hxxp://202.121.93.186/iclass_f_2007/main/main.aspx

显示全部楼层 · 发表于 2009-8-31 12:34:57

关于:hxxp://202.121.93.186/iclass_f_2007/main/main.aspx解密的日志(全体输出 -  59):

Level  1>http://wo8.ss.la/1/cqqskin.css  ●
Level  2>http://fuck.ss.la/1.exe  ●
Level  1>http://wo8.ss.la/1/show.jpg
Level  1>http://wo8.ss.la/1/shows.jpg
Level  1>http://wo8.ss.la/1/ec4.js
Level  2>http://fuck.ss.la/1.exe  ●
Level  1>http://wo8.ss.la/1/off.css  ●
Level  2>http://fuck.ss.la/1.exe  ●
Level  1>http://wo8.ss.la/1/cry.css  ●
Level  2>http://fuck.ss.la/1.exe  ●
Level  1>http://wo8.ss.la/1/cqq2s.css  ●
Level  1>http://wo8.ss.la/1/cqq2.css  ●
Level  2>http://fuck.ss.la/1.exe  ●
Level  1>http://wo8.ss.la/1/wing
Level  1>http://wo8.ss.la/1/rr.js
Level  2>http://wo8.ss.la/1/fyre1.htm
Level  3>http://wo8.ss.la/1/fyr1.js
Level  4>http://fuck.ss.la/1.exe  ●
Level  2>http://wo8.ss.la/1/evilr.htm
Level  3>http://wo8.ss.la/1/evilrr.js
Level  4>http://fuck.ss.la/1.exe  ●
Level  1>http://wo8.ss.la/1/zz.js
Level  2>http://wo8.ss.la/1/fylz.htm
Level  3>http://wo8.ss.la/1/xxxxz.js
Level  4>http://fuck.ss.la/1.exe  ●
Level  1>http://wo8.ss.la/1/ecffx.htm
Level  2>http://wo8.ss.la/1/ecfox.js
Level  3>http://fuck.ss.la/1.exe  ●
Level  1>http://wo8.ss.la/1/sf.pdf
Level  1>http://%34%6a%33%6a%2e%63%6e
Level  2>http://wo8.ss.la/1/google.htm?1
Level  3>http://wo8.ss.la/1/music.js
Level  4>http://wo8.ss.la/1/sfpf.htm
Level  5>http://wo8.ss.la/1/sf.pdf
Level  3>http://wo8.ss.la/1/google_adx.js
Level  4>http://wo8.ss.la/1/ecfox.htm
Level  4>http://wo8.ss.la/1/fyr.htm
Level  4>http://wo8.ss.la/1/ecb.htm
Level  4>http://wo8.ss.la/1/cqq0.htm
Level  3>http://wo8.ss.la/1/google_ads.js
Level  3>http://wo8.ss.la/1/google_ad.js
Level  4>http://wo8.ss.la/1/cqqmp.htm
Level  1>http://wo8.ss.la/1/google.htm?1
Level  1>http://wo8.ss.la/1/google_ad.js
Level  1>http://wo8.ss.la/1/google_ads.js
Level  1>http://wo8.ss.la/1/google_adx.js
Level  1>http://wo8.ss.la/1/music.js
Level  1>http://s107.cnzz.com/stat.php?id=1583441&web_id=1583441
Level  1>http://wo8.ss.la/ta3.htm
Level  1>http://wo8.ss.la/1/cqqmp.htm
Level  1>http://wo8.ss.la/1/ec1.htm
Level  1>http://wo8.ss.la/1/fyfl.htm
Level  1>http://wo8.ss.la/1/ecof.htm
Level  1>http://wo8.ss.la/1/fydvd.htm
Level  1>http://wo8.ss.la/1/fycry.htm
Level  1>http://wo8.ss.la/1/cqq0.htm
Level  1>http://wo8.ss.la/1/ecb.htm
Level  1>http://wo8.ss.la/1/fyr.htm
Level  1>http://wo8.ss.la/1/ecfox.htm
Level  1>http://wo8.ss.la/1/sfpf.htm
（重复已省略）

关注-http://fuck.ss.la/1.exe  ●

网页分析 By：liujiehua-猫猫

显示全部楼层 · 发表于 2009-8-31 12:37:36

原始 - http://202.121.93.186/iclass_f_2007/main/main.aspx
开始自动解析 - http://202.121.93.186/iclass_f_2007/main/main.aspx
L1 - http://202.121.93.186/iclass_f_2007/main/../share/trim.js
L1 - http://202.121.93.186/iclass_f_2007/main/../share/head2.js
L1 - http://%34%6A%33%6A%2E%63%6E
可能的Flash溢出 - http://202.121.93.186/iclass_f_2007/main/fdap.swf
NATIVE AUTO XOR - 高度可疑 - http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>无法找
L1 - http://202.121.93.186/iclass_f_2007/main/../share/bottom.js
L2 - http://wo8.ss.la/1/google.htm?1
L3 - http://wo8.ss.la/1/google_ad.js
L3 - http://wo8.ss.la/1/google_ads.js
L3 - http://wo8.ss.la/1/google_adx.js
L3 - http://wo8.ss.la/1/music.js
L4 - http://wo8.ss.la/1/cqqmp.htm
L4 - http://wo8.ss.la/1/ec1.htm
L4 - http://wo8.ss.la/1/fyfl.htm
L4 - http://wo8.ss.la/1/ecof.htm
L4 - http://wo8.ss.la/1/fydvd.htm
L4 - http://wo8.ss.la/1/fycry.htm
L4 - http://wo8.ss.la/1/cqq0.htm
L4 - http://wo8.ss.la/1/ecb.htm
L4 - http://wo8.ss.la/1/fyr.htm
L4 - http://wo8.ss.la/1/ecfox.htm
L4 - http://wo8.ss.la/1/sfpf.htm
L5 - http://wo8.ss.la/1/cqqskin.css
自动解析 - Auto XOR - 高度可疑 - http://fuck.ss.la/1.exe
L5 - http://wo8.ss.la/1/show.jpg
L5 - http://wo8.ss.la/1/shows.jpg
L5 - http://wo8.ss.la/1/ec4.js
L5 - http://wo8.ss.la/1/off.css
L5 - http://wo8.ss.la/1/dvd.js
自动解析 - Auto XOR - 高度可疑 - http://fuck.ss.la/1.exe
L5 - http://wo8.ss.la/1/cry.css
自动解析 - Auto XOR - 高度可疑 - http://fuck.ss.la/1.exe
L5 - http://wo8.ss.la/1/cqq2s.css
L5 - http://wo8.ss.la/1/cqq2.css
自动解析 - Auto XOR - 高度可疑 - http://fuck.ss.la/1.exe
L5 - http://wo8.ss.la/1/wing;o2[
L5 - http://wo8.ss.la/1/ecbbb.htm
L5 - http://wo8.ss.la/1/rr.js
L5 - http://wo8.ss.la/1/zz.js
L5 - http://wo8.ss.la/1/ecffx.htm
可能的PDF溢出 - http://wo8.ss.la/1/sf.pdf
关注 - http://fuck.ss.la/1.exe
L6 - http://wo8.ss.la/1/ecfff.js
自动解析 - Auto XOR - 高度可疑 - http://fuck.ss.la/1.exe
L6 - http://wo8.ss.la/1/evilr.htm
L6 - http://wo8.ss.la/1/fyre1.htm
L6 - http://wo8.ss.la/1/fylz.htm
L6 - http://wo8.ss.la/1/ecfox.js
L7 - http://wo8.ss.la/1/evilrr.js
L7 - http://wo8.ss.la/1/fyr1.js
自动解析 - Auto XOR - 高度可疑 - http://fuck.ss.la/1.exe
L7 - http://wo8.ss.la/1/xxxxz.js
自动解析 - Auto XOR - 高度可疑 - http://fuck.ss.la/1.exe
输出的对象 - http://fuck.ss.la/1.exe

此分析日志由悠柚使用 Astox v1 Build 1100 在 2009年8月31日12时36分48秒生成。

显示全部楼层 · 发表于 2009-9-1 00:28:23

[其它] hxxp://202.121.93.186/iclass_f_2007/main/main.aspx