一款疑似Stuxnet的恶意代码的动态分析  

Dynamic Analysis of a Suspected Stuxnet Malicious Code

作　　者：王光卫[1] 潘泓[1] 范明钰[1] 

机构地区：[1]电子科技大学计算机学院,四川成都611731

出　　处：《实验室研究与探索》2014年第8期119-122,共4页Research and Exploration In Laboratory

基　　金：国家863项目(2009AA01Z435;2009AA01Z403);信息保障技术重点实验室开放基金资助

摘　　要：Stuxnet又名"震网",是针对微软系统以及西门子工业系统的最新恶意代码,目前已席卷全球工业界,感染多个国家及地区的工业系统和个人用户。与以往恶意代码不同,其代码非常复杂但是相关的分析实验报道较少。本文通过动态分析实验,给出了一款最新发现的恶意代码的基本行为。分析发现该样本与著名的Stuxnet的功能特征十分相似。Stuxnet is also known as “shock”,and is a new malicious code designed for MS systems as well as Siemens Industrial systems.It has swept the world industry,a lot of industrial systems and individual users in many countries and regions are infected.Differing from previous malicious code,the code is very complex but few relevant analysis experiments were reported.Through the dynamic analysis experiment,the basic behavior of a newly discovered malicious code is given.Analysis shows that the functional characteristics of the sample are very similar with the famous Stuxnet.

关 键 词：恶意代码 动态分析 网震 

分 类 号：TP31[自动化与计算机技术—计算机软件与理论]