Linux.Ngioweb分析报告

栏目: 编程工具 · 发布时间: 4年前

内容简介：2019年5月27号，360Netlab 未知威胁检测系统发现一个可疑的ELF文件，目前仅有一款杀毒引擎检测识别。通过详细分析，我们确定这是一款Proxy Botnet，并且是Win32.Ngioweb[此外，我们还观察到大量部署WordPress的Web服务器被植入Linux.Ngioweb 恶意软件。尽管Bot程序由Web容器对应的用户组运行并且权限很小但还是能够正常工作，并被充当Rotating Reverse Proxy[目前，我们还没有看清楚Linux.Ngioweb攻击者的目的，但我们猜测他可能

背景介绍

2019年5月27号，360Netlab 未知威胁检测系统发现一个可疑的ELF文件，目前仅有一款杀毒引擎检测识别。通过详细分析，我们确定这是一款Proxy Botnet，并且是Win32.Ngioweb[ 1] 恶意软件的 Linux 版本变种，我们将它命名为Linux.Ngioweb。它与Win32.Ngioweb共用了大量代码，不同的是它新增了DGA特性。我们注册了其中一个DGA C2域名(enutofish-pronadimoful-multihitision.org)，并对它进行Sinkhole处理以此来观察Bot连接情况。

此外，我们还观察到大量部署WordPress的Web服务器被植入Linux.Ngioweb 恶意软件。尽管Bot程序由Web容器对应的用户组运行并且权限很小但还是能够正常工作，并被充当Rotating Reverse Proxy[ 2] 节点。

目前，我们还没有看清楚Linux.Ngioweb攻击者的目的，但我们猜测他可能会监听代理网络流量。

Linux.Ngioweb概览

Linux.Ngioweb Bot样本的主要功能是在受害者的机器上实现Back-Connect Proxy[ 3] 。攻击者将多个Bot构建为一个Proxies Pool，并通过双层C2协议控制，然后提供Rotating Reverse Proxy Service。

Linux.Ngioweb分析报告

Linux.Ngioweb逆向分析

样本信息

  • MD5: 827ecf99001fa66de513fe5281ce064d
ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), statically linked, stripped

样本对抗技巧

  • 使用小众的musl libc库

    Linux.Ngioweb分析报告

  • 将所需函数预存在function table中

    Linux.Ngioweb分析报告

  • 使用Stack Strings Obfuscation技术

    Linux.Ngioweb分析报告

  • 动态生成CRC，AES加密算法所需常量表

    Linux.Ngioweb分析报告

  • 使用双层C2协议，其中Stage-2 C2由Stage-1 C2的CONNECT指令确定

  • Stage-2 C2使用双层加密的通信协议

Stage-1 C2协议分析

在此阶段样本的主要行为是和Stage-1 C2建立通信，根据C2返回的指令进行下一步的操作。

通信尝试

  • 每隔60秒尝试和以下硬编码C2 IP建立通信

    169.239.128.166:443

    185.244.149.73:443

  • 每隔73秒尝试和DGA (Domain Generation Algorithm) 生成的域名建立通信。当DGA域名数达到300时，Seed会重置，所以DGA域名总数只有300。

    Linux.Ngioweb分析报告

DGA实现

uint64_t GenSeed(uint32_t& seed, uint32_t mod)
{
      uint32_t tmp = 0x41C64E6D * seed + 0x3039;
      seed = tmp;
      return tmp % mod;
}
string dga(uint32_t& seed)
{
      char* HeadBuf[] = { "un", "under", "re", "in", "im", "il", "ir", "en", "em",
                          "over", "mis", "dis", "pre", "post", "anti","inter",
                          "sub", "ultra", "non", "de","pro", "trans", "ex",
                          "macro", "micro", "mini","mono", "multi", "semi", "co" };

      char* BodyBufA[] = {"able","ant","ate","age","ance","ancy","an","ary",
                          "al","en","ency","er","etn", "ed", "ese","ern","ize",
                          "ify","ing","ish","ity","ion","ian","ism","ist","ic","ical",
                          "ible","ive","ite","ish","ian","or","ous","ure" };

      char* BodyBufB[] = {"dom","hood","less","like","ly","fy","ful","ness",
                          "ment","sion","ssion","ship","ty","th","tion","ward" };

      char* TailBuf[] = { ".net",".info",".com",".biz",".org",".name" };

      string BlockBufA = "aeiou";
      string BlockBufB = "bcdfghklmnprstvxz";
      string domain;
      uint32_t dashloop = GenSeed(seed, 3) + 1;
      while (dashloop--)
      {
              domain += HeadBuf[GenSeed(seed, 0x1e)];
              int flag = 0;
              int i = 0;
              if (BlockBufA.find(domain.back()) == string::npos)
                      flag = 1;
              int fillcnt = GenSeed(seed, 0x3) + 4;
              while (fillcnt > i)
              {

                      if (flag + i & 1)
                              domain += BlockBufA[GenSeed(seed, 0x5)];
                      else
                              domain += BlockBufB[GenSeed(seed, 0x11)];
                      i++;
              }
              if (BlockBufA.find(domain.back()) == string::npos)
                      domain += BodyBufA[GenSeed(seed, 0x23)];
              else
                      domain += BodyBufB[GenSeed(seed, 0x10)];
              if (dashloop != 0)
                      domain += "-";
      }
      return domain += TailBuf[GenSeed(seed, 0x6)];
}

通信协议

此阶段通信是基于HTTP协议，并将参数内容进行了Base64编码。

数据包概览

Linux.Ngioweb分析报告

发包解析

将参数内容通过Base64解码后可以看到以下信息

Linux.Ngioweb分析报告

  • id=machine-id[0:15]

    Linux.Ngioweb分析报告

  • v=x86_64，硬编码，架构

  • sv=5003，硬编码，版本号

  • &qlohmzalwdepupwf,随机16字节数据，算法如下

    Linux.Ngioweb分析报告

  • User-Agent，硬编码

    Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0

收包解析

Linux.Ngioweb分析报告

支持的指令

  • WAIT
  • CONNECT
  • DISCONNECT
  • CERT

Stage-2 C2协议分析

在此阶段样本的主要行为是和Stage-2的C2建立通信，开启Back-Connect Proxy功能。

通信协议

此阶段通信是经过双层加密组合合成，内层为XOR，外层为AES。

数据包概览

Linux.Ngioweb分析报告

加密算法

XOR的Key由随机算法产生

Linux.Ngioweb分析报告

算法为

Linux.Ngioweb分析报告

AES使用ECB模式，无填充，Key为 qwerasdfzxcqwerasdftyuirfdsdsdss

数据包结构

数据包由header和msg俩部分组成

header结构

#le->little endian
#be->big endian
struct header
{
	uint32_le xorkey;
	uint32_be msgcrc32;
	uint32_be len;
	uint16_be msgcode
	uint16_be magic
};

msg由chunk构成，样本支持的chunk如下

Chunk Type Chunk Length Description
1 1 BYTE
2 2 WORD big endian
3 4 DWORD big endian
4 8 QWORD big endian
5 N+4 Bytes array.The first 4 bytes of chunk are the big endian-encoded length (N) of the array

一个msg可以有一个或多个chunk,不同的msg有不同的格式。

样本支持的msg类型分recv和send 两种

  • recv

    Linux.Ngioweb分析报告

  • send

    Linux.Ngioweb分析报告

汇总见下表

msgcode Driection Description Fromat
0x1010 recv set channel id 3 chunks:(QWORD ConnId, Array IPAddr,WORD Port)
0x1011 recv start proxy request 5 chunks:(QWORD RequestId, BYTE reason,BYTE AddrType,Array Addr, WORD port)
0x1012 recv close connection 1 chunk:(QWORD ConnId)
0x10 send check-in 1 chunk:(QWORD BotId)
0x11 send set-channel ack 1 chunk:(DWORD VersionId)
0x14 send tcp server started 5 chunks:(DWORD ConnectionId, QWORD RequestId, BYTE AddrType, Array Addr, WORD Port)
0x15 send error 2 chunks:(DWORD RequestId,BYTE reason )
0x16 send udp server started 5 chunks:(DWORD ConnectionId, QWORD RequestId, BYTE AddrType, Array Addr, WORD Port)

发包解析样例

  • 原始数据（数据包结构）

    packet[0:31]:
 6c 52 8c 08 3e 80 a9 3c 00 00 00 10 00 10 fa 51 
 04 dd b0 b4 9d 10 ec 42 c3 00 00 00 00 00 00 00
 header		--->packet[0:15]
 	xorkey		--->0x088c526c
 	msgcrc32	--->0x3e80a93c
 	msglen		--->0x00000010
 	msgcode		--->0x0010,check-in 
 	magic		--->0xfa51
 msg		--->packet[16:31]
 	1st chunk
 		chunktype	--->0x4
 		content		--->0xddb0b49d10ec42c3

  • XOR加密后

    6c 52 8c 08 36 0c fb 50 08 8c 52 7c 08 9c a8 3d 
0c 51 e2 d8 95 9c be 2e cb 8c 52 6c 08 8c 52 6c

  • AES加密后

    c1 d3 78 71 2d f6 5b bb  16 ca ff 8b ef 69 bb 26
3b 01 f0 22 70 09 38 dc  e7 06 89 de 2b 55 eb 8e

收包解析样例

  • 原始数据

    c5 ad 4a bf 30 C2 3a 43 9b 6e 22 08 73 e0 b9 5d 
3c e6 b7 f0 74 76 53 43 3a 79 0e 82 80 1a c3 84 
ba a4 85 05 4a 63 b1 d6 d1 94 ad 53 be 7a 9a 88

  • AES解密后

    59 8b e5 6d 4a ee bf ef 6d e5 8b 79 7d f5 71 08
69 b8 81 aa 92 ed 65 fb 29 e0 8b 59 6d e1 51 47
19 e1 89 d8 29 e5 8b 59 6d e5 8b 59 6d e5 8b 59

  • XOR解密后（数据包结构）

    packet[0:47]
    59 8b e5 6d 27 0b 34 b6 00 00 00 20 10 10 fa 51
    04 5d 0a f3 ff 08 ee a2 44 05 00 00 00 04 da 1e
    74 04 02 81 44 00 00 00 00 00 00 00 00 00 00 00

  header		--->packet[0:15]
    xorkey		--->0x6de58b59
    msgcrc32	--->0x270b34b6
    msglen		--->0x00000020
    msgcode		--->0x1010,set channel id
    magic		--->0xfa51

  msg			--->packet[16:47]
    1st chunk
        chunktype	--->0x04
        content		--->0x5d0af3ff08eea244
    2nt chunk
        chunktype	--->0x05
        content		--->len:0x00000004 buf:0xda1e7404
    3rd chunk
        chunktype	--->0x02
        content		--->0x8144

Stage-2 C2关联分析

我们通过访问Stage-1 C2 URL ( http://185.244.149.73:443/min.js ) 共得到以下6个Stage-2 C2的地址。 

5.135.58.119
5.135.58.121
5.135.58.123
5.135.58.124
91.134.157.11
193.70.73.115

通过我们的图系统关联test.zip的MD5（9017804333c820e3b4249130fc989e00）得到了更多的URL并对他们进行指纹识别，确认了另外18个存活的Stage-2 C2。

5.135.35.160
5.196.194.209
51.254.57.83
54.36.244.84
54.36.244.85
54.36.244.91
91.121.36.212
91.121.236.219
92.222.151.63
145.239.108.241
163.172.201.184
163.172.202.116
178.33.101.176
178.33.101.177
178.33.101.178
178.33.101.182
188.165.5.123
188.165.163.20

我们在free-socks.in网站上可以检索到Stage-2 C2 IP地址正在提供Socks5代理服务。

Linux.Ngioweb分析报告

我们测试这些Socks5代理IP均正常工作，同时它们也通过Stage-1 C2协议访问了我们Sinkhole 的C2域名(enutofish-pronadimoful-multihitision.org)，所以可以说明他们都是Linux.Ngioweb Bot。

root@localhost:~# curl --socks5 91.134.157.11:50880 ifconfig.me
31.170.123.49

root@localhost:~# curl --socks5 91.134.157.11:62012 ifconfig.me
208.113.197.88

root@localhost:~# curl --socks5 91.134.157.11:18278 ifconfig.me
45.58.190.100

root@localhost:~# curl --socks5 91.134.157.11:64380 ifconfig.me
72.29.64.29

root@localhost:~# curl --socks5 91.134.157.11:47067 ifconfig.me
54.38.101.17

root@localhost:~# curl --socks5 91.134.157.11:63862 ifconfig.me
88.99.212.97

root@localhost:~# curl --socks5 91.134.157.11:49475 ifconfig.me
23.91.65.240

被感染的IP信息

通过Sinkhole C2域名(enutofish-pronadimoful-multihitision.org)，我们目前共观察到有2692个Bot IP。

Linux.Ngioweb分析报告

以下是被感染的IP 国家/地区详细列表

US 1306
BR 156
RU 152
DE 133
FR 102
SG 98
NL 80
GB 66
CA 66
IT 64
VN 42
AU 36
PL 31
TR 28
JP 26
IN 26
ZA 21
ID 19
ES 18
UA 15

通过对被感染IP指纹识别，我们观察到几乎所有Bot IP都是Web服务器，同时都部署了WordPress程序，但是我们还不能确定攻击者是如何入侵WordPress网站。

我们通过联系一些受感染者用户，并在他们的Web服务器上发现了多种类型的WebShell，这些WebShell都是高度混淆，但是混淆手法，加密方式以及编码特征相似。结合被感染IP访问Sinkhole时序特征，我们猜测攻击者会周期性地对受害者网站WebShell下发指令并运行Linux.Ngioweb程序。

处置建议

Linux.Ngioweb攻击者可能会监听代理网络流量，我们建议读者不要使用Stage-2 C2 IP提供的Socks5代理服务。

我们建议WordPress用户备份网站文章数据库(删除wp.service.controller.*等后门用户)，重新安装最新版本WordPress程序，增强用户密码复杂度，增强WebShell检测能力，并禁止 PHP 命令执行相关函数；

相关安全和执法机构，可以邮件联系netlab[at]360.cn获取被感染的IP地址列表。

联系我们

感兴趣的读者，可以在 twitter 或者在微信公众号 360Netlab 上联系我们。

IoC list

样本MD5

827ecf99001fa66de513fe5281ce064d

Stage-1 C2 (硬编码IP)

169.239.128.166     	South Africa        	ASN 61138           	Zappie Host LLC
185.244.149.73      	Romania             	ASN 60117           	Host Sailor Ltd.

Stage-2 C2

163.172.201.184     	France              	ASN 12876           	Online S.a.s.
163.172.202.116     	France              	ASN 12876           	Online S.a.s.
5.135.35.160        	France              	ASN 16276           	OVH SAS
5.135.58.119        	France              	ASN 16276           	OVH SAS
5.135.58.121        	France              	ASN 16276           	OVH SAS
5.135.58.123        	France              	ASN 16276           	OVH SAS
5.135.58.124        	France              	ASN 16276           	OVH SAS
5.196.194.209       	France              	ASN 16276           	OVH SAS
51.254.57.83        	France              	ASN 16276           	OVH SAS
54.36.244.84        	France              	ASN 16276           	OVH SAS
54.36.244.85        	France              	ASN 16276           	OVH SAS
54.36.244.91        	France              	ASN 16276           	OVH SAS
91.121.36.212       	France              	ASN 16276           	OVH SAS
91.121.236.219      	France              	ASN 16276           	OVH SAS
91.134.157.11       	France              	ASN 16276           	OVH SAS
92.222.151.63       	France              	ASN 16276           	OVH SAS
145.239.108.241     	Germany             	ASN 16276           	OVH SAS
178.33.101.176      	Ireland             	ASN 16276           	OVH SAS
178.33.101.177      	Ireland             	ASN 16276           	OVH SAS
178.33.101.178      	Ireland             	ASN 16276           	OVH SAS
178.33.101.182      	Ireland             	ASN 16276           	OVH SAS
188.165.5.123       	Ireland             	ASN 16276           	OVH SAS
188.165.163.20      	France              	ASN 16276           	OVH SAS
193.70.73.115       	France              	ASN 16276           	OVH SAS

Stage-1 C2 (DGA)

enutofish-pronadimoful-multihitision.org
exaraxexese-macrobacaward-exafosuness.net
nonafudazage.name
demigelike.net
emuvufehood.net
subolukobese.biz
inogepicor-prorarurument.biz
overahudulize-unazibezize-overuzozerish.org
imunolance-postodinenetn-antifipuketn.net
antizerolant-monogevudom.info
transavecaful-transinenation-transikaduhern.com
subogonance.info
inoxodusor-misehupukism.info
devikoviward-semibazegily-copaxugage.name
eniguzeless-inecimanable.net
subilebesion-irogipate.biz
colozosion-antigobunaful.name
inudiduty-dezaviness.org
irelizaring-enipulical-monovuxehossion.info
ilenudavous-monoxoxapal-semimihupution.info
ultrapadupize.biz
covategal-dezakedify-enebugassion.name
transivesudom-macropimuship.org
rezolezation-transapupirify-seminecation.name
macrolutoxous-overefimety.name
coxumumage-dexolalite.name
cotexafical-postirutuvian-emimimous.biz
copubuloness-misumusal-disokozian.com
nonecuzuking-enekopofen-imakozity.info
dezohipal-ultrazebebive.name
cosazalike-antifoxirer-subudikic.biz
underotutilism-monoceraretion-underosociful.name
overugiror.net
emuzixucize.biz
disicevament-desizigasion-recadihuful.biz
decehoward-microhikodely-overokerezant.com
microlasokadom-ultralarumous.info
minixecision-iruzaxuhood.net
profusonuty.info
multifipakency-conovofy-prorakikate.com
antiseramoment.info
postavutetn-emedarevous.biz
inolugoty-inidiverible.com
prodipamament.biz
overogobity-imivocurify-disovizution.biz
decozaness-antihazation-overetalovical.net
nonesolafy.com
unihatosancy.name
interiragocern-micropuxotion-transogorion.org
seminamatity-enogibely.name
inosebovion.net
exofifure-postirexument.info
transirirenern-semizafunic-nonivubed.biz
enegizize-microtizobity.name
macrohuseded-multipazaseship.com
imefihured-macrohixuhood.org
microlulition-macrokiguxable.biz
multizesumefy-emebefion.biz
underebelassion-postizoziless.info
dezuvazen.name
decotusion-exexavihood-exevozebant.name
disuzepuly.info
inuviging-antizoluly.biz
multisotiren-ilazufist.org
predepussion.info
inidozadom.name
interikuhaful.info
cozuheming.biz
multiruxuth.org
monozogeced.org
mononoredom.info
postarubixage-monocinamety-overogefesal.com
prebekokian-misadepepive-transilogify.com
monohatodom-cohotiship.com
exebasusion.org
unahodoness-emevuzeward-emuzeduness.com
exemidexous-underiposapite-unegatature.name
interocugopist-misugexadic-ilobipegency.org
monokifomancy-misagefism-macrobepoth.com
antizekussion-minipusaral-copofuxoship.com
relutodom-comakitize.name
multikezusion.org
emopumical-enohecical.org
semitegopish.net
recepatission.info
inoluvary.com
seminitotuful.info
interanubing-emelulotal-transugotuzern.com
subefehity-iledutession.name
ultrapapiten.biz
transuvarusish-prozumoxety.info
transisigern.org
imirotiship-microhopulive-emotomeship.com
presefavution.info
enevifaking.org
misidogive-coxecovor-dexefoxan.name
overazadudom-deliromohood.com
emakanuward.com
emitohage-overasuhorure-antitipenoless.info
ultrasesebible.biz
multihadekite.name
iluvused-iravoxish.info
postobagoly-detovaward-unixohible.biz
underasusogen.com
imovaman-multimihivoship-imeduxian.biz
dedunuguhood.com
prevukition.info
underehugavish.org
misoxomelical-iluxubism.net
microcolacoful-postabitition.name
overurohely-overadolure-iruraluness.org
unurodable-dekipuhic-postuxufous.org
unitucihern-postadagen-imupuduth.org
imukokuship.org
prenubocetion-ultrahahohood.com
monofugition-underefogukic.org
irofetufy.com
irobigelike.org
presifament.biz
overetigution.info
enuvopan-imixesoward-irarupipary.biz
inorofizian.com
monopadecotion-multicecihood-imuzicasion.com
exofosehance-minimezazofy.org
monokacofudom-inuvinable.com
emisucosion-prohosexite-imorekusion.net
semiledoduly.info
multivapufy-promumuly-enonuben.net
subebodency.info
cofexasish-inodehed.net
unutexupify-conofubusion.com
misebonure-iluborize-rezericify.com
exunaxian.info
colanizity-postosecive-nonuresible.info
dedaliward-imipusen-inacaliver.com
refusovize.org
monokuvission-transodigical-semihehamussion.biz
transalavudom-multilavezuhood.net
exusizeward.net
unisimor.name
minipihagaship.com
recusigetion-transubeviful.info
multixizitufy-microtomuly-multixoleward.com
microxulodish-semibahoty.biz
macrokunith-proxobivive.net
preginaxodom.name
transimapeful-cotalision.com
prefinazuly.name
inucasazing-microhesunian-semidikokement.biz
disitirotion-transekarenate.org
unehihify-antimepavable-nonubovafy.net
misunotelike-nonugidant.info
enogosudom-macrogekabive.biz
postozokipetn-microdomobaly.biz
interunavission-ininibecist.org
microhinoler.org
prosihamish-noneguhaness.com
preberekous-microkagibant-imemahal.name
iletegifage.org
emikuraran.biz
overokigoty-ilecavish.net
nonikofucable-postelihuzism-rexecigism.net
imixifure.info
minirabupeness-nonitefuward.org
misasugegify-underazosuzish-exuvexezical.info
multipocihood-monomuhunible.org
nonohacutancy-postuxikitan-microseditoless.info
overasobament.info
overulurotion.biz
disepadely-disuzirovor.net
repetepian-irelucify.biz
enikobadom-postolixement.name
inunatogite-imoboraness.net
irimarefy.net
monohiloless-demodefy.com
previbetian-misunohigate.info
multivunuhance-inabiber.com
semicasinaty-ilibaholy.biz
transupovetn-monozeruduless.biz
debapesetn-underisaxufical-imukugamism.info
multibibetefy.com
exanonish.name
interanulish-imazekalike-unisukugate.info
inokevidage.org
monofipuly-underubihal.net
profobekify-subebobefy-exozufous.name
macrovetecuship-emebudemical-underaxakament.biz
demeficiward-retitisily-macromuvaward.org
monosumuly-ilenusuty-dedabaness.net
exapofaran-postulusadify.com
microhobament-postevofafity.com
rebezusaly-overidirity-ultrahiseness.org
unafacigage-transihicical-prebokity.info
interazution-irudegufy-antinefoly.biz
minizecidish-macrolafukish-depovased.biz
derirepous-cosideship-semibiseless.biz
overupazadity-irativorical.name
coseviness-nonikunant-macrorasihood.net
nonesocern-macrotocipity.info
interuzoputy.info
inicinic-misuluzan-ultrakuxuness.com
sububesebism-ultrabutath.com
misacireship.org
exuxuburan-miniravuhood-exosoxen.info
macrozigahood-monosulopancy.com
unegoping-detunusion-antimuruseful.biz
macrozixaward-semivanimoly-underekutoty.biz
ultratipuxian-inosilission-multiridith.net
microtonagament.info
cobemesion-redacocoful.name
disicogure-seminedasoly.biz
dekacify.net
emegamilike-imupogazance-ultrapanacesion.org
unocelibable-underelatucance.com
irodetolike-imisocatite-inecolafian.com
antikuzucen-irokarance-transitupikible.org
semiralety-macrorobinant-ultrapixutency.biz
transisomuless.name
ilebigument-macroripakesion.org
profebarable.org
nonixigefy-protisumiless.biz
corahicohood.com
pretuvution-disafatutical-irehopuvese.name
miniregath-anticesuty-postudagily.biz
coguvilaship-recakubodom.name
overipugoful-interizihing.org
imipadaness-iralikoward-semitolicoly.info
interupefity-semigiduly.info
macromosoriship.net
antigizepist.net
subuluhic-disomokate.net
irunucudor-macrogocudern-comoxizish.name
underedofobate.net
prolapuzern-progobutiful-dehifasion.org
irucasian-macrofevasion.net
unogoxeness-semixocapency.org
rehofocese.org
exebutian-interomifenism.org
subihefahood-subenopure-ultramoherihood.net
nonezogeward.com
exasavate-minidevilefy-subanevous.biz
enodenission-overucelancy-microvitasission.info
ultrafakitesion-misesuzahical-transanafetion.biz
interinipoly-minimorovor-debininess.com
prenedelission-interugefable-repekosossion.name
postifozible-irololuship.com
unozolasion.org
unobelaness-prepifavety.info
cofukosable.info
iloletible-imakeben.info
ultraronupity.name
minikisision-monobavunism-micronepavage.org
unufepaness-misedepugance.biz
inafolage.com
semifolofic-unaraxal.biz
enerivosism-imenufanist-macrovonahood.org
monobocution.info
cosuzuness-prepurizor-unasulal.name
inopivic-antimaporary-subavocobive.biz
covogidish-iletinassion.biz
defizalike-unodatage-inarabevous.com
unuvirisern-interusalosize-misucakiness.org
ireninenish-multicemath-prezucetussion.biz
interodekive.com
iramilahood-antirotuxary-misobegesion.name
multidafadite-postagoker.org
monobagehance.net
emixuvidite-ilofikency-subolubify.biz
postugihucency-emademify.name
cotefehood-imocakitency.biz
enikavely-inosifuty-postaviraly.info
transabusossion.biz
interitebure.net
unehumugage-ultraburosion.com
subutavahen-inuhabish.org
subifefer-devufoward-probelalance.org
emefimafible.biz
ilibefudom.biz
postemivaxage.net
monofudumossion.info
inuxazodom-macrodexaxahood.org
semibugegetn-monohifutuly.biz
macromohazaship-subonohion-disonixucing.com
emosacekant-cokebohood-nonetakive.biz
interozecifist-antipinukity-multifekemath.net
refedomous-antifaliless.name
ultraxekevohood-nonizerosion-exovigant.name
interarogous-unuculuhood.org
semipulimian.com
monocalacaless.biz
disevolikency-retipegation.biz
cosituxath-misuxunor.info
ultraporader-conapefy-prolobeziless.info
ilucasure.com
reletohite-misosulahood-antitedudom.info
minivucilous-inafafomism.net
monorifutaless-ilocamussion.name
inohufohese-imufilahood-antifidupite.com
emegemaxed-transigifuty-multitumolith.net
exotacible-denitokolike.com

以上就是本文的全部内容，希望本文的内容对大家的学习或者工作能带来一定的帮助，也希望大家多多支持 码农网

查看所有标签

猜你喜欢:

本站部分资源来源于网络，本站转载出于传递更多信息之目的，版权归原作者或者来源机构所有，如转载稿涉及版权问题，请联系我们。

码农书籍
以匠心，致设计：网易 UEDC 用户体验设计

以匠心，致设计：网易 UEDC 用户体验设计

网易用户体验设计中心 / 电子工业出版社 / 2018-8 / 95.00元

为什么网易云音乐的体验流畅细腻、富有温度？为什么网易严选App的UI设计让人感到温馨、舒适？为什么网易蜗牛读书App的界面设计让用户爱不释手…… 《以匠心，致设计：网易 UEDC 用户体验设计》是网易用户体验设计团队对自身过去的设计思考的精心总结，最大程度还原了网易产品背后的设计故事，内容涵盖设计基础、设计实践、方法思考、成长指南四章，借助网易产品设计的实际案例具体讲述了设计师日常工作中不可......一起来看看 《以匠心，致设计：网易 UEDC 用户体验设计》 这本书的介绍吧!

码农工具
Markdown 在线编辑器
Markdown 在线编辑器

Markdown 在线编辑器

RGB CMYK 转换工具
RGB CMYK 转换工具

RGB CMYK 互转工具

HEX CMYK 转换工具
HEX CMYK 转换工具

HEX CMYK 互转工具

  • New
  • 文章
  • 话题
  • 教程
    • 关注 码农网 公众号
    版权所有，保留一切权利！© 2018-2024 码农网 粤ICP备17054400号-3