pandio

PEID查好像是Upack,但是跟踪的结果不像.
下面是跟踪的部分结果.
好像加壳了,但是从实际跟踪过程来看,好像是伪装壳.
call sub_10002200这个call没有任何意义,纯属花指令
然后Sleep(1)->GetTickCount()->sub_10002200()好像没什么意义.
继续跟
GetSystemDirectory(path,MAX_PATH)得到系统目录
strcat(path,"kernel32.dll"),得到C:\WINDOWS\system32\kernel32.dll
接下来竟然DeleteFile(path),要删系统文件?当然是删不掉
GetLastError()  cmp eax,5?
GetModuleFileName(NULL,hostpath,MAX_PATH)
strrchr(hostpath, '\\')
得到最后一个名字,这个就是宿主程序名.
我用OD,就是LOADDLL.EXE
hostname为宿主程序名
stricmp(hostname,"svchost.exe");
这里当然不一样,继续比较
stricmp(hostname,"alg.exe");
构造字符串"SeDebugPrivilege",想提升权限了,有野心
构造字符串"Explorer.exe",
stricmp(hostname,"Explorer.exe");若不跳则开启线程CreateThread(),ThreadProc=sub_10001A45
若跳则:  GetModuleFileName(hModule,dllpath,MAX_PATH)
  CreateToolhelp32Snapshot()->Process32First()
  比较进程名是否为Explorer.exe
  不是则继续Process32Next()
  若是则新CreateToolhelp32Snapshot()->Module32First()
  比较模块名是否为sqmapi32.dll
  是则返回1;不是则返回0
若返回0.则提升进程权限OpenProcess()->LookupPrivilige->AdjustProcessToken()
加载dllpath,并加载qdshm.dll和mszs.dll
线程函数里面会查找以下dll是否存在,有则加载
ALLatl.dll
Z_Tatl.dll
MHatl.dll
DHatl.dll
FYatl.dll
HXatl.dll
MSatl.dll
MYatl.dll
QJatl.dll
TLatl.dll
TXatl.dll
WMatl.dll
GJatl.dll
WLatl.dll
ZXatl.dll
WDatl.dll
QQHXatl.dll
DTHXatl.dll
CHDatl.dll
CQatl.dll
EVEatl.dll
JZatl.dll
BFatl.dll
WMTWatl.dll
QQSGatl.dll
CQSJatl.dll
GEatl.dll
PTYJatl.dll
XWTWatl.dll
QQatl.dll
RXJHatl.dll
SHQZatl.dll
DH3atl.dll
DJatl.dll
LRTWatl.dll
GZGDatl.dll
ZHatl.dll
YT2atl.dll
GFSJatl.dll
JRatl.dll学习中.......

帖子54 精华0 积分194 阅读权限40 性别男 在线时间12 小时 注册时间2006-9-10 最后登录2008-7-18 查看详细资料TOP 赚更多的钱

bink
荣誉会员