今天在机房的机器上使用U盘,插上去,打开,U盘里出现了一个隐藏的熊猫图标的可执行文件setup.exe和另一个名为autorun.inf的文件,我猜可能是病毒。在尝试了几次要删除两者都已失败而告终后,我确定了这是一个病毒。
随后,我将我U盘格式化了。由于机房的机器安装有还原卡,在将机房的机器重启后,C盘被还原,病毒没有被激活,虽然D盘有病毒的安装文件setup.exe,但由于没有安装,所以没有被感染。我试着用C32Asm反汇编了病毒的setup.exe的文件,并用自己写的文件分析器分析了该文件,得到以下的一些数据。反汇编代码由于太多,放在附件里了。
The Programme setup.exe Is An Exeactuable File !
+++++++++++++++++ FILE HEADER IMFORMATION ++++++++++++++++++++++++++++++++
Machine 014C
NumberOfSections 0008
TimeDateStamp 2A425E19
PointerToSymbolTable 00000000
NumberOfSymbols 00000000
SizeOfOptionalHeader 00E0
Characteristics 818E
Brief Tips :
----> 1. Runs At The Environment Of 32-Bit Machine.
----> 2. Contains 8 Sections.
----> 3. Created Time : 2A425E19
----> 4. OptionalHeader Size Is 224(dec) Bytes.
FILE HEADER Features : EXECUTABLE, 32BIT_MACHINE,
+++++++++++++++++ OPTIONAL HEADER IMFORMATION ++++++++++++++++++++++++++++
AddressOfEntryPoint 0000CDAE
ImageBase 00400000
SizeOfImage 00014000
SizeOfCode 00000000
BaseOfCode 00001000
BaseOfData 0000D000
Subsystem 00000002
CheckSum 00000000
MajorLinkerVersion 00000002
MajorImageVersion 00000000
MajorSubsystemVersion 00000004
SectionAlignment 00001000
SizeOfHeaders 00000400
DllCharacteristics 00000000
FileAlignment 00000200
SizeOfDataDirectory 00000010
AddressOfDataDirectory 0048A824
-----> DataDirectory :
Item RVA Size
---------------------------------------------------------------------
Export Table 00000000 00000000
Import Table 0000F000 00000C68
Resource 00013000 00000A00
Exception 00000000 00000000
Security 00000000 00000000
Relocation 00012000 00000AA4
Debug 00000000 00000000
Copyright 00000000 00000000
GlobalPtr 00000000 00000000
Tls Table 00011000 00000018
Load Config 00000000 00000000
IAT 00000000 00000000
Bound Import 00000000 00000000
COM 00000000 00000000
Delay Import 00000000 00000000
No Use 00000000 0
SubSystem(User Interface) Features : WINDOWS_GUI_SUBSYSTEM.
++++++++++++++++++ SECTION HEADER IMFORMATION +++++++++++++++++++++++++
-> 8 Sections Contained !
Name VOffset VSize ROffset RSize Flags
-----------------------------------------------------------------------
.MaskPE 00001000 0000BDD6 00000400 0000BE00 60000020
DATA 0000D000 000002C0 0000C200 00000400 C0000040
BSS 0000E000 000007DD 0000C600 00000000 C0000000
.idata 0000F000 00000C68 0000C600 00000E00 C0000040
.tls 00010000 00000008 0000D400 00000000 C0000000
.rdata 00011000 00000018 0000D400 00000200 50000040
.reloc 00012000 00000AA8 0000D600 00000C00 50000040
.rsrc 00013000 00000A00 0000E200 00000A00 50000040
.MaskPE Segment Features : CODE Included, EXECUTABLE, READABLE,
DATA Segment Features : INITIALIZED_DATA Included, READABLE, WRITABLE,
BSS Segment Features : READABLE, WRITABLE,
.idata Segment Features : INITIALIZED_DATA Included, READABLE, WRITABLE,
.tls Segment Features : READABLE, WRITABLE,
.rdata Segment Features : INITIALIZED_DATA Included, DATA_SHARED, READABLE,
.reloc Segment Features : INITIALIZED_DATA Included, DATA_SHARED, READABLE,
.rsrc Segment Features : INITIALIZED_DATA Included, DATA_SHARED, READABLE,
++++++++++++++++++++++++++ Export Table Information +++++++++++++++++++++
-> No Export Table !
++++++++++++++++++++++++++ Import Table Information +++++++++++++++++++++
------------------------------------------------------------------------
Name 0000F358 TimeDateStamp 00000000
OriginalFirstThunk 00000000 FirstThunk 0000F12C
ForwarderChain 00000000 Characteristics 00000000
-> DLL Name : kernel32.dll
|
-> ThunkRVA ThunkValue Hint Function Name
----------------------------------------------------------------------
0000F12C 0000F366 0000 DeleteCriticalSection
0000F130 0000F37E 0000 LeaveCriticalSection
0000F134 0000F396 0000 EnterCriticalSection
0000F138 0000F3AE 0000 InitializeCriticalSection
0000F13C 0000F3CA 0000 VirtualFree
0000F140 0000F3D8 0000 VirtualAlloc
0000F144 0000F3E8 0000 LocalFree
0000F148 0000F3F4 0000 LocalAlloc
0000F14C 0000F402 0000 GetTickCount
0000F150 0000F412 0000 QueryPerformanceCounter
0000F154 0000F42C 0000 GetVersion
0000F158 0000F43A 0000 GetCurrentThreadId
0000F15C 0000F450 0000 WideCharToMultiByte
0000F160 0000F466 0000 MultiByteToWideChar
0000F164 0000F47C 0000 GetThreadLocale
0000F168 0000F48E 0000 GetStartupInfoA
0000F16C 0000F4A0 0000 GetModuleFileNameA
0000F170 0000F4B6 0000 GetLocaleInfoA
0000F174 0000F4C8 0000 GetLastError
0000F178 0000F4D8 0000 GetCommandLineA
0000F17C 0000F4EA 0000 FreeLibrary
0000F180 0000F4F8 0000 ExitProcess
0000F184 0000F506 0000 CreateThread
0000F188 0000F516 0000 WriteFile
0000F18C 0000F522 0000 UnhandledExceptionFilter
0000F190 0000F53E 0000 SetFilePointer
0000F194 0000F550 0000 SetEndOfFile
0000F198 0000F560 0000 RtlUnwind
0000F19C 0000F56C 0000 ReadFile
0000F1A0 0000F578 0000 RaiseException
0000F1A4 0000F58A 0000 GetStdHandle
0000F1A8 0000F59A 0000 GetFileSize
0000F1AC 0000F5A8 0000 GetFileType
0000F1B0 0000F5B6 0000 CreateFileA
0000F1B4 0000F5C4 0000 CloseHandle
------------------------------------------------------------------------
Name 0000F5D2 TimeDateStamp 00000000
OriginalFirstThunk 00000000 FirstThunk 0000F1BC
ForwarderChain 00000000 Characteristics 00000000
-> DLL Name : user32.dll
|
-> ThunkRVA ThunkValue Hint Function Name
----------------------------------------------------------------------
0000F1BC 0000F5DE 0000 GetKeyboardType
0000F1C0 0000F5F0 0000 MessageBoxA
0000F1C4 0000F5FE 0000 CharNextA
------------------------------------------------------------------------
Name 0000F60A TimeDateStamp 00000000
OriginalFirstThunk 00000000 FirstThunk 0000F1CC
ForwarderChain 00000000 Characteristics 00000000
-> DLL Name : advapi32.dll
|
-> ThunkRVA ThunkValue Hint Function Name
----------------------------------------------------------------------
0000F1CC 0000F618 0000 RegQueryValueExA
0000F1D0 0000F62C 0000 RegOpenKeyExA
0000F1D4 0000F63C 0000 RegCloseKey
------------------------------------------------------------------------
Name 0000F64A TimeDateStamp 00000000
OriginalFirstThunk 00000000 FirstThunk 0000F1DC
ForwarderChain 00000000 Characteristics 00000000
-> DLL Name : oleaut32.dll
|
-> ThunkRVA ThunkValue Hint Function Name
----------------------------------------------------------------------
0000F1DC 0000F658 0000 SysFreeString
0000F1E0 0000F668 0000 SysAllocStringLen
------------------------------------------------------------------------
Name 0000F67C TimeDateStamp 00000000
OriginalFirstThunk 00000000 FirstThunk 0000F1E8
ForwarderChain 00000000 Characteristics 00000000
-> DLL Name : kernel32.dll
|
-> ThunkRVA ThunkValue Hint Function Name
----------------------------------------------------------------------
0000F1E8 0000F68A 0000 TlsSetValue
0000F1EC 0000F698 0000 TlsGetValue
0000F1F0 0000F6A6 0000 LocalAlloc
0000F1F4 0000F6B4 0000 GetModuleHandleA
------------------------------------------------------------------------
Name 0000F6C8 TimeDateStamp 00000000
OriginalFirstThunk 00000000 FirstThunk 0000F1FC
ForwarderChain 00000000 Characteristics 00000000
-> DLL Name : advapi32.dll
|
-> ThunkRVA ThunkValue Hint Function Name
----------------------------------------------------------------------
0000F1FC 0000F6D6 0000 RegSetValueExA
0000F200 0000F6E8 0000 RegOpenKeyExA
0000F204 0000F6F8 0000 RegDeleteValueA
0000F208 0000F70A 0000 RegCreateKeyExA
0000F20C 0000F71C 0000 RegCloseKey
0000F210 0000F72A 0000 OpenProcessToken
0000F214 0000F73E 0000 LookupPrivilegeValueA
0000F218 0000F756 0000 AdjustTokenPrivileges
------------------------------------------------------------------------
Name 0000F76E TimeDateStamp 00000000
OriginalFirstThunk 00000000 FirstThunk 0000F220
ForwarderChain 00000000 Characteristics 00000000
-> DLL Name : kernel32.dll
|
-> ThunkRVA ThunkValue Hint Function Name
----------------------------------------------------------------------
0000F220 0000F77C 0000 WriteFile
0000F224 0000F788 0000 WinExec
0000F228 0000F792 0000 TerminateProcess
0000F22C 0000F7A6 0000 Sleep
0000F230 0000F7AE 0000 SetFilePointer
0000F234 0000F7C0 0000 SetFileAttributesA
0000F238 0000F7D6 0000 OpenProcess
0000F23C 0000F7E4 0000 LoadLibraryA
0000F240 0000F7F4 0000 GetWindowsDirectoryA
0000F244 0000F80C 0000 GetVersionExA
0000F248 0000F81C 0000 GetTempPathA
0000F24C 0000F82C 0000 GetSystemDirectoryA
0000F250 0000F842 0000 GetProcAddress
0000F254 0000F854 0000 GetModuleHandleA
0000F258 0000F868 0000 GetModuleFileNameA
0000F25C 0000F87E 0000 GetLocalTime
0000F260 0000F88E 0000 GetLastError
0000F264 0000F89E 0000 GetFileAttributesA
0000F268 0000F8B4 0000 GetDriveTypeA
0000F26C 0000F8C4 0000 GetCurrentProcess
0000F270 0000F8D8 0000 FreeLibrary
0000F274 0000F8E6 0000 FindNextFileA
0000F278 0000F8F6 0000 FindFirstFileA
0000F27C 0000F908 0000 FindClose
0000F280 0000F914 0000 FileTimeToLocalFileTime
0000F284 0000F92E 0000 FileTimeToDosDateTime
0000F288 0000F946 0000 ExitProcess
0000F28C 0000F954 0000 DeleteFileA
0000F290 0000F962 0000 CreateThread
0000F294 0000F972 0000 CreateFileA
0000F298 0000F980 0000 CopyFileA
0000F29C 0000F98C 0000 CompareStringA
0000F2A0 0000F99E 0000 CloseHandle
------------------------------------------------------------------------
Name 0000F9AC TimeDateStamp 00000000
OriginalFirstThunk 00000000 FirstThunk 0000F2A8
ForwarderChain 00000000 Characteristics 00000000
-> DLL Name : mpr.dll
|
-> ThunkRVA ThunkValue Hint Function Name
----------------------------------------------------------------------
0000F2A8 0000F9B4 0000 WNetCancelConnectionA
0000F2AC 0000F9CC 0000 WNetAddConnection2A
------------------------------------------------------------------------
Name 0000F9E2 TimeDateStamp 00000000
OriginalFirstThunk 00000000 FirstThunk 0000F2B4
ForwarderChain 00000000 Characteristics 00000000
-> DLL Name : user32.dll
|
-> ThunkRVA ThunkValue Hint Function Name
----------------------------------------------------------------------
0000F2B4 0000F9EE 0000 keybd_event
0000F2B8 0000F9FC 0000 SetTimer
0000F2BC 0000FA08 0000 PostMessageA
0000F2C0 0000FA18 0000 MapVirtualKeyA
0000F2C4 0000FA2A 0000 KillTimer
0000F2C8 0000FA36 0000 GetWindowTextA
0000F2CC 0000FA48 0000 GetMessageA
0000F2D0 0000FA56 0000 GetDesktopWindow
0000F2D4 0000FA6A 0000 FindWindowExA
0000F2D8 0000FA7A 0000 FindWindowA
0000F2DC 0000FA88 0000 DispatchMessageA
0000F2E0 0000FA9C 0000 CharUpperBuffA
------------------------------------------------------------------------
Name 0000FAAE TimeDateStamp 00000000
OriginalFirstThunk 00000000 FirstThunk 0000F2E8
ForwarderChain 00000000 Characteristics 00000000
-> DLL Name : wsock32.dll
|
-> ThunkRVA ThunkValue Hint Function Name
----------------------------------------------------------------------
0000F2E8 0000FABA 0000 WSACleanup
0000F2EC 0000FAC8 0000 WSAStartup
0000F2F0 0000FAD6 0000 gethostname
0000F2F4 0000FAE4 0000 gethostbyname
0000F2F8 0000FAF4 0000 socket
0000F2FC 0000FAFE 0000 inet_ntoa
0000F300 0000FB0A 0000 inet_addr
0000F304 0000FB16 0000 htons
0000F308 0000FB1E 0000 connect
0000F30C 0000FB28 0000 closesocket
------------------------------------------------------------------------
Name 0000FB36 TimeDateStamp 00000000
OriginalFirstThunk 00000000 FirstThunk 0000F314
ForwarderChain 00000000 Characteristics 00000000
-> DLL Name : wininet.dll
|
-> ThunkRVA ThunkValue Hint Function Name
----------------------------------------------------------------------
0000F314 0000FB42 0000 InternetGetConnectedState
0000F318 0000FB5E 0000 InternetReadFile
0000F31C 0000FB72 0000 InternetOpenUrlA
0000F320 0000FB86 0000 InternetOpenA
0000F324 0000FB96 0000 InternetCloseHandle
------------------------------------------------------------------------
Name 0000FBAC TimeDateStamp 00000000
OriginalFirstThunk 00000000 FirstThunk 0000F32C
ForwarderChain 00000000 Characteristics 00000000
-> DLL Name : advapi32.dll
|
-> ThunkRVA ThunkValue Hint Function Name
----------------------------------------------------------------------
0000F32C 0000FBBA 0000 OpenServiceA
0000F330 0000FBCA 0000 OpenSCManagerA
0000F334 0000FBDC 0000 DeleteService
0000F338 0000FBEC 0000 ControlService
0000F33C 0000FBFE 0000 CloseServiceHandle
------------------------------------------------------------------------
Name 0000FC14 TimeDateStamp 00000000
OriginalFirstThunk 00000000 FirstThunk 0000F344
ForwarderChain 00000000 Characteristics 00000000
-> DLL Name : netapi32.dll
|
-> ThunkRVA ThunkValue Hint Function Name
----------------------------------------------------------------------
0000F344 0000FC22 0000 NetRemoteTOD
0000F348 0000FC32 0000 NetScheduleJobAdd
------------------------------------------------------------------------
Name 0000FC46 TimeDateStamp 00000000
OriginalFirstThunk 00000000 FirstThunk 0000F350
ForwarderChain 00000000 Characteristics 00000000
-> DLL Name : URLMON.DLL
|
-> ThunkRVA ThunkValue Hint Function Name
----------------------------------------------------------------------
0000F350 0000FC52 0000 URLDownloadToFileA
-> 14 (dec) Dll File(s) Included !
我在网上又找了一些关于这个熊猫病毒的一些资料,看了一些他的表现,知道该病毒确实不可小觑。国内的一些杀毒软件对他没办法,现在唯一的杀毒办法似乎只有使用专杀工具。不过这个病毒做的很狡猾,他会阻止windows任务管理器的打开,在被感染状态下,专杀工具也没有办法启动。不过,它在windows启动时会随系统一起启动,只要删除它的启动项,就可以用专杀工具将其杀灭。
新年到了,大家欢喜之余也小心计算机的安全,我周围有人因为这个病毒没办法只好作整个硬盘的格式化了。图标是熊猫在烧三注香,大家多注意。希望上面的信息对大家有所帮助。更多的信息大家可以参考
http://pluto1313.bokee.com/viewdiary.13531598.html
最后,祝大家新年快乐,Happy New Year !^_^
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)
上传的附件: