暗黑3拍卖行使用详解.exe，请高手分析下

Nocria

To ESET.

zilch

小a报安全；
火眼报告：http://fireeye.ijinshan.com/anal ... 44e789c05a9229c6473：


基本信息

    文件名称：暗黑3拍卖行使用详解.rar
    文件哈希：57cfdd055aea544e789c05a9229c6473
    文件大小：325038字节
    创建时间：2012-07-01 13:43:40
    文件类型：RAR
    PEID信息：Not a valid PE file

其他行为监控

    行为描述：检测是否存在指定注册表键
    附加信息：

    HKEY_LOCAL_MACHINE\SOFTWARE\Blizzard Entertainment\World of Warcraft
    行为描述：查找文件
    附加信息：

    "%APPDATA%\Macromedia\Flash Player\#SharedObjects\L8AFARJF\localhost\Program Files\Ten...

    "%APPDATA%\Macromedia\Flash Player\#SharedObjects\L8AFARJF\localhost\Program Files\Ten...

    "%APPDATA%\Tencent\IM\Diablo III.exe"

    "%APPDATA%\Tencent\QQ\Misc\CSC\2052\4\Diablo III.exe"

    "%APPDATA%\Tencent\QQ\TxApp\100001\*.*"

    "%APPDATA%\Tencent\TXSSO\SSOConfig\GlobleDB\_SID_0\*.*"

    "%APPDATA%\Tencent\WebQQ\*.*"

    "%USERPROFILE%\Local Settings\Application Data\Microsoft\Windows Media\9.0\Diablo III....

    "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012011122120111222\*.*"

    "%USERPROFILE%\「开始」菜单\程序\附件\娱乐\Diablo III.exe"

    "%USERPROFILE%\桌面\*.*"

    "%AllUsersProfile%\Application Data\Microsoft\*.*"

    "%AllUsersProfile%\Application Data\VMware\Compatibility\Diablo III.exe"

    "%AllUsersProfile%\桌面\*.*"

    "C:\Documents and Settings\Default User\*.*"

    "C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Conten...

    "C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\...

    "C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\*.*"

    "C:\Documents and Settings\User\Application Data\Microsoft\Credentials\S-1-5-21-164552...

    "C:\Documents and Settings\User\Application Data\Microsoft\CryptnetUrlCache\Content\Di...

    "C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Diablo III.exe...

    "C:\Documents and Settings\NetworkService\Application Data\Diablo III.exe"

    "%ProgramFiles%\*.*"

    "%ProgramFiles%\ComPlus Applications\Diablo III.exe"

    "%commonprogramfiles%\Diablo III.exe"

    "%commonprogramfiles%\Microsoft Shared\DW\1025\*.*"

    "%commonprogramfiles%\Microsoft Shared\web server extensions\40\admcgi\Diablo III.exe&...

    "%commonprogramfiles%\SpeechEngines\Diablo III.exe"

    "%ProgramFiles%\InstallShield Installation Information\Diablo III.exe"

    "%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Diablo III.exe"

    "%ProgramFiles%\MSN Gaming Zone\*.*"

    "%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\Diablo III.exe"

    "%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\*.*"

    "%ProgramFiles%\Tencent\QQ\AuI18N\2052\Diablo III.exe"

    "%ProgramFiles%\Tencent\QQ\Plugin\Com.Tencent.QQRing\*.*"

    "%ProgramFiles%\Tencent\QQ\Plugin\Com.Tencent.QQRing\Bin\*.*"

    "%ProgramFiles%\Tencent\QQ\Plugin\Com.Tencent.QQWebsite\Bin\*.*"

    "%ProgramFiles%\Tencent\QQ\Plugin\Com.Tencent.Qzone\FlashPlayer\I18N\Diablo III.exe&qu...

    "%ProgramFiles%\Tencent\QQ\Plugin\Com.Tencent.RemoteHelp\Misc\*.*"

    "%ProgramFiles%\Tencent\QQ\Plugin\Com.Tencent.Today\Diablo III.exe"

    "%ProgramFiles%\Tencent\QQ\Resource.1.70.2423\Themes\Diablo III.exe"

    "%ProgramFiles%\Tencent\QQ\Users\All Users\QQ\Misc\com.tencent.qqshow\1\*.*"

    "%ProgramFiles%\Tencent\QQ\Users\All Users\QQ\Misc\com.tencent.qqshow\4\Diablo III.exe...

    "%ProgramFiles%\Tencent\QQ\Users\All Users\QQ\Misc\com.tencent.qqshow\96\*.*"

    "%windir%\Help\Tours\mmTour\Diablo III.exe"

    "%windir%\Media\Diablo III.exe"

    "%windir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalRe...

    "%windir%\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\Diablo III.exe"

    "%windir%\Microsoft.NET\Framework\v3.0\WPF\zh-CHS\*.*"

    "%windir%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Diablo III.exe...

    "%windir%\Resources\Themes\Luna\Shell\Homestead\*.*"

    "%windir%\Resources\Themes\Luna\Shell\Metallic\Diablo III.exe"

    "%windir%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww...

    "%windir%\assembly\GAC_32\PresentationCore\Diablo III.exe"

    "%windir%\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\*.*"

    "%windir%\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Diablo III.exe&q...

    "%windir%\assembly\GAC_MSIL\Sentinel.v3.5Client\3.5.0.0__b03f5f7f11d50a3a\*.*"

    "%windir%\assembly\GAC_MSIL\System.Configuration.Install\Diablo III.exe"

    "%windir%\assembly\GAC_MSIL\System.Data.DataSetExtensions\3.5.0.0__b77a5c561934e089\*....

    "%windir%\assembly\GAC_MSIL\System.Data.DataSetExtensions\3.5.0.0__b77a5c561934e089\Di...

    "%windir%\assembly\GAC_MSIL\System.Data.Linq\3.5.0.0__b77a5c561934e089\Diablo III.exe&...

    "%windir%\assembly\GAC_MSIL\System.Data.Services.Client.resources\3.5.0.0_zh-CHS_b77a5...

    "%windir%\assembly\GAC_MSIL\System.Data.Services.Client\*.*"

    "%windir%\assembly\GAC_MSIL\System.DirectoryServices.resources\*.*"

    "%windir%\assembly\GAC_MSIL\System.DirectoryServices.resources\2.0.0.0_zh-CHS_b03f5f7f...

    "%windir%\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\Diablo ...

    "%windir%\assembly\GAC_MSIL\System.IdentityModel.Selectors\Diablo III.exe"

    "%windir%\assembly\GAC_MSIL\System.Management.Instrumentation\*.*"

    "%windir%\assembly\GAC_MSIL\System.Management.resources\2.0.0.0_zh-CHS_b03f5f7f11d50a3...

    "%windir%\assembly\GAC_MSIL\System.Management\*.*"

    "%windir%\assembly\GAC_MSIL\System.Messaging.resources\*.*"

    "%windir%\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\D...

    "%windir%\assembly\GAC_MSIL\System.ServiceModel\*.*"

    "%windir%\assembly\GAC_MSIL\System.Web.DynamicData.Design.resources\*.*"

    "%windir%\assembly\GAC_MSIL\System.Web.Services\Diablo III.exe"

    "%windir%\assembly\GAC_MSIL\System.Workflow.ComponentModel\*.*"

    "%windir%\assembly\GAC_MSIL\System.Workflow.Runtime\Diablo III.exe"

    "%windir%\assembly\GAC_MSIL\System.WorkflowServices\Diablo III.exe"

    "%windir%\assembly\GAC_MSIL\UIAutomationClientsideProviders\3.0.0.0__31bf3856ad364e35\...

    "%windir%\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\*.*"

    "%windir%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\36dbc4689f7c51e3935...

    "%windir%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\152cf75db013f052393...

    "%windir%\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\Diablo III.exe"

    "%windir%\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\Diablo III.exe"

    "%windir%\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\Diablo III.exe"

    "%windir%\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\*.*"

    "%windir%\pchealth\helpctr\DataColl\Diablo III.exe"

    "%windir%\pchealth\helpctr\System\images\Centers\*.*"

    "%windir%\pchealth\helpctr\System\images\Expando\Diablo III.exe"

    "%system%\CatRoot\Diablo III.exe"

    "%system%\IME\PINTLGNT\*.*"

    "%system%\Restore\Diablo III.exe"

    "%system%\config\systemprofile\Local Settings\Application Data\*.*"

    "%system%\config\systemprofile\「开始」菜单\程序\附件\辅助工具\*.*"

    "%system%\dllcache\*.*"

    "%system%\drivers\Diablo III.exe"

    "%system%\mui\Diablo III.exe"

    "%system%\oobe\isperror\Diablo III.exe"

    "%system%\spool\drivers\*.*"

    "D:\RECYCLER\Diablo III.exe"

    "E:\*.*"

文件操作监控
操作        文件MD5        文件大小        文件路径
新增        a54dc85589510ecba01c563e04564c89        145920        %SampleStore%\patch.html

炎之使者

完整路径: g:\tddownload\备用软件\暗黑3拍卖行使用详解.exe
威胁: WS.Reputation.1
____________________________
____________________________
在电脑上的创建时间 不可用
上次使用时间 1/7/2012 ( 17:09:49 )
启动项目 否
已启动 否
____________________________
____________________________
未知
诺顿社区中使用此文件的用户数量: 未知
____________________________
未知
此文件版本当前未知。
____________________________
中
此文件具有中等程度风险。
____________________________
威胁详细信息
威胁类型: 智能网络威胁。 很多迹象表明此文件不可信任，不安全
____________________________
http://bbs.kafan.cn/forum.php?mo ... DU4NTY1OHwxMzE4MzM1 已下载文件暗黑3拍卖行使用详解.exe
威胁名称:
WS.Reputation.1自
bbs.kafan.cn
____________________________
文件操作
文件: g:\tddownload\备用软件\暗黑3拍卖行使用详解.exe
已删除
____________________________
文件指纹 - SHA:
987c0e6b59f299046bcf4435f0d126195aee72b691fec0e879531b084d2b255b
____________________________
文件指纹 - MD5:
8324abaa0807d9ef1ae4af5084841aab
____________________________

一个笨鸟

“使用详解”还需要看exe？不用想，一定是马。

老机子

数字解压缩报了！

liyangfr

BD 启发报：Gen:Trojan.Heur.FU.ICW@aiaOaMnj

liwnpin

网站被阻止！
G Data 杀毒软件 2012已阻止访问此网站。
该站点包含被感染的代码：Gen:Trojan.Heur.FU.ICW@aiaOaMnj (引擎A)。

itcql

微点2.0，KILL

挥泪斩情思

itcql 发表于 2012-7-1 22:49
微点2.0，KILL

微点

itcql

挥泪斩情思 发表于 2012-7-1 22:50
微点

咋了？你没有用了？