  4>http://myaa.kmip.net/aa/yt.js
Level  5>http://myaa.kmip.net/aa/4.htm
Level  6>http://myaa.kmip.net/aa/2.css
Level  7>http://myaa.kmip.net/aa/qq.exe  ●
Level  5>http://myaa.kmip.net/aa/3.htm
Level  6>http://myaa.kmip.net/aa/3.css
Level  7>http://myaa.kmip.net/aa/qq.exe  ●
Level  3>http://myaa.kmip.net/aa/iie.swf
Level  4>http://myaa.kmip.net/aa/WIN 9,0,115,0i.swf
Level  5>http://myaa.kmip.net/aa/qq.exe  ●
Level  1>http://%6d%61%70%2e%78%6f%72%67%2e%70%6c/x.js?google_ad=95x30_ad
Level  2>http://myaa.kmip.net/aa/360.htm

网页分析:250662772

显示全部楼层 · 发表于 2009-8-14 00:37:15

Url and sample to KL

[ 本帖最后由尤金卡巴斯基于 2009-8-14 00:39 编辑 ]

显示全部楼层 · 发表于 2009-8-15 00:08:04

Hello,

qq.exe - Worm.Win32.AutoRun.gmu

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

qqq.exe

No malicious code was found in this file.

Best Regards, NewVirus

10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia
Tel./Fax: + 7 (495) 797 8700
http://www.kaspersky.com http://www.viruslist.com

[其它] http://shiruizhileng.com