Cryzip勒索型特洛伊程序的简单分析

文件名：vcmauth.dll 
文件大小：1,191,936 字节
MD5校检：86a48836bced8c4a0b59fca972800890 
SHA1校检：0b3a49b3172fc65db607fcb1b8029820ec11c5b6[2]
壳：无
编译器：Visual C++ 6.0 
编译日期：Thu Mar 2 18:11:02 2006 
CME号：无 
验证字符串： 
zippo.dll 
ZippoCrypt 
_zippo_crypter_v1.0_

.arh .asm .arj .bas .cdr .cgi .chm .cpp .db1 .db2 
.dbf .dbt .dbx .doc .dpr .dsw .frm .frt .frx .gtd 
.gzip .jpg .key .kwm .lst .man .mdb .mmf .old .p12 
.pas .pak .pdf .pgp .pwl .pwm .rar .rtf .safe .tar 
.txt .xls .xml .zip

OUR E-GOLD ACCOUNT: XXXXXXX

INSTRUCTIONS HOW TO GET YUOR FILES BACK
READ CAREFULLY. IF YOU DO NOT UNDERSTAND, READ AGAIN.

This is automated report generated by auto archiving software.

Your computer catched our software while browsing illigal porn
pages, all your documents, text files, databases was archived
with long enought password.

You can not guess the password for your archived files - password
lenght is more then 10 symbols that makes all password recovery
programs fail to bruteforce it (guess password by trying all
possible combinations).

Do not try to search for a program what encrypted your information - it
is simply do not exists in your hard disk anymore.
If you really care about documents and information in encrypted files
you can pay using electonic currency $300.
Reporting to police about a case will not help you, they do not know
password. Reporting somewhere about our e-gold account will not help
you to restore files. This is your only way to get yours files back.

2934363 2917501 2917505 2917510 2934369 2934376 2934380 2934382 2934383 2934389
2934392 2934394 2934396 2934404 2934409 2934419 2934421 2934425 2934427 2897227
2934430 2897191 2897193 2934435 2897209 2897212 2934441 2897232 2934446 2934448 
2897243 2897258 2934452 2897021 2917497 2934354 2934356 2917500 2897263 2934455 
2934459 2934466 2934469 2934477 2934491 2934501 2934506 2934510 2934515 2934474 

2934782 2934788 2934799 2934806 2934814 2934816 2934820 2934825 2934829 2934832 
2934837 2934841 2934849 2934853 2934860 2934862 2934866 2934872 2934869 2934885 
2934880 2934891 2934895 2934898 2934903 2934925 2934929 2934938 2934948 2934953 
2934956 2934964 2934480 2934487 2934775 2934802 2934811 2934864 2935277 2935274 
2935268 2935264 2935260 2935252 2935244 2935235 2935232 2935229 2935223

C:\Program Files\Microsoft Visual Studio\VC98