AE35FC9E.zip

sam.to

https://www.virustotal.com/zh-tw ... nalysis/1374023481/



07.19:
https://www.virustotal.com/zh-tw ... nalysis/1374196879/

275751198

密码是 infected

消停

Filename: ae35fc9e
Threat name: Suspicious.Cloud.5.A
Full Path: f:\norton样本\诺顿排除\ae35fc9e

____________________________



Details
Very Few Users,  Very New,  Risk High





Origin
Downloaded from
 Unknown





Activity
Actions performed: Actions performed: 1



____________________________



On computers as of 
2013-7-17 at 9:24:34


Last Used 
2013-7-17 at 9:25:04


Startup Item 
No


Launched 
No


____________________________


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.

Threat type: Heuristic Virus. Detection of a threat based on malware heuristics.



____________________________



Source: External Media



Source File:
winrar.exe




File Created:
winrar.exe




File Created:
ae35fc9e




____________________________

File Actions

Infected file: f:\norton样本\诺顿排除\ ae35fc9e Removed
____________________________


File Thumbprint - SHA:
8d2d0e80f85b28f5f85ca94c827842b41aea3a412ad2701046e6b9417411a05d
File Thumbprint - MD5:
Not available

小洪

密码啊 老大

真小读者

小洪 发表于 2013-7-17 09:28
密码啊 老大

2楼不都说了
何况样本区不告诉密码的横竖就那几个固定密码：infected、virus、kafan、vir

llcy

金山卫士

swq0503

Nocria

To ESET.

3801187

2013-07-17 15:40:06        c:\windows\explorer.exe        创建新进程        c:\documents and settings\administrator\桌面\ae35fc9e.exe        允许        [应用程序]c:\windows\explorer.exe        命令行: "C:\Documents and Settings\Administrator\桌面\AE35FC9E.exe"
2013-07-17 15:40:12        c:\documents and settings\administrator\桌面\ae35fc9e.exe        修改文件        \Device\NamedPipe\lsarpc        阻止        [文件组]命令管道 -> [文件]\device\namedpipe\*       
2013-07-17 15:40:13        c:\documents and settings\administrator\桌面\ae35fc9e.exe        读文件夹        D:\My Documents        阻止        [文件组]隐藏磁盘 -> [文件]d:\*       
2013-07-17 15:40:13        c:\documents and settings\administrator\桌面\ae35fc9e.exe        修改文件        \Device\NamedPipe\lsarpc        阻止        [文件组]命令管道 -> [文件]\device\namedpipe\*       
2013-07-17 15:40:13        c:\documents and settings\administrator\桌面\ae35fc9e.exe        修改文件        C:\WINDOWS\Debug\UserMode\userenv.log        阻止        [文件组]只读磁盘 -> [文件]c:\*       

llcy

毒霸