[其他相关] PUP

显示全部楼层 · 发表于 2012-6-16 09:48:37

本帖最后由 humanlwj52 于 2012-6-16 09:49 编辑

To ESET & AVG.

P.S.
安装包，请选择性测试。

显示全部楼层 · 发表于 2012-6-16 09:56:13

to CIS to 小a

显示全部楼层 · 发表于 2012-6-16 10:07:54

显示全部楼层 · 发表于 2012-6-16 10:23:11

nis2012

完整路径: C:\Documents and Settings\wen\桌面\dmtdl\dmtdl.exe
____________________________
____________________________
开发人员不可用
版本 2.0.0.39
安装时间 2012-6-16 ( 10:21:58 )
上次使用时间不可用
启动项目否
____________________________
____________________________
未知
此程序的崩溃历史记录未知。
____________________________
少量用户信任的文件
诺顿社区中有不到 100 名用户使用了此文件。
____________________________
发布已久的文件
该文件已在 1 年前发行。
____________________________
良好
诺顿为此文件指定的分级为良好。
____________________________
源文件:
wrar410sc.exe
创建的文件:
winrar.exe
创建的文件:
dmtdl.exe
____________________________
文件指纹 - SHA:
8424b849b051bf25f500f679410f3dda964f605f0f3c8e5be6331938b6329bf4
____________________________
文件指纹 - MD5:
9521d1dea8a476f820f4fd7a843c4453
____________________________

显示全部楼层 · 发表于 2012-6-16 11:13:16

显示全部楼层 · 发表于 2012-6-16 11:20:47

大蜘蛛clean，已上报。

显示全部楼层 · 发表于 2012-6-16 11:57:50

本帖最后由 DPT1 于 2012-6-16 12:00 编辑

火眼分析

http://fireeye.ijinshan.com/anal ... d678e05a82c9140865a

显示全部楼层 · 发表于 2012-6-16 12:05:23

DPT1 发表于 2012-6-16 11:57
火眼分析

http://fireeye.ijinshan.com/analyse.html?md5=889e97e6fab30d678e05a82c9140865a

这是个安装程序，需要人工点击才能看到进一步的行为。
对于这类程序在线沙盘分析可能并不准确的，我看其中的截图也只有一张安装程序最开始的欢迎界面的图片。

显示全部楼层 · 发表于 2012-6-16 12:20:13

humanlwj52 发表于 2012-6-16 12:05
这是个安装程序，需要人工点击才能看到进一步的行为。
对于这类程序在线沙盘分析可能并不准确的，我看其 ...

后台应该有做相应的对抗吧，我咨询一下官方

显示全部楼层 · 发表于 2012-6-16 12:51:03

<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改注册表项
</td>
<td>HKUS\S-1-5-21-842925246-1935655697-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改注册表项
</td>
<td>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\History
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改注册表项
</td>
<td>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\History
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改注册表项
</td>
<td>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\History
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改注册表项
</td>
<td>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\History
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改注册表项
</td>
<td>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\History
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改注册表项
</td>
<td>HKUS\S-1-5-21-842925246-1935655697-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>访问内存
</td>
<td>C:\WINDOWS\explorer.exe
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改文件
</td>
<td>\Device\NamedPipe\wkssvc
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改注册表项
</td>
<td>HKUS\S-1-5-21-842925246-1935655697-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Favorites
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改文件
</td>
<td>\Device\NamedPipe\lsarpc
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改注册表项
</td>
<td>HKUS\S-1-5-21-842925246-1935655697-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A\BaseClass
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改文件
</td>
<td>\Device\NamedPipe\srvsvc
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改注册表项
</td>
<td>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
</td>
</tr>
<tr>
<td>2002-01-01 03:32:15
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\History
</td>
</tr>
<tr>
<td>2002-01-01 03:32:23
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改注册表项
</td>
<td>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
</td>
</tr>
<tr>
<td>2002-01-01 03:32:23
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\Local Settings\History
</td>
</tr>
<tr>
<td>2002-01-01 03:32:23
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改注册表项
</td>
<td>HKUS\S-1-5-21-842925246-1935655697-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Browse For Folder Width
</td>
</tr>
<tr>
<td>2002-01-01 03:32:23
</td>
<td>C:\Documents and Settings\Administrator\桌面\dmtdl.exe
</td>
<td>修改文件
</td>
<td>C:\Documents and Settings\Administrator\桌面\Uninstal.$$A
</td>
</tr>
</table>
<table width="100%" bgcolor="#CFCFE5" border="0">
<tr>
<td>
<font face="Arial" size="+1">报告结束</font>
</td>
</tr>
</table>
</body>
</html>

[其他相关] PUP

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源