查看: 5454|回复: 21
收起左侧

[可疑文件] 【第二弹28个可疑文件】人脑识别可疑文件

[复制链接]
claudgreen
发表于 2017-2-15 09:59:17 | 显示全部楼层 |阅读模式
本帖最后由 claudgreen 于 2017-2-17 10:26 编辑

【第二弹28个可疑文件】链接: http://pan.baidu.com/s/1dFxcTtZ 密码: t66u

SHA256:        f0cb4f2b3dacb3d6aad8edb98447637a0c36183c3685b5b246b888f8eef2e8ae
File name:        virs.rar
Detection ratio:        29 / 55
Analysis date:        2017-02-17 01:59:06 UTC ( 0 minutes ago )

https://www.virustotal.com/en/fi ... nalysis/1487296746/

----------------------------------------------------------------------------------------------------------
【第一弹】链接: http://pan.baidu.com/s/1jIc9MRG 密码: h66w

Iyyesms.exe Portable Executable 12051888 Bytes
SHA256 4abd26e8e31617d6664f3a98cd3c6fc3b2341ea1ae663780ea76b9b4f3e7f7e4
Datetime 2016-08-14 20:56:08
Detection ratio Unknown when this report was generated


Antivirus scan for eb61b7f8537f486335b3e8135970072595fdda6dd0e819ffbcd7feaa0777567c at UTC - VirusTotal https://www.virustotal.com/en/fi ... analysis/1487215861






腾讯哈勃分析了一个最可疑对象:

https://habo.qq.com/file/showdetail?pk=ADYGb11sB2QIMVs7



基本信息
文件名称:       
Iyyesms.exe
MD5:        87f8f1661f3d90983269ca3a86627734
文件类型:        EXE
上传时间:        2017-02-15 09:57:39
出品公司:        Thunder Network
版本:        1.0.0.1---1
壳或编译器信息:        PACKER:UPolyX v0.5
关键行为
行为描述:        探测 Virtual PC是否存在
详情信息:       
N/A
行为描述:        直接获取CPU时钟
详情信息:       
EAX = 0x131b0148, EDX = 0x00001197
EAX = 0x131b0194, EDX = 0x00001197
EAX = 0x131b01e0, EDX = 0x00001197
EAX = 0x131b022c, EDX = 0x00001197
EAX = 0x131b0278, EDX = 0x00001197
EAX = 0x131b02c4, EDX = 0x00001197
EAX = 0x131b0310, EDX = 0x00001197
EAX = 0x131b035c, EDX = 0x00001197
EAX = 0x131b03a8, EDX = 0x00001197
EAX = 0x131b03f4, EDX = 0x00001197
EAX = 0x87a730ea, EDX = 0x0000119b
EAX = 0x87a73136, EDX = 0x0000119b
EAX = 0x87a73182, EDX = 0x0000119b
EAX = 0x87a731ce, EDX = 0x0000119b
EAX = 0x87a7321a, EDX = 0x0000119b
行为描述:        尝试打开调试器或监控软件的驱动设备对象
详情信息:       
\??\SICE
\??\SIWVID
\??\NTICE
行为描述:        自删除
详情信息:       
C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe
行为描述:        打开注册表_检测虚拟机相关
详情信息:       
\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__
行为描述:        创建系统服务
详情信息:       
[服务创建成功]: Thunqwk Programc, C:\Program Files\Windows NT\Iyyesms.exe
行为描述:        获取TickCount值
详情信息:       
TickCount = 5443796, SleepMilliseconds = 5000.
TickCount = 5441265, SleepMilliseconds = 500.
TickCount = 5441281, SleepMilliseconds = 500.
TickCount = 5441296, SleepMilliseconds = 500.
TickCount = 5456031, SleepMilliseconds = 15000.
TickCount = 5456093, SleepMilliseconds = 15000.
TickCount = 5441282, SleepMilliseconds = 1.
TickCount = 5441376, SleepMilliseconds = 1.
TickCount = 5441751, SleepMilliseconds = 1.
TickCount = 5444907, SleepMilliseconds = 1.
行为描述:        查询注册表_检测虚拟机相关
详情信息:       
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
行为描述:        查找指定内核模块
详情信息:       
lstrcmpiA: ntice.sys <------> ntkrnlpa.exe Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> hal.dll Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> KDCOM.DLL Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> BOOTVID.dll Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> ACPI.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> WMILIB.SYS Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> pci.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> isapnp.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> compbatt.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> BATTC.SYS Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> intelide.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> PCIIDEX.SYS Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> MountMgr.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> ftdisk.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> dmload.sys Des: SoftICE驱动
行为描述:        查找反病毒常用工具窗口
详情信息:       
NtUserFindWindowEx: [Class,Window] = [OLLYDBG,]
NtUserFindWindowEx: [Class,Window] = [GBDYLLO,]
NtUserFindWindowEx: [Class,Window] = [pediy06,]
NtUserFindWindowEx: [Class,Window] = [FilemonClass,]
NtUserFindWindowEx: [Class,Window] = [,File Monitor - Sysinternals: www.sysinternals.com]
NtUserFindWindowEx: [Class,Window] = [PROCMON_WINDOW_CLASS,]
NtUserFindWindowEx: [Class,Window] = [,Process Monitor - Sysinternals: www.sysinternals.com]
NtUserFindWindowEx: [Class,Window] = [RegmonClass,]
NtUserFindWindowEx: [Class,Window] = [,Registry Monitor - Sysinternals: www.sysinternals.com]
行为描述:        VMWare特殊指令检测虚拟机
详情信息:       
N/A



本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
linzh
发表于 2017-2-15 10:54:50 | 显示全部楼层
ESET下载拦截

[mw_shl_code=css,true]时间;扫描程序;对象类型;对象;威胁;操作;用户;信息;哈希;此处首次所见
2017/2/14 21:52:15;HTTP 过滤器;文件;http://nj01ct01.baidupcs.com/fil ... ;to=njhb&fm=Yan,B,U,ny&sta_dx=8674249&sta_cs=2&sta_ft=zip&sta_ct=0&sta_mt=0&fm2=Yangquan,B,U,ny&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=00008da5c23c59520259c9fd027900a53990&sl=81068110&expires=8h&rt=sh&r=258103483&mlogid=1053948540608875494&vuk=1595516054&vbdid=2086257667&fin=VIRS(1).zip&fn=VIRS(1).zip&uta=0&rtype=1&iv=0&isw=0&dp-logid=1053948540608875494&dp-callid=0.1.1&csl=10&csign=Vf2+NSFkBIujvS+lCgkkpkyUeVY=&by=flowserver;多个威胁;连接中断;LINZH-NOTEBOOK\linzh;通过应用程序访问 web 时检测到威胁: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe.;;
[/mw_shl_code]

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
Eset小粉絲
发表于 2017-2-15 11:02:39 | 显示全部楼层
[mw_shl_code=css,true]VIRS(1).zip
    [0] Archive type: ZIP
    --> 401.vbs
        [DETECTION] Contains recognition pattern of the HTML/Rce.Gen3 HTML script virus
        [WARNING]   Infected files in archives cannot be repaired
    --> 410.vbs
        [DETECTION] Contains recognition pattern of the HTML/Rce.Gen3 HTML script virus
        [WARNING]   Infected files in archives cannot be repaired
    --> xpcd.zip
        [1] Archive type: ZIP
      --> 410.vbs
          [DETECTION] Contains recognition pattern of the HTML/Rce.Gen3 HTML script virus
          [WARNING]   Infected files in archives cannot be repaired
      --> 401.vbs
          [DETECTION] Contains recognition pattern of the HTML/Rce.Gen3 HTML script virus
          [WARNING]   Infected files in archives cannot be repaired[/mw_shl_code]
Dolby123
发表于 2017-2-15 13:07:06 | 显示全部楼层
avast

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
轩夏
发表于 2017-2-15 15:57:01 | 显示全部楼层
MSE 断网
401.vbs
Infected: TrojanDownloader:HTML/Adodb.gen!A [generic]
410.vbs
Infected: TrojanDownloader:HTML/Adodb.gen!A [generic]
xpcd.zip->410.vbs
Infected: TrojanDownloader:HTML/Adodb.gen!A [generic]
xpcd.zip->401.vbs
Infected: TrojanDownloader:HTML/Adodb.gen!A [generic]
claudgreen
 楼主| 发表于 2017-2-15 17:35:05 | 显示全部楼层
linzh 发表于 2017-2-15 10:54
ESET下载拦截

[mw_shl_code=css,true]时间;扫描程序;对象类型;对象;威胁;操作;用户;信息;哈希;此处首次 ...

这是下载就报出病毒个数和名字了?
linzh
发表于 2017-2-15 23:17:25 | 显示全部楼层
claudgreen 发表于 2017-2-15 17:35
这是下载就报出病毒个数和名字了?

对啊
claudgreen
 楼主| 发表于 2017-2-16 09:06:53 | 显示全部楼层

小绿人什么时候这么牛逼了
a445441
发表于 2017-2-16 17:01:29 | 显示全部楼层
Iyyesms.exe 微点拦截
claudgreen
 楼主| 发表于 2017-2-16 17:09:46 | 显示全部楼层
a445441 发表于 2017-2-16 17:01
Iyyesms.exe 微点拦截

微点的理念值值得尊敬
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-3-29 04:34 , Processed in 0.163738 second(s), 17 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表