1、文档结构分析
2、静态文档
1、实体文件
File Compression State : 0 (Not Compressed)
File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 1274200 (0137158h) Byte(s) | Machine: 0x14C (I386)
Compilation TimeStamp : 0x38215CB8 -> Thu 04th Nov 1999 10:15:20 (GMT)
[TimeStamp] 0x38215CB8 -> Thu 04th Nov 1999 10:15:20 (GMT) | PE Header | - | Offset: 0x000000C0 | VA: 0x004000C0 | -
-> File Appears to be Digitally Signed @ Offset 0BD000h, size : 01678h / 05752 byte(s)
-> File has 494304 (078AE0h) bytes of appended data starting at offset 0BE678h
[LoadConfig] CodeIntegrity -> Flags 0xA3F0 | Catalog 0x46 (70) | Catalog Offset 0x2000001 | Reserved 0x46A4A0
[LoadConfig] GuardAddressTakenIatEntryTable 0x8000011 | Count 0x46A558 (4629848)
[LoadConfig] GuardLongJumpTargetTable 0x8000001 | Count 0x46A5F8 (4630008)
[LoadConfig] HybridMetadataPointer 0x8000011 | DynamicValueRelocTable 0x46A66C
[LoadConfig] FailFastIndirectProc 0x8000011 | FailFastPointer 0x46C360
[LoadConfig] UnknownZero1 0x8000011
[File Heuristics] -> Flag #1 : 00000000000000000000000000000100 (0x00000004)
[Entrypoint Section Entropy] : 7.42 (section #0) ".text " | Size : 0xB71C0 (750016) byte(s)
[DllCharacteristics] -> Flag : (0x0000) -> NONE
[SectionCount] 3 (0x3) | ImageSize 0xBD000 (774144) byte(s)
[VersionInfo] Product Name : CUFFIN10
[VersionInfo] Product Version : 3.05.0004
[VersionInfo] File Description : BARTRAMIA1
[VersionInfo] File Version : 3.05.0004
[VersionInfo] Original FileName : Moistness9.exe
[VersionInfo] Internal Name : Moistness9
[ModuleReport] [IAT] Modules -> MSVBVM60.DLL
[!] File appears to have no protection or is using an unknown protection
- Scan Took : 0.531 Second(s) [000000213h (531) tick(s)] [566 of 580 scan(s) done]
2、网络连接
==============================================
Operating System Intel Recovery
==============================================
PC Name: WIN-A4B0N3V4K81
Local Time: 2018/12/21 11:26:25
Installed Language: zh-CN
Net Version: 2.0.50727.5420
Operating System Platform: Win32NT
Operating System Version: 6.1.7601.65536
Operating System: Microsoft Windows 7 旗舰版
Internal IP Address: 192.168.92.144
External IP Address:
Installed Anti-Virus:
Installed Firewall:
==============================================
WEB Browser Password Stealer
==============================================
==============================================
Mail Messenger Password Stealer
==============================================
==============================================
Internet Download Manager Stealer
==============================================
==============================================
JDownloader Password Stealer
==============================================
3、启动方式和自保护
4、域名解析
IoC
- 结尾 - 精彩推荐 【技术分享】分析Teaser Dragon CTF 2019中Crypto方向题目 【技术分享】ctf 中的病毒分析: Insomni’hack 2018 – vba03-strikeBack 【技术分享】MIPS缓冲区溢出学习实践 戳“阅读原文”查看更多内容 原文始发于微信公众号（安全客）：【技术分享】一个使用cve-2017-11882和cve-2018-0802组合漏洞的恶意文档分析
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论