Detection ratio: 3 / 55

墨家小子

SHA256:        4601699e3dad1987c51af95fff0aafd38c7555f87f2c93da1a1a8540f5779f52
File name:        4601699e3dad1987c51af95fff0aafd38c7555f87f2c93da1a1a8540f5779f52.exe
Detection ratio:        3 / 55
Analysis date:        2015-12-04 11:31:05 UTC ( 1 minute ago )
https://www.virustotal.com/en/fi ... nalysis/1449228665/






送两个：




再送一个：

XywCloud

BAV云全杀

aboringman

AVG：

扫描：miss all；

双击：实机双击（不入沙），IDP三杀，最后一个怀疑不是程序。。。。。。

4601699e3dad1987c51af95fff0aafd38c7555f87f2c93da1a1a8540f5779f52.exe：

"";"Unknown, C:\Users\Killer\Desktop\4601699e3dad1987c51af95fff0aafd38c7555f87f2c93da1a1a8540f5779f52.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/4, 19:41:17"
"";", C:\Users\Killer\Desktop\4601699e3dad1987c51af95fff0aafd38c7555f87f2c93da1a1a8540f5779f52.exe";"Object was blocked";"Process";"2015/12/4, 19:41:17"
"";", C:\Users\Killer\AppData\Roaming\360se6\Application\360se.exe";"Object was blocked";"Process";"2015/12/4, 19:41:17"
"";", C:\Users\Killer\AppData\Roaming\360se6\Application\360se.exe";"Object was blocked";"Process";"2015/12/4, 19:41:17"
"";", C:\Users\Killer\AppData\Local\Temp\jikhrgleg.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/4, 19:41:17"
"";", C:\Users\Killer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0I8UZZG\7za[1].mkv";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/4, 19:41:17"

caitlyn.exe：

"";"IDP.ALEXA.51, C:\uoscnassc\hrthfkcbccia.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/4, 19:43:25"
"";", C:\uoscnassc\kxt8e95b24uztoaggvsp.exe";"Object was blocked";"Process";"2015/12/4, 19:43:25"
"";", C:\uoscnassc\xdaeqxhaq.exe";"Object was blocked";"Process";"2015/12/4, 19:43:25"
"";", C:\Users\Killer\Desktop\caitlyn.exe";"Object was blocked";"Process";"2015/12/4, 19:43:25"
"";", C:\Users\Killer\Desktop\caitlyn.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/4, 19:43:25"
"";", C:\uoscnassc\xdaeqxhaq.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/4, 19:43:25"
"";", C:\uoscnassc\kxt8e95b24uztoaggvsp.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/4, 19:43:25"
"";", C:\uoscnassc\hrthfkcbccia.exe";"Object was blocked";"Process";"2015/12/4, 19:43:25"
"";", HKEY_USERS\S-1-5-21-1910074467-3606790842-1030588025-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\PANEL POLICY WIRED SECURITY";"Deleted, Moved to Virus Vault";"Registry value";"2015/12/4, 19:43:25"

godfrey.exe：

"";"IDP.ALEXA.51, C:\qoddilfu\vrafmeg.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/4, 19:44:37"
"";", C:\qoddilfu\ywdsajiyp.exe";"Object was blocked";"Process";"2015/12/4, 19:44:37"
"";", C:\QODDILFU\FU73O96T9XJNFURYBPWNI.EXE";"Object was blocked";"Process";"2015/12/4, 19:44:37"
"";", C:\Users\Killer\Desktop\godfrey.exe";"Object was blocked";"Process";"2015/12/4, 19:44:37"
"";", C:\Users\Killer\Desktop\godfrey.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/4, 19:44:37"
"";", C:\QODDILFU\FU73O96T9XJNFURYBPWNI.EXE";"Deleted";"File or Directory";"2015/12/4, 19:44:37"
"";", C:\qoddilfu\ywdsajiyp.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/4, 19:44:37"
"";", C:\qoddilfu\vrafmeg.exe";"Object was blocked";"Process";"2015/12/4, 19:44:37"
"";", HKEY_USERS\S-1-5-21-1910074467-3606790842-1030588025-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\PLAY THREAD CONNECTION ADAPTER LIST SPOOLER EVENT";"Deleted, Moved to Virus Vault";"Registry value";"2015/12/4, 19:44:37"

caitlyn.exe和godfrey.exe貌似是一样的（从行为看有些相似）。

zmzcy

saga3721

文件 ID         文件名         大小(字节)         结果
28668283         %E6%96%B0%E5%BB%B...B9.rar         1.55 MB         OK

以下位置提供了存档中包含的文件及其结果的列表:
文件 ID         文件名         大小(字节)         结果
28668284         431a908a13149c5a9...26.exe         182.93 KB         UNDER ANALYSIS
28668285         4601699e3dad1987c...52.exe         1.23 MB         UNDER ANALYSIS
28668286         caitlyn.exe         329 KB         UNDER ANALYSIS
28668287         godfrey.exe         329 KB         UNDER ANALYSIS

挥泪斩情思

275751198

类型：
感染型病毒(Win32/Trojan.97a)

描述：
木马通常利用系统的漏洞，绕过系统防御，达到：盗取账号、窃取资料、篡改文件、破坏数据的目的。
经过360安全中心检验，此文件是木马，建议您立即处理。

扫描引擎：
360云查杀引擎

文件路径：
D:\下载文件存储文件夹\123\新建文件夹\431a908a13149c5a9695b61edc27d58741b909acaf4f0336aaade327c8e1e626.rar

文件指纹(MD5)：
bc68d9a23964f3ba01a8e96542c0ed73
类型：
HEUR/QVM10.1.Malware.Gen

描述：
木马通常利用系统的漏洞，绕过系统防御，达到：盗取账号、窃取资料、篡改文件、破坏数据的目的。
经过360安全中心检验，此文件是木马，建议您立即处理。

扫描引擎：
360云查杀引擎

文件路径：
D:\下载文件存储文件夹\123\新建文件夹\godfrey.rar

文件指纹(MD5)：
5949c84ffe9a7020cd72563cddfb0867
类型：
HEUR/QVM10.1.Malware.Gen

描述：
木马通常利用系统的漏洞，绕过系统防御，达到：盗取账号、窃取资料、篡改文件、破坏数据的目的。
经过360安全中心检验，此文件是木马，建议您立即处理。

扫描引擎：
360云查杀引擎

文件路径：
D:\下载文件存储文件夹\123\新建文件夹\e354615300fd85d05fa54f5e68345c03042edf4007624496fa2d30c73029d0ce.zip

文件指纹(MD5)：
996931d24500620ba61f7cc203de741e