每日样本

东方妖妖梦

上报百度杀毒国内版

狐狸糊涂

BD显示安全

XywCloud

Result: Backdoor(Susuicious)
Skip test.

ytysh

EAV 扫描杀
C:\Users\BNNY\Desktop\virus\298374.jar  ZIP  LoadStub.class - Java/Adwind.FM trojan - cleaned by deleting - quarantined
C:\Users\BNNY\Desktop\virus\298374.jar  ZIP  LoadStubDecrypted.class - a variant of Java/Adwind.FJ trojan - cleaned by deleting - quarantined
C:\Users\BNNY\Desktop\virus\298374.jar  ZIP  LoadPassword.class - a variant of Java/Adwind.FK trojan - cleaned by deleting - quarantined
C:\Users\BNNY\Desktop\virus\298374.jar  ZIP  DecryptStub.class - Java/Adwind.FK trojan - cleaned by deleting - quarantined
C:\Users\BNNY\Desktop\virus\298374.jar  ZIP  ClassLoaders.class - Java/Adwind.FL trojan - cleaned by deleting - quarantined

欧阳宣

如果是安卓类样本，估计很难受理

尘梦幽然

NS22miss

wenshui1013

费尔云鉴定

蓝天二号

KIS  安全，

ericdj

蛋挞，右键miss

右键入沙，蛋挞主防发现问题：


*** Process ***

Process: 3792
File name: sandboxierpcss.exe
Path: d:\sandboxie\sandboxierpcss.exe

Publisher: Invincea, Inc.
Creation date: 02/18/15 00:41:22
Modification date: 02/18/15 00:41:22

Started by: sbiesvc.exe
Publisher: Invincea, Inc.


*** Actions ***

The program has executed actions in the name of another program.
The program has changed values in the system registry that can be used to endanger the system.
The program is trying to create a startup item to launch a program automatically at system startup.
The program establishes a network connection.
An unknown process was accessed.
The program has created or manipulated an executable file.
The program can be used to execute any program code.
The program frequently creates entries in critical parts of the registry.
The program disables Windows Task Manager.
The program writes registry values belonging to G DATA software.


*** Quarantine ***

The following files were moved into quarantine:
c:\sandbox\eric\suspicioussamples\user\current\windwos\bin\server\xusage.txt
c:\sandbox\eric\suspicioussamples\user\current\windwos\lib\jvm.hprof.txt
c:\sandbox\eric\suspicioussamples\user\current\windwos\readme.txt
c:\sandbox\eric\suspicioussamples\user\current\windwos\thirdpartylicensereadme-javafx.txt
c:\sandbox\eric\suspicioussamples\user\current\windwos\thirdpartylicensereadme.txt

The following registry entries were deleted:
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareDesktop.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebCompanion.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\machine\Software\Microsoft\Windows\CurrentVersion\Run
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\user\current\Software\Microsoft\Windows\CurrentVersion\Policies\System
\REGISTRY\\REGISTRY\USER\Sandbox_eric_SuspiciousSamples\user\current\Software\Microsoft\Windows\CurrentVersion\Run

\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareDesktop.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareTray.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebCompanion.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe || debugger
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows\CurrentVersion\Policies\System || ConsentPromptBehaviorAdmin
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows\CurrentVersion\Policies\System || ConsentPromptBehaviorUser
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows\CurrentVersion\Policies\System || EnableLUA
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\machine\software\microsoft\Windows\CurrentVersion\Run || Windwos
\REGISTRY\USER\SANDBOX_ERIC_SUSPICIOUSSAMPLES\user\current\software\Microsoft\Windows\CurrentVersion\Policies\System || DisableTaskMgr

YGLRv6L5sHKSKCYmJ4nAcpJ5YmJyknnQcvIpJiYnn+BygrxygiYnqAunQictdKJCJwm3ctJyonKSgCsnKCYmJwjocnIqJiYnp5AoJ3ktJiYneQ25YtG/crYJyXKS15AtJ6eQLid3Kyf3cvIMynKSKSYmJ5mgLScpJiYnCaxyks9ykp9yksAvJ+5iYnLiDo1ygi8mJif40C4nLSYmJw39YvFyqfAmJy4mJicO/3LiYmJy4nCncpJ5cJpyknZwunKxW2O2ciYZmTVmKicXuzVmKw+nLie3B7csJycmJicHty0nJyYmJwfHKicsJiYnDMctJyomJicKxy4n6GJicoIOxy8nhykn93JypnCOcqLYcI9ygnD/crJiYnKygJZycreAl3KCAAA
Rules version: 5.0.35
OS: Windows 6.2 Service Pack 0.0 Build: 9200 - Workstation 64bit OS
dll version: 51504

D:\sandboxie\SandboxieRpcSs.exe
MD5: 820C48B6935459CB56080114B1E2DE15
"D:\sandboxie\SbieSvc.exe"
MD5:

希望偶的SBie表出问题啊

3801187

过大BD