hXXp://worldcup.qq.com/guess/index.html（怀疑挂马）[正常][已检测 by 是昔流芳]

fqcomodo

进入 TX 世界杯竞猜首页                                          http://worldcup.qq.com/guess/index.html                   firefox 提示！！！  请高手分析谢谢了

zjelva

[root]http://worldcup.qq.com/guess/index.html(世界杯竞猜首页_腾讯网)
    [script]http://apps.worldcup.qq.com/js/app.platform.guess.wc.js
    [script]http://mat1.gtimg.com/www/apps/js/app.platform.guess.wc.js
    [iframe]http://worldcup.qq.com/guess/about:blank
    [script]http://pingjs.qq.com/ping.js
    [flash]http://mat1.gtimg.com/worldcup/ad/700-60.swf
    [iframe]http://worldcup.qq.com/guess/guessone.htm
        [iframe]http://worldcup.qq.com/guess/about:blank
        [script]http://mat1.gtimg.com/www/apps/js/app.platform.guess.index.wc.js
    [iframe]http://worldcup.qq.com/guess/guesstow.htm
        [iframe]http://worldcup.qq.com/guess/about:blank
        [script]http://mat1.gtimg.com/www/apps/js/app.platform.guess.index.wc.js
    [flash]http://mat1.gtimg.com/worldcup/2010ad/0527960-90-3.swf

没有挂马程序~~正常~~~

fqcomodo

[root]http://worldcup.qq.com/guess/index.html(世界杯竞猜首页_腾讯网)
    [script]http://apps.worl ...
zjelva 发表于 2010-6-5 17:40

请问你用什么分析的

zjelva

MDecoder软件

是昔流芳

关于:hxxp://worldcup.qq.com/guess/index.html解密的日志(全体输出 -  9):

Level  0>http://worldcup.qq.com/guess/index.html
Level  1>http://apps.worldcup.qq.com/js/app.platform.guess.wc.js
Level  1>http://mat1.gtimg.com/www/apps/js/app.platform.guess.wc.js
Level  1>http://pingjs.qq.com/ping.js
Level  1>http://btrace.qq.com/collect?sIp=&iQQ=+uin+&sBiz=guessindex&sOp=guessindex&iSta=&iTy=106&iFlow=&reserve=
Level  1>http://worldcup.qq.com/guess/guessone.htm
Level  2>http://mat1.gtimg.com/www/apps/js/app.platform.guess.index.wc.js
Level  1>http://worldcup.qq.com/guess/guesstow.htm
Level  1>http://worldcup.qq.com/guess/+_rsND+v51.js

analyzed by 是昔流芳