VirSCAN全过和火眼也没有查到的东东，这个确实是毒

wuweizi

VirSCAN全部pass，解压包后分别上传火眼也没查出来啥
http://fireeye.ijinshan.com/anal ... aeee495b7872d2f1be5
http://fireeye.ijinshan.com/anal ... 5c1dabc8a0ccb534185

sanwutheme

VT全PASS 解压卡巴未报 实机未敢双击！

消停

完整路径: f:\样本\巨人密保卡资料\pjee7tgihcby8.exe
威胁: WS.Reputation.1
____________________________
____________________________
在电脑上的创建时间 不可用
上次使用时间 2012-7-6 ( 15:26:21 )
启动项目 否
已启动 否
____________________________
____________________________
未知
诺顿社区中使用此文件的用户数量: 未知
____________________________
未知
此文件版本当前未知。
____________________________
中
此文件具有中等程度风险。
____________________________
威胁详细信息
威胁类型: 智能网络威胁。 很多迹象表明此文件不可信任，不安全
____________________________
https://att.kafan.cn/forum.php?mo ... Dc5OTA2N3wxMzIxNzkw 已下载文件pjee7tgihcby8.exe
威胁名称:
WS.Reputation.1自
att.kafan.cn
____________________________
文件操作
文件: f:\样本\巨人密保卡资料\pjee7tgihcby8.exe
已删除
____________________________
文件指纹 - SHA:
08afcfbc28defc25fa24d742be83f70329a56d01496afd5bc30c2c53ce637729
____________________________
文件指纹 - MD5:
222710884f12eaeee495b7872d2f1be5
____________________________

Mr.Tong

360未知

lishaoyu007

未发现其他行为

绅博周幸

lishaoyu007 发表于 2012-7-6 15:32
未发现其他行为

确实是一个特洛伊

dljsxyls

1. 
   
2. 07.06.2012  15:33:50, 模块 C:\eeo\EUnpya.exe, Internet connections are blocked (网络)
   
3. 
   
4. 07.06.2012  15:33:29, 模块 C:\eeo\EUnpya.exe, Attempt to set value Common AppData within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
   
5. 
   
6. 07.06.2012  15:33:29, 模块 C:\eeo\EUnpya.exe, Attempt to set value AppData within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
   
7. 
   
8. 07.06.2012  15:33:29, 模块 C:\eeo\EUnpya.exe, Attempt to set value MigrateProxy within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ (注册表)
   
9. 
   
10. 07.06.2012  15:33:29, 模块 C:\eeo\EUnpya.exe, Attempt to set value ProxyEnable within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ (注册表)
    
11. 
    
12. 07.06.2012  15:33:29, 模块 C:\eeo\EUnpya.exe, Attempt to set value SavedLegacySettings within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\ (注册表)
    
13. 
    
14. 07.06.2012  15:33:28, 模块 C:\eeo\EUnpya.exe, Attempt to set value Directory within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\ (注册表)
    
15. 
    
16. 07.06.2012  15:33:28, 模块 C:\eeo\EUnpya.exe, Attempt to set value Cookies within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
17. 
    
18. 07.06.2012  15:33:28, 模块 C:\eeo\EUnpya.exe, Attempt to set value History within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
19. 
    
20. 07.06.2012  15:33:28, 模块 C:\eeo\EUnpya.exe, Attempt to delete service (服务)
    
21. 
    
22. 07.06.2012  15:33:28, 模块 C:\eeo\EUnpya.exe, Attempt to set value Cache within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
23. 
    
24. 07.06.2012  15:33:22, 模块 C:\eeo\EUnpya.exe, 1:Process is running untrusted now (进程)
    
25. 
    
26. 07.06.2012  15:33:21, 模块 C:\WINDOWS\system32\rundll32.exe, Attempt to set value Cache within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
27. 
    
28. 07.06.2012  15:33:21, 模块 C:\WINDOWS\system32\rundll32.exe, Attempt to set value Cookies within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
29. 
    
30. 07.06.2012  15:33:20, 模块 C:\WINDOWS\system32\rundll32.exe, Attempt to delete service (服务)
    
31. 
    
32. 07.06.2012  15:33:20, 模块 C:\WINDOWS\system32\rundll32.exe, Attempt to set value Common Documents within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
33. 
    
34. 07.06.2012  15:33:20, 模块 C:\WINDOWS\system32\rundll32.exe, Attempt to set value Desktop within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
35. 
    
36. 07.06.2012  15:33:20, 模块 C:\WINDOWS\system32\rundll32.exe, Attempt to set value Common Desktop within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
37. 
    
38. 07.06.2012  15:33:20, 模块 C:\WINDOWS\system32\rundll32.exe, Attempt to set value Personal within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
39. 
    
40. 07.06.2012  15:33:16, 模块 C:\WINDOWS\system32\rundll32.exe, 1:Process is running untrusted now (进程)
    
41. 
    
42. 07.06.2012  15:33:09, 模块 C:\WINDOWS\system32\rundll32.exe, Attempt to delete service (服务)
    
43. 
    
44. 07.06.2012  15:33:09, 模块 C:\Documents and Settings\Administrator\桌面\巨人密保卡资料\pjee7TGiHcBY8.exe, Attempt to set value Cookies within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
45. 
    
46. 07.06.2012  15:33:09, 模块 C:\Documents and Settings\Administrator\桌面\巨人密保卡资料\pjee7TGiHcBY8.exe, Attempt to set value Cache within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
47. 
    
48. 07.06.2012  15:33:06, 模块 C:\WINDOWS\system32\rundll32.exe, 1:Process is running untrusted now (进程)
    
49. 
    
50. 07.06.2012  15:33:05, 模块 C:\Documents and Settings\Administrator\桌面\巨人密保卡资料\pjee7TGiHcBY8.exe, Attempt to delete service (服务)
    
51. 
    
52. 07.06.2012  15:33:05, 模块 C:\Documents and Settings\Administrator\桌面\巨人密保卡资料\pjee7TGiHcBY8.exe, Attempt to set value Common Documents within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
53. 
    
54. 07.06.2012  15:33:05, 模块 C:\Documents and Settings\Administrator\桌面\巨人密保卡资料\pjee7TGiHcBY8.exe, Attempt to set value Desktop within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
55. 
    
56. 07.06.2012  15:33:05, 模块 C:\Documents and Settings\Administrator\桌面\巨人密保卡资料\pjee7TGiHcBY8.exe, Attempt to set value Common Desktop within the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
57. 
    
58. 07.06.2012  15:33:05, 模块 C:\Documents and Settings\Administrator\桌面\巨人密保卡资料\pjee7TGiHcBY8.exe, Attempt to set value Personal within the key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\ (注册表)
    
59. 
    
60. 07.06.2012  15:33:04, 模块 C:\Documents and Settings\Administrator\桌面\巨人密保卡资料\pjee7TGiHcBY8.exe, 1:Process is running untrusted now (进程)
    

复制代码

高压气瓶

楼下的人员帮我回复了 感谢！

Madook

楼主，火眼目前不支持带子目录的压缩包，重新把两个文件放在一起打包上传，结果已经出来了：
http://fireeye.ijinshan.com/anal ... 2402a9f6e3ff069d856

jayavira

调用cmd
联网