带壳入库者可以哭了ed1c8

qwerasdf123

历史上罕见的大乱报
压根不是毒

[ 本帖最后由 qwerasdf123 于 2007-7-24 07:58 编辑 ]

qwerasdf123

这是沙盘
Analysis Date 7/23/2007 3:37:10 PM
Sandbox Version 2.0.6
Filename ed1c8fd9484c931eb9610b62ca4b9b30.exe

Technical Details:

Analysis Number 1
Parent ID 0
Process ID 580
Filename c:\temp\ed1c8fd9484c931eb9610b62ca4b9b30.exe
Filesize 29696 bytes
MD5 ed1c8fd9484c931eb9610b62ca4b9b30
Start Reason AnalysisTarget
Termination Reason NormalTermination
Start Time 00:00.235
Stop Time 00:03.032
Detection Trojan (Authentium Command Antivirus)
(BitDefender Antivirus)
(CounterSpy)
(Microsoft Malware Protection)
(Norton AntiVirus)

DLL-Handling Loaded DLLs
C:\WINDOWS\System32\ntdll.dll
\ C:\WINDOWS\system32\kernel32.dll
\ C:\WINDOWS\system32\user32.dll
\ C:\WINDOWS\system32\GDI32.dll
\ C:\WINDOWS\system32\ADVAPI32.dll
\ C:\WINDOWS\system32\RPCRT4.dll
\ C:\WINDOWS\system32\oleaut32.dll
\ C:\WINDOWS\system32\MSVCRT.DLL
\ C:\WINDOWS\system32\OLE32.DLL
\ C:\WINDOWS\system32\comctl32.dll
\ C:\WINDOWS\System32\wsock32.dll
\ C:\WINDOWS\System32\WS2_32.dll
\ C:\WINDOWS\System32\WS2HELP.dll
\ C:\WINDOWS\System32\pstorec.dll
\ C:\WINDOWS\System32\ATL.DLL
\ C:\WINDOWS\System32\Wship6.dll
\ C:\WINDOWS\System32\iphlpapi.dll
\ C:\WINDOWS\System32\Secur32.dll
\ USER32.dll
\  

Process Management Kill Process - Filename () CommandLine: () Target PID: (580) As User: () Creation Flags: ()

红心王子

C:\Documents and Settings\Administrator\桌面\大乱
报.rar>>大乱报.exe
Dropper.Dropres.b

tracydk

zengmingwh

红伞挂，上报。

曲中求

NOD

C:\Documents and Settings\Administrator\桌面\大乱报.rar »RAR »大乱报.exe - a variant of Win32/TrojanDropper.Delf.AAH trojan

lsyer

原帖由 zengmingwh 于 2007-7-24 07:58 发表
红伞挂，上报。

历史上罕见的大乱报
压根不是毒
间接证明雨伞不止会包壳

微点卫士

金山毒霸,费尔报!
微点没报

残缺的唯美

感觉不是误报

xxwpk007

Kaspersky Internet Security 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=104341 is infected with Trojan-Dropper.Win32.Delf.aah virus