一个多重变形vbs木马解码分析  

Analysis of Decrypting One Encrypted vbs Trojan

作　　者：金玉荣[1] 谢亿鑫[1] 杨奕[1] 张博[1] 

机构地区：[1]无锡江南计算技术研究所,江苏无锡214083

出　　处：《信息网络安全》2013年第12期67-70,共4页Netinfo Security

摘　　要：脚本类木马为了提高其生存能力和反调试能力,多以转换数据的方式存储指令代码,使其变形的指令在内存中解码并运行,从而导致无法对其进行有效的分析。文章通过脚本调试技术,在对脚本进行充分分析的基础上,不断转储木马解码数据,同时修改木马相关执行参数和运行环境参数,分析了木马的完整解码过程和运行过程。In order to improve the survival and anti-adaptability, Script Trojan stores encrypted instruction code in Script, decrypt and runs them in memory. This has resulted that it is difficult to analyze the Trojan. On the basis of full analysis of the script and by script debugging techniques, by means of modifying the Trojan＇s execution parameters and operating environmental parameters, this paper completes analysis of the Script Trojan decryption process and running process.

关 键 词：木马 脚本 变形 解码 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]