【病毒】[08-02-03]可疑樣本

[juijui]

過紅傘、nod32...

應該是一個廣告程序~

樣本儘供測試分析使用

[juijui]

目前只有卡巴報...

樣本儘供測試分析使用

結果: 1/32 (3.13%)

[juijui]

毒網
http://whusu.future.org.cn/in_news_view.asp?n_id=2129

進入後...紅傘警報不停
解密後發現外連一大堆可疑網址

http://aa.chaina-game.cn/reg.htm
http://aa.llsging.com/ww/new05.htm?075
http://AAA.77xxmm.cn/new858.htm?075
http://aaa.1l1l1l.com/error/404.html
http://aaa.77xxmm.cN/New858.htm?075
http://aaa.1l1l1l.cOm/errOr/404.html
http://ppp.749571.com/ww/new888.htm?011
hTTp://ppp.749571.com/ww/new888.hTm?011
http://aaa.77xxmm.cn/new858.htm?075
http://aaa.1l1l1l.com/eRRoR/404.html
http://aaa.77xxmm.cn/new858.htm?075
http://aaa.1l1l1l.com/error/404.html
http://aaa.77xxmm.cn/new858.htm?075
http://aaa.1l1l1l.com/Error/404.html
http://aa.chaiNa-game.cN/reg.htm
http://aa.llsging.com/ww/new05.htm?075
http://aaa.77xxmm.cn/new858.htm?075
http://AAA.1l1l1l.com/error/404.html
http://aaa.77xxmm.cn/new858.htm?075
http://aaa.1l1l1l.com/error/404.html
http://ppp.749571.com/WW/neW888.htm?011
http://ppp.749571.com/ww/new888.htm?011
hTTp://aaa.77xxmm.cn/new858.hTm?075
http://AAA.1l1l1l.com/error/404.html
http://aaa.77xxmm.cn/new858.htm?075
hTTp://aaa.1l1l1l.com/error/404.hTml
http://aaa.77xxmm.cn/new858.htm?075
http://aaa.1l1l1l.com/error/404.html
http://aa.Chaina-game.Cn/reg.htm
Http://aa.llsging.com/ww/new05.Htm?075
http://aaa.77xxmm.Cn/new858.htm?075
http://aaa.1l1l1l.com/error/404.html
http://aaa.77xxmm.Cn/new858.htm?075
httP://aaa.1l1l1l.com/error/404.html
http://ppp.749571.com/ww/new888.htm?011
http://ppp.749571.com/ww/new888.htm?011
http://aaa.77xxmm.cn/new858.htm?075
http://aaa.1l1l1l.cOm/errOr/404.html
http://aaa.77xxmm.cn/new858.htm?075
http://aaa.1l1l1l.com/eRRoR/404.html
http://aaa.77xxMM.cn/new858.htM?075
http://aaa.1l1l1l.com/error/404.html
http://aa.Chaina-game.Cn/reg.htm
Http://aa.llsging.com/ww/new05.Htm?075
http://aaa.77xxmm.cn/new858.htm?075
http://aaa.1l1l1l.com/error/404.html
http://aaa.77xxmm.cn/new858.htm?075
http://aaa.1l1l1l.com/error/404.html
Http://ppp.749571.com/ww/new888.Htm?011
http://ppp.749571.com/ww/new888.htm?011
http://aaa.77xxmm.cn/new858.htm?075
http://aaa.1l1l1l.com/error/404.html
http://aaa.77xxmm.cn/new858.htm?075
http://aaa.1l1l1l.com/eRRoR/404.html
http://aaa.77XXmm.cn/new858.htm?075
http://aaa.1l1l1l.com/error/404.html

選二個來追蹤看看

追蹤 http://aaa.1l1l1l.com/error/404.html
指向 http://37586.com/888/008.htm
指向 http://37586.com/r.htm
找到 http://37586.com/real.exe

追蹤 http://aaa.77xxmm.cn/new858.htm?075
指向 http://ppp.buyaoni.com/dm/rr.htm
找到 http://ppp.buyaoni.com/1.exe





防毒軟體若無網頁監控!請勿測試!!!