sai7sai
2007-03-30, 02:11 PM
在最近分析的樣本中，有幾個樣本非常詭異，昨天晚上稍微檢查他們的檔案格式，發現是 Animated Cursor (*.ani) (但卻取名為 *.jpg)，今天早上有個朋友通知我，微軟公佈一個安全漏洞 (Vulnerability in Windows Animated Cursor Handling)，才恍然大悟，原來是零時差攻擊 (Zero-Day Attack)。
到目前為止，下面的防毒軟體可以偵測這些惡意檔案：
ANI_attack-all/1.jpg:
[ Kaspersky ], “Trojan-Downloader.Win32.Ani.g”
[ McAfee ], “Exploit-ANIfile.c”
ANI_attack-all/2.jpg:
[ Kaspersky ], “Trojan-Downloader.Win32.Ani.g”
[ McAfee ], “Exploit-ANIfile.c”
ANI_attack-all/7888p.jpg:
[ Kaspersky ], “Trojan-Downloader.Win32.Ani.g”
[ McAfee ], “Exploit-ANIfile.c”
ANI_attack-all/9197p.jpg:
[ Kaspersky ], “Trojan-Downloader.Win32.Ani.g”
[ McAfee ], “Exploit-ANIfile.c”
ANI_attack-all/da.jpg:
[ Kaspersky ], “Trojan-Downloader.Win32.Ani.g”
[ McAfee ], “Exploit-ANIfile.c”
詳細的資訊，請參考「台灣出現零時差攻擊 (Zero-Day Attack) (http://malware-test.com/blog/archives/2007/03/30/914)」。:eek:
贊助商連結
到目前為止，下面的防毒軟體可以偵測這些惡意檔案：
ANI_attack-all/1.jpg:
[ Kaspersky ], “Trojan-Downloader.Win32.Ani.g”
[ McAfee ], “Exploit-ANIfile.c”
ANI_attack-all/2.jpg:
[ Kaspersky ], “Trojan-Downloader.Win32.Ani.g”
[ McAfee ], “Exploit-ANIfile.c”
ANI_attack-all/7888p.jpg:
[ Kaspersky ], “Trojan-Downloader.Win32.Ani.g”
[ McAfee ], “Exploit-ANIfile.c”
ANI_attack-all/9197p.jpg:
[ Kaspersky ], “Trojan-Downloader.Win32.Ani.g”
[ McAfee ], “Exploit-ANIfile.c”
ANI_attack-all/da.jpg:
[ Kaspersky ], “Trojan-Downloader.Win32.Ani.g”
[ McAfee ], “Exploit-ANIfile.c”
詳細的資訊，請參考「台灣出現零時差攻擊 (Zero-Day Attack) (http://malware-test.com/blog/archives/2007/03/30/914)」。:eek:
贊助商連結