\u5176\u4e2d\u7684\u4e00\u79cd\u5206\u6790\u65b9\u6cd5\uff0c\u5c31\u662f\u901a\u8fc7\u5206\u6790\u6076\u610f\u4ee3\u7801\u4e2d\u8d1f\u8d23\u544a\u8bc9\u7cfb\u7edf\u5982\u4f55\u6267\u884c\u7279\u5b9a\u64cd\u4f5c\u7684API\u8c03\u7528\u4ee5\u53ca\u63a7\u5236\u547d\u4ee4\u3002\u5728\u8fd9\u79cd\u65b9\u6cd5\u4e2d\uff0c\u6211\u4eec\u4e0d\u9700\u8981\u5bf9\u5df2\u52a0\u58f3\u7684\u6587\u4ef6\u8fdb\u884c\u9006\u5411\u5206\u6790\uff0c\u56e0\u4e3a\u6211\u4eec\u53ea\u9700\u8981\u5bf9\u6076\u610f\u4ee3\u7801\u6240\u6267\u884c\u7684API\u8c03\u7528\u6765\u8fdb\u884c\u52a8\u6001\u5206\u6790\uff0c\u5c31\u53ef\u4ee5\u77e5\u9053\u67d0\u4e2a\u7279\u5b9a\u6587\u4ef6\u5177\u4f53\u7684\u529f\u80fd\u4e86\u3002\u901a\u8fc7\u8fd9\u6837\u7684\u65b9\u6cd5\uff08\u5206\u6790API\u8c03\u7528\uff09\uff0c\u6211\u4eec\u53ef\u4ee5\u786e\u5b9a\u4e00\u4e2a\u6587\u4ef6\u662f\u5426\u5177\u6709\u6076\u610f\u6027\uff0c\u800c\u6709\u4e9bAPI\u8c03\u7528\u53ea\u6709\u67d0\u4e9b\u7279\u6b8a\u7c7b\u578b\u7684\u6076\u610f\u8f6f\u4ef6\u624d\u4f1a\u53bb\u4f7f\u7528\u3002\u6bd4\u5982\u8bf4\uff0c\u5e38\u7528\u7684\u6076\u610fPayload\u4e0b\u8f7dAPI\u662fURLDownloadToFile\uff0c\u800cGetWindowDC\u8fd9\u4e2aAPI\u4e00\u822c\u7528\u4e8e\u95f4\u8c0d\u8f6f\u4ef6\u6216\u952e\u76d8\u8bb0\u5f55\u5668\u7b49\u6076\u610f\u5de5\u5177\uff08\u7528\u4e8e\u5c4f\u5e55\u622a\u53d6\uff09\u3002<\/p>\n

\u63a5\u4e0b\u6765\uff0c\u6211\u4eec\u4f1a\u5bf9\u4e00\u4e2a\u6076\u610f\u8f6f\u4ef6\u6837\u672c\u8fdb\u884c\u5206\u6790\uff0c\u5e76\u7ed9\u5927\u5bb6\u4ecb\u7ecd\u8fd9\u9879\u6280\u672f\u7684\u5b9e\u73b0\u65b9\u6cd5\u3002<\/p>\n

\u6728\u9a6c\u6837\u672c<\/strong><\/div>\n
\u6211\u4eec\u6240\u8981\u5206\u6790\u7684\u6076\u610f\u8f6f\u4ef6\u6837\u672c\u662f\u4e00\u4e2a\u540d\u53eb1.exe\u7684\u8457\u540d\u6728\u9a6c\uff0c\u5b83\u7684SHA256\u5982\u4e0b\uff1a0213b36ee85a301b88c26e180f821104d5371410ab4390803eaa39fac1553c4c<\/p>\n
$\"\"$ <\/p>\n
\u8fd9\u4e2a\u6587\u4ef6\u662f\u52a0\u4e86\u58f3\u7684\uff08VMProtect\uff09\uff0c\u6240\u4ee5\u6211\u4eec\u5c31\u5f88\u96be\u4f7f\u7528\u53cd\u7f16\u8bd1\u5de5\u5177\u6765\u5bf9\u5176\u8fdb\u884c\u5206\u6790\u4e86\u3002\u7531\u4e8e\u6211\u4e2a\u4eba\u5e76\u4e0d\u64c5\u957f\u9006\u5411\u5de5\u7a0b\u5206\u6790\uff0c\u56e0\u6b64\u6211\u6253\u7b97\u901a\u8fc7\u5206\u6790\u8be5\u6587\u4ef6\u5728\u6c99\u76d2\u73af\u5883\u7684\u6267\u884c\u8fc7\u7a0b\u4e2d\u7684API\u8c03\u7528\u6765\u4e86\u89e3\u5b83\u7684\u884c\u4e3a\u3002<\/p>\n
\u4e0b\u9762\u8fd9\u5f20\u56fe\u7247\u4e2d\uff0c\u663e\u793a\u7684\u662f\u6211\u4eec\u901a\u8fc7\u89c2\u5bdf\u5b83\u5728\u6c99\u76d2\u73af\u5883\u4e2d\u7684\u8fd0\u884c\u60c5\u51b5\u6240\u5f97\u5230\u7684API\u8c03\u7528\u5217\u8868\uff1a<\/p>\n
$\"\"$ <\/p>\n
\u9996\u5148\uff0c\u6211\u4eec\u6765\u770b\u4e00\u770b\u8fd9\u4e9b\u51fd\u6570\u5230\u5e95\u6709\u4ec0\u4e48\u4f5c\u7528\u3002\u5176\u4e2d\u6709\u90e8\u5206\u51fd\u6570\u53ef\u4ee5\u5728\u5fae\u8f6f\u7684\u7f51\u7ad9\u4e2d\u627e\u5230\u76f8\u5173\u5185\u5bb9\uff1a<\/p>\n
GetModuleHandle\u51fd\u6570<\/strong><\/span><\/div>\n
\u4e3a\u7279\u5b9a\u6a21\u5757\u83b7\u53d6\u6a21\u5757\u5904\u7406\u5668\uff0c\u8be5\u6a21\u5757\u5fc5\u987b\u5728\u8c03\u7528\u8fdb\u7a0b\u4e2d\u88ab\u52a0\u8f7d\u3002GetModuleHandleA (ANSI)<\/p>\n
GetProcAddress\u51fd\u6570<\/strong><\/span><\/div>\n
\u83b7\u53d6\u4e00\u4e2a\u8f93\u51fa\u51fd\u6570\u7684\u5730\u5740\uff0c\u6216\u4ece\u6307\u5b9a\u7684\u52a8\u6001\u94fe\u63a5\u5e93\uff08DLL\uff09\u83b7\u53d6\u53d8\u91cf\u3002<\/p>\n
_wtoi<\/strong><\/span><\/div>\n
\u5c06\u4e00\u4e2a\u5b57\u7b26\u4e32\u8f6c\u6362\u6210\u6574\u578b<\/p>\n
CreateStreamOnHGlobal\u51fd\u6570<\/strong><\/span><\/div>\n
\u8fd9\u4e2a\u51fd\u6570\u5c06\u521b\u5efa\u4e00\u4e2a\u6d41\u5bf9\u8c61\uff0c\u8be5\u5bf9\u8c61\u53ef\u4ee5\u4f7f\u7528\u4e00\u4e2aHGLOBAL\u5185\u5b58\u5904\u7406\u5668\u6765\u5b58\u50a8\u6d41\u5185\u5bb9\u3002<\/p>\n
StrStr\u51fd\u6570<\/strong><\/span><\/div>\n
\u67e5\u627e\u5b57\u7b26\u4e32\u4e2d\u51fa\u73b0\u7684\u7b2c\u4e00\u4e2a\u5b50\u5b57\u7b26\u4e32\uff0c\u5339\u914d\u662f\u5927\u5c0f\u5199\u654f\u611f\u7684\u3002StrStrA(ANSI)<\/p>\n
wsprintf\u51fd\u6570<\/strong><\/span><\/div>\n
\u5411\u7279\u5b9a\u7684\u7f13\u51b2\u533a\u4e2d\u5199\u5165\u683c\u5f0f\u5316\u6570\u636e\uff0c\u53ef\u6839\u636e\u76f8\u5e94\u7684\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u6807\u51c6\u5411\u8f93\u51fa\u7f13\u51b2\u533a\u4e2d\u5199\u5165\u4efb\u610f\u53c2\u6570\u3002wsprintfA (ANSI)<\/p>\n
WinHttpOpen\u51fd\u6570<\/strong><\/span><\/div>\n
\u8be5\u51fd\u6570\u53ef\u4ee5\u521d\u59cb\u5316WinHTTP\u51fd\u6570\u5e76\u8fd4\u56de\u4e00\u4e2aWinHTTP-session\u5904\u7406\u5668\u3002<\/p>\n
GetModuleFileName\u51fd\u6570<\/strong><\/span><\/div>\n
\u83b7\u53d6\u5305\u542b\u6307\u5b9a\u6a21\u5757\u7684\u6587\u4ef6\u7684\u5b8c\u6574\u8def\u5f84\uff0c\u8be5\u6a21\u5757\u5fc5\u987b\u5728\u5f53\u524d\u7684\u8c03\u7528\u8fdb\u7a0b\u4e2d\u88ab\u52a0\u8f7d\u3002GetModuleFileNameW (Unicode)<\/p>\n
LoadLibrary\u51fd\u6570<\/strong><\/span><\/div>\n
\u5411\u8c03\u7528\u8fdb\u7a0b\u7684\u5730\u5740\u7a7a\u95f4\u52a0\u8f7d\u7279\u5b9a\u6a21\u5757\uff0c\u8be5\u6a21\u5757\u53ef\u80fd\u8fd8\u4f1a\u52a0\u8f7d\u5176\u4ed6\u7684\u6a21\u5757\u3002LoadLibraryA (ANSI)<\/p>\n
LocalAlloc\u51fd\u6570<\/strong><\/span><\/div>\n
\u5411\u5806\u5185\u5b58\u4e2d\u5206\u914d\u6307\u5b9a\u5927\u5c0f\u7684\u5b57\u8282\u3002<\/p>\n
LocalFree\u51fd\u6570<\/strong><\/span><\/p>\n
\u91ca\u653e\u6307\u5b9a\u7684\u672c\u5730\u5185\u5b58\u5bf9\u8c61\uff0c\u5e76\u521d\u59cb\u5316\u8be5\u5bf9\u8c61\u7684\u5904\u7406\u5668\u3002<\/p>\n
GetModuleFileName\u51fd\u6570<\/strong><\/span><\/div>\n
\u83b7\u53d6\u5305\u542b\u6307\u5b9a\u6a21\u5757\u7684\u6587\u4ef6\u7684\u5b8c\u6574\u8def\u5f84\uff0c\u8be5\u6a21\u5757\u5fc5\u987b\u5728\u5f53\u524d\u8c03\u7528\u8fdb\u7a0b\u4e2d\u88ab\u52a0\u8f7d\u3002GetModuleFileNameA (ANSI)<\/p>\n
ExitProcess\u51fd\u6570<\/strong><\/span><\/div>\n
\u7ec8\u6b62\u8c03\u7528\u8fdb\u7a0b\u4ee5\u53ca\u6240\u6709\u76f8\u5173\u7684\u7ebf\u7a0b\u3002<\/div>\n
\u5173\u952e\u7684\u6076\u610f\u8bc6\u522b\u6307\u6807<\/strong><\/div>\n
\u9700\u8981\u6ce8\u610f\u7684\u662f\uff0c\u4e0a\u9762\u7ed9\u51fa\u7684\u6240\u6709\u51fd\u6570\u5e76\u975e\u90fd\u80fd\u591f\u4e4b\u522b\u6807\u660e\u67d0\u4e2a\u53ef\u6267\u884c\u7a0b\u5e8f\u7684\u771f\u5b9e\u4f5c\u7528\u3002\u4f46\u662f\u9488\u5bf9WinHttpOpen\u7684\u8c03\u7528\u53ef\u4ee5\u544a\u8bc9\u6211\u4eec\u8fd9\u4e2a\u5e94\u7528\u662f\u6709\u7279\u6b8a\u76ee\u7684\u7684\u3002<\/p>\n
\u90a3\u6211\u4eec\u5c31\u53ef\u4ee5\u4ece\u8fd9\u4e2a\u51fd\u6570\u4e0b\u624b\uff0c\u6211\u4eec\u4f7f\u7528URL Revealer\uff08Kahu Security\uff09\u6765\u68c0\u6d4b\u6d41\u91cf\u7684\u76ee\u7684\u5730\uff0c\u5e76\u53d1\u73b0\u4e86\u4e24\u4e2a\u8be5\u6076\u610f\u5e94\u7528\u4f1a\u4e0d\u65ad\u5c1d\u8bd5\u8fde\u63a5\u7684URL\u5730\u5740\u3002<\/p>\n
GET http:\/\/twitter.com\/pidoras6<\/p>\n
POST http:\/\/www.virustotal.com\/vtapi\/v2\/file\/scan<\/p><\/blockquote>\n
\u6ce8\uff1a\u5f53\u6211\u4eec\u5411VirusTotalAPI\u63d0\u4ea4\u4e00\u4e2a\u6587\u4ef6\u6765\u8fdb\u884c\u626b\u63cf\u65f6\uff0c\u6700\u597d\u63d0\u4ea4\u8fd9\u79cd\u5f62\u5f0f\u7684POST<\/p>\n
\u4e0a\u9762\u8fd9\u4e2a\u94fe\u63a5\u6307\u5411\u7684\u662f\u4e00\u4e2a\u5df2\u5931\u6548\u7684Twitter\u5730\u5740\uff0c\u5f53\u6211\u4f7f\u7528Twitter\u7684\u9ad8\u7ea7\u641c\u7d22\u529f\u80fd\u8fdb\u884c\u67e5\u627e\u65f6\uff0c\u6211\u53d1\u73b0\u8fd9\u6761\u63a8\u6587\u65e9\u5c31\u5df2\u7ecf\u88ab\u5220\u9664\u4e86\u3002<\/p>\n
$\"\"$ <\/p>\n
\u901a\u8fc7Base64\u89e3\u7801\u4e4b\u540e\u6211\u4eec\u5f97\u5230\u4e86\u8fd9\u6761\u63a8\u6587\u7684\u539f\u59cb\u5185\u5bb9\uff1ahttps:\/\/w0rm.in\/join\/join.php\u3002\u4f46\u4e0d\u5e78\u7684\u662f\uff0c\u8fd9\u4e2a\u7f51\u7ad9\u5df2\u7ecf\u65e0\u6cd5\u89e3\u6790\u4e86\uff0c\u4f46\u8fd9\u4e2a\u7f51\u7ad9\u539f\u672c\u662f\u4e00\u4e2a\u4e13\u95e8\u63d0\u4f9b\u7f51\u7ad9\u5165\u4fb5\u670d\u52a1\u7684\u5730\u4e0b\u7ad9\u70b9\u3002\u4e0d\u8fc7\u9700\u8981\u6ce8\u610f\u7684\u662f\uff0c\u8fd9\u4e2aTwitter\u8d26\u53f7\u76ee\u524d\u4ecd\u7136\u662f\u6d3b\u8dc3\u7684\u3002<\/p>\n
\u7531\u6b64\u770b\u6765\uff0c\u6211\u4eec\u5c31\u6ca1\u529e\u6cd5\u5f04\u6e05\u695a\u8fd9\u4e2a\u6076\u610f\u8f6f\u4ef6\u60f3\u8981\u5229\u7528GET\u8bf7\u6c42\u6765\u505a\u4ec0\u4e48\u4e86\u3002\u4f46\u662f\u6211\u4eec\u53ef\u4ee5\u7528\u5176\u4ed6\u7684\u65b9\u6cd5\u641e\u6e05\u695a\u5b83\u60f3\u7528VirusTotal\u6765\u626b\u63cf\u4ec0\u4e48\u4e1c\u897f\uff1f\u4e0b\u9762\u662f\u6211\u4eec\u4f7f\u7528WireShark\u6240\u6355\u6349\u5230\u7684\u6570\u636e\u5305\uff1a<\/p>\n
$\"\"$ <\/p>\n
\u5728\u8fd9\u4e2a\u6570\u636e\u5305\u4e2d\uff0c\u4f60\u53ef\u4ee5\u770b\u5230\u6076\u610f\u8f6f\u4ef6\u7528\u6765\u5728VirusTotal\u7f51\u7ad9\u4e0a\u626b\u63cf\u6587\u4ef6\u7684API\u5bc6\u94a5\u4ee5\u53ca\u6587\u4ef6\u540d\u3002\u6240\u4ee5\uff0c\u901a\u8fc7\u5bf9API\u8c03\u7528\u548c\u6570\u636e\u5305\u8fdb\u884c\u91cd\u6784\uff0c\u6211\u4eec\u53d1\u73b0\u8fd9\u6b3e\u6076\u610f\u8f6f\u4ef6\u4f1a\u5411VirusTotal\u63d0\u4ea4\u81ea\u5df1\u7684\u62f7\u8d1d\u7248\u672c\uff0c\u5373\u6076\u610f\u8f6f\u4ef6\u526f\u672c\uff0c\u800c\u8fd9\u6b63\u597d\u662fVflooder\u6728\u9a6c\u5bb6\u65cf\u7684\u5178\u578b\u884c\u4e3a\u3002Vflooder\u662f\u4e00\u79cd\u7279\u6b8a\u7c7b\u578b\u7684Flooder\u6728\u9a6c\uff0c\u800cFlooder\u6728\u9a6c\u53ef\u4ee5\u5411\u76ee\u6807\u53d1\u9001\u5927\u91cf\u7684\u4fe1\u606f\u6765\u4e2d\u65ad\u76ee\u6807\u7684\u6b63\u5e38\u64cd\u4f5c\u3002\u4f46\u662f\u6211\u8ba4\u4e3aVirusTotal\u53ef\u80fd\u65e0\u6cd5\u68c0\u6d4b\u5230\u8fd9\u79cd\u6076\u610f\u8f6f\u4ef6\u5a01\u80c1\u3002<\/p>\n
\n
\u603b\u7ed3<\/p>\n<\/div>\n
\u5b9e\u9645\u4e0a\uff0c\u6211\u4eec\u672c\u6587\u6240\u5206\u6790\u7684Vflooder\u6728\u9a6c\u6837\u672c\u5176\u5b9e\u8fd8\u662f\u8d39\u67e5\u66f4\u7b80\u5355\u7684\u3002\u4f46\u662f\u901a\u8fc7\u5206\u6790API\u8c03\u7528\u6765\u4e86\u89e3\u6076\u610f\u8f6f\u4ef6\u7684\u884c\u4e3a\uff0c\u5176\u5b9e\u5e76\u4e0d\u662f\u4e00\u4ef6\u5bb9\u6613\u7684\u4e8b\u60c5\uff0c\u56e0\u4e3a\u6211\u4eec\u53d1\u73b0\u6709\u5f88\u591a\u7684\u6076\u610f\u8f6f\u4ef6\u4f1a\u6dfb\u52a0\u65e0\u6548\/\u5197\u4f59\u7684API\u8c03\u7528\u6765\u589e\u52a0\u6211\u4eec\u7684\u5206\u6790\u96be\u5ea6\u3002\u4f46\u65e0\u8bba\u600e\u6837\uff0c\u5206\u6790API\u8c03\u7528\u4e5f\u662f\u4e00\u79cd\u68c0\u6d4b\u6076\u610f\u8f6f\u4ef6\u7684\u6709\u6548\u65b9\u6cd5\uff0c\u56e0\u4e3a\u653b\u51fb\u8005\u60f3\u8981\u505a\u7684\u4e8b\u60c5\uff0c\u80af\u5b9a\u8981\u5728\u4ee3\u7801\u4e2d\u6709\u6240\u4f53\u73b0\u3002<\/p>\n
\n
\u539f\u6587\u6765\u81ea\uff1ahttp:\/\/www.tiejiang.org\/19886.html<\/a><\/p>\n
\u672c\u6587\u5730\u5740\uff1a http:\/\/lrxjmw.cn\/api-PCvirus.html<\/a>\u7f16\u8f91\uff1a\u502a\u5bb6\u5174\uff0c\u5ba1\u6838\u5458\uff1a\u9004\u589e\u5b9d<\/span><\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"
\u5bfc\u8bfb \u5728\u4eca\u5e74\u7684\u4e0a\u4e00\u4e2a\u5b63\u5ea6\uff0c\u6211\u4eec\u53d1\u73b0\u6709\u8d8a\u6765\u8d8a\u591a\u7684\u6076\u610f\u8f6f\u4ef6\u5f00\u59cb\u4f7f\u7528\u5404\u79cd\u52a0\u5bc6\u3001\u5c01\u88c5\u548c\u52a0\u58f3\u7b49\u4fdd\u62a4\u6280\u672f\u6765\u5bf9 […]<\/p>\n","protected":false},"author":362,"featured_media":88607,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[55],"tags":[],"class_list":["post-88595","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-thread"],"acf":[],"_links":{"self":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts\/88595","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/users\/362"}],"replies":[{"embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/comments?post=88595"}],"version-history":[{"count":3,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts\/88595\/revisions"}],"predecessor-version":[{"id":88650,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts\/88595\/revisions\/88650"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/media\/88607"}],"wp:attachment":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/media?parent=88595"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/categories?post=88595"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/tags?post=88595"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}