Detection ratio: 3 / 54

墨家小子

https://www.virustotal.com/en/fi ... nalysis/1449575229/
SHA256:        f32547b5bb4abe56e6ba6ba0676466735ce8aa50be4beb1d90e43438c7296030
File name:        f32547b5bb4abe56e6ba6ba0676466735ce8aa50be4beb1d90e43438c7296030.exe
Detection ratio:        3 / 54
Analysis date:        2015-12-08 11:47:09 UTC ( 1 minute ago )



2015/12/8 19:47:17,C:\Windows\explorer.exe,53,Allowed ;执行应用程序 ("C:\Users\AA\Desktop\AA\f32547b5bb4abe56e6ba6ba0676466735ce8aa50be4beb1d90e43438c7296030.exe" )

2015/12/8 19:47:55,C:\Users\AA\Desktop\AA\f32547b5bb4abe56e6ba6ba0676466735ce8aa50be4beb1d90e43438c7296030.exe,50,Allowed ;使用 DNS 解析服务访问网络

2015/12/8 19:48:01,C:\Users\AA\Desktop\AA\f32547b5bb4abe56e6ba6ba0676466735ce8aa50be4beb1d90e43438c7296030.exe,48,Allowed ;出站网络访问
建立 出站 网络连接 (TCP)
远程地址=216.189.52.147  远程端口=243

2015/12/8 19:48:11,C:\Users\AA\Desktop\AA\f32547b5bb4abe56e6ba6ba0676466735ce8aa50be4beb1d90e43438c7296030.exe,40,Blocked ;以修改权限打开进程或线程 (explorer.exe(pid=2980))

aboringman

AVG：

扫描：miss；

双击：实机双击（不入沙），等了一会儿，IDP击杀之。

"";"IDP.ARES.Generic, C:\Users\killer.Killer-PC\Desktop\f32547b5bb4abe56e6ba6ba0676466735ce8aa50be4beb1d90e43438c7296030.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/8, 19:56:50"
"";", C:\Windows\System32\sdbinst.exe";"Object was blocked";"Process";"2015/12/8, 19:56:50"
"";", C:\Windows\System32\sdbinst.exe";"Object was blocked";"Process";"2015/12/8, 19:56:50"
"";", C:\Users\killer.Killer-PC\AppData\Local\JNaES03P\UIZD13Kf.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/8, 19:56:50"
"";", C:\Users\killer.Killer-PC\AppData\LocalLow\w0EucwrF.bat";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/8, 19:56:50"
"";", C:\Users\killer.Killer-PC\Desktop\f32547b5bb4abe56e6ba6ba0676466735ce8aa50be4beb1d90e43438c7296030.exe";"Object was blocked";"Process";"2015/12/8, 19:56:50"

zmzcy

samlin01

红伞kill

275751198

360 QVM10

XywCloud

SUD to BAV