注册
登录
| 关键词： nbsp CODE 004042 call mov eax sub push var ebp |
【文章标题】分析一个简单的DLL劫持下载者 【文章作者】ZzAge 【文章目标】某个下载者 【相关工具】ida,ollydbg 【作者 Q Q】85400516 【作者邮箱】[email protected] 【作者主页】http://hi.baidu.com/zzage 【文章日期】2008年12月01日 一 创建互斥体 复制内容到剪贴板代码: CODE:00404844 push ebx CODE:00404845 push off Name ; lpName //′′ CODE:0040484A push 0FFFFFFFFh ; int CODE:0040484C push 0 ; lpMutexAttributes CODE:0040484E call sub_403EC4 //互斥体的构建函数 CODE:00404853 call GetLastError_0 CODE:00404858 cmp eax, 0B7h CODE:0040485D jnz short loc_404861 CODE:0040485F mov bl, 1 CODE:00404861 CODE:00404861 loc_404861: ; CODE XREF: sub_404844+19j CODE:00404861 mov eax, ebx CODE:00404863 pop ebx CODE:00404864 retn 二 取Windows目录 复制内容到剪贴板代码: CODE:004041DB push 100h ; uSize CODE:004041E0 push ebx ; lpBuffer CODE:004041E1 call GetWindowsDirectoryA 三 删除计划任务C:\WINDOWS\Tasks\At1.job文件 复制内容到剪贴板代码: CODE:004041FD mov edx, off dword_404530 //′\tasks\at1.job′ CODE:00404202 call sub_403760 CODE:00404207 mov eax, [ebp+var_4] CODE:0040420A call sub_403840 CODE:0040420F push eax ; lpFileName CODE:00404210 call eteFileA 四 把Windows目录下的wsock32x.dll,lpk.dll,avp.的文件属性设置为正常，并且删除其文件,然后把木马自身复制到Windows目录下，新命名为avp.。 复制内容到剪贴板代码: CODE:0040422C mov edx, off dword_404548//′\wsock32x.dll′ CODE:00404231 call sub_403760 CODE:00404236 mov eax, [ebp+var_8] CODE:00404239 call sub_403840 CODE:0040423E push eax ; lpFileName CODE:0040423F call FileAttributesA CODE:00404244 push 80h ; dwFileAttributes CODE:00404249 lea eax, [ebp+var_C] CODE:0040424C mov edx, ebx CODE:0040424E mov ecx, 101h CODE:00404253 call sub_403740 CODE:00404258 lea eax, [ebp+var_C] CODE:0040425B mov edx, off dword_404560 //′\lpk.dll′ CODE:00404260 call sub_403760 CODE:00404265 mov eax, [ebp+var_C] CODE:00404268 call sub_403840 CODE:0040426D push eax ; lpFileName CODE:0040426E call FileAttributesA CODE:00404273 push 80h ; dwFileAttributes CODE:00404278 lea eax, [ebp+var_10] CODE:0040427B mov edx, ebx CODE:0040427D mov ecx, 101h CODE:00404282 call sub_403740 CODE:00404287 lea eax, [ebp+var_10] CODE:0040428A mov edx, off dword_404574 //′\avp.′ CODE:0040428F call sub_403760 CODE:00404294 mov eax, [ebp+var_10] CODE:00404297 call sub_403840 CODE:0040429C push eax ; lpFileName CODE:0040429D call FileAttributesA CODE:004042A2 lea eax, [ebp+var_14] CODE:004042A5 mov edx, ebx CODE:004042A7 mov ecx, 101h CODE:004042AC call sub_403740 CODE:004042B1 lea eax, [ebp+var_14] CODE:004042B4 mov edx, off dword_404548 //′\wsock32x.dll′ CODE:004042B9 call sub_403760 CODE:004042BE mov eax, [ebp+var_14] CODE:004042C1 call sub_403840 CODE:004042C6 push eax ; lpFileName CODE:004042C7 call eteFileA CODE:004042CC lea eax, [ebp+var_18] CODE:004042CF mov edx, ebx CODE:004042D1 mov ecx, 101h CODE:004042D6 call sub_403740 CODE:004042DB lea eax, [ebp+var_18] CODE:004042DE mov edx, off dword_404560 //′\lpk.dll′ CODE:004042E3 call sub_403760 CODE:004042E8 mov eax, [ebp+var_18] CODE:004042EB call sub_403840 CODE:004042F0 push eax ; lpFileName CODE:004042F1 call eteFileA CODE:004042F6 lea eax, [ebp+var_1C] CODE:004042F9 mov edx, ebx CODE:004042FB mov ecx, 101h CODE:00404300 call sub_403740 CODE:00404305 lea eax, [ebp+var_1C] CODE:00404308 mov edx, off dword_404574 //′\avp.′ CODE:0040430D call sub_403760 CODE:00404312 mov eax, [ebp+var_1C] CODE:00404315 call sub_403840 CODE:0040431A push eax ; lpFileName CODE:0040431B call eteFileA CODE:00404320 push 0 ; bFailIfExists CODE:00404322 lea eax, [ebp+var_20] CODE:00404325 mov edx, ebx CODE:00404327 mov ecx, 101h CODE:0040432C call sub_403740 CODE:00404331 lea eax, [ebp+var_20] CODE:00404334 mov edx, off dword_404574 //′\avp.′ CODE:00404339 call sub_403760 CODE:0040433E mov eax, [ebp+var_20] CODE:00404341 call sub_403840 CODE:00404346 push &n |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
