每日样本

送信Y

数字不杀！

zmzcy

  杀衍生物
  恶意软件(QVM07.1.Malware.Gen)MD5:68f77ad0e2dc5eb28e876be3690fbb16         
  c:\360sandbox\shadow\users\mr.zcy\appdata\local\temp\pocrahig.exe

bbszy

改了文件名后，连按了两次回车，还好信誉给我拦了。。。。

Filename: 3b8e8fe55323610878142de25fa6302a.exe
Threat name: WS.Reputation.1Full Path: c:\users\yx\desktop\3b8e8fe55323610878142de25fa6302a.exe

____________________________

____________________________


On computers as of 
2015/7/15 at 16:49:34

Last Used 
2015/7/15 at 16:51:34

Startup Item 
No

Launched 
No

Threat type: Insight Network Threat. There are many indications that this file is untrustworthy and therefore not safe


____________________________


3b8e8fe55323610878142de25fa6302a.exe Threat name: WS.Reputation.1
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

Medium
This file risk is medium.


____________________________


Source: External Media

Source File:
3b8e8fe55323610878142de25fa6302a.exe

____________________________

File Actions

File: c:\users\yx\desktop\ 3b8e8fe55323610878142de25fa6302a.exe Removed
____________________________


File Thumbprint - SHA:
6830747a4e332f7f1922d84c3579526996ba6dbd453654aea210d43cd128de89
File Thumbprint - MD5:
Not available

bbszy

SONAR 杀

Filename: 3b8e8fe55323610878142de25fa6302a.exe
Threat name: SONAR.Heuristic.120Full Path: Not Available

____________________________

____________________________


On computers as of 
2015/7/15 at 16:52:33

Last Used 
2015/7/15 at 16:52:33

Startup Item 
No

Launched 
Yes

SONAR Protection monitors for suspicious program activity on your computer.


____________________________


3b8e8fe55323610878142de25fa6302a.exe Threat name: SONAR.Heuristic.120
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media

Source File:
3b8e8fe55323610878142de25fa6302a.exe

____________________________

File Actions

File: c:\users\yx\desktop\ 3b8e8fe55323610878142de25fa6302a.exe Threat Removed
____________________________

System Settings Actions

Event: Process start (Performed by c:\users\yx\desktop\3b8e8fe55323610878142de25fa6302a.exe, PID:7172) No action taken
Event: PE file creation: c:\sandbox\yx\defaultbox\user\current\appdata\local\temp\ lifikuri.exe (Performed by c:\users\yx\desktop\3b8e8fe55323610878142de25fa6302a.exe, PID:7172) No action taken
Event: Process start: c:\users\yx\desktop\ 3b8e8fe55323610878142de25fa6302a.exe, PID:7172 (Performed by c:\users\yx\desktop\3b8e8fe55323610878142de25fa6302a.exe, PID:7172) No action taken
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

卡布达

驭龙 发表于 2015-7-15 13:54
那个也是不可以的，当然2楼的是Windows 10所以你懂得

应该是这原因，，吧。没在意，下了样本后 他自己带着图标就跑出来了，

驭龙

卡布达 发表于 2015-7-15 21:03
应该是这原因，，吧。没在意，下了样本后 他自己带着图标就跑出来了，

看起来，好像Windows 10的WD又改变策略了

卡布达

驭龙 发表于 2015-7-15 21:12
看起来，好像Windows 10的WD又改变策略了

我把防护关了之后再启用。好吧

卡布达

驭龙 发表于 2015-7-15 21:12
看起来，好像Windows 10的WD又改变策略了

原来这样，把防护在这里关了，然后在WD里启用，就是27楼图样
在这里却可以正常启用，启用了在wd界面也可以立马变成绿色 不会出错之类的- -，@wjy19800315 @ELOHIM
算BUG还是

清澈梦

avast防御成功

2221000789

百度 Kill