Detection ratio: 5 / 55

墨家小子

SHA256:        7357c45ba3650e4b07d8ab09320d95ed056880692d2795fbede36c8290f6dec5
File name:        gavilchila.exe
Detection ratio:        5 / 55
Analysis date:        2015-12-17 03:32:32 UTC ( 1 minute ago )
https://www.virustotal.com/en/fi ... nalysis/1450323152/

胖福

文件名: gavilchila.exe
威胁名称: SAPE.Heur.985C7完整路径: f:\norton样本\gavilchila.exe

____________________________

____________________________


在电脑上的创建时间 
2015-12-17 ( 11:41:49 )

上次使用时间 
2015-12-17 ( 11:43:49 )

启动项目 
否

已启动 
否

威胁类型: 启发式病毒。 根据恶意软件启发式技术检测威胁。

____________________________


gavilchila.exe 威胁名称: SAPE.Heur.985C7
定位


极少用户信任的文件
诺顿社区中有 不到 5 名用户使用了此文件。

极新的文件
该文件已在 不到 1 周 前发行。

高
此文件具有高风险。


____________________________


来源: 外部介质

源文件:
gavilchila.exe

____________________________

文件操作

文件: f:\norton样本\ gavilchila.exe 已删除
____________________________


文件指纹 - SHA:
7357c45ba3650e4b07d8ab09320d95ed056880692d2795fbede36c8290f6dec5
文件指纹 - MD5:
不可用

yuzhi3366853

奇怪的是微点不杀，难道在沙盘运行的原因？
[mw_shl_code=css,true]<activities>
<activity timestamp="2015-12-17T05:19:04.602Z" id="2" type="LoadImageFile" path="C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll"/>
<activity timestamp="2015-12-17T05:19:04.603Z" id="3" type="LoadImageFile" path="C:\Windows\SysWOW64\version.dll"/>
<activity timestamp="2015-12-17T05:19:04.604Z" id="4" type="LoadImageFile" path="C:\Windows\WindowsShell.Manifest"/>
<activity timestamp="2015-12-17T05:19:04.607Z" id="5" type="LoadImageFile" path="E:\我的程序\Ad Muncher4.93中文版_CJX规则_150817\Ad Muncher4.93cn\AM32-33707.dll"/>
<activity timestamp="2015-12-17T05:19:04.611Z" id="7" type="LoadImageFile" path="C:\Windows\SysWOW64\ws2_32.dll"/>
<activity timestamp="2015-12-17T05:19:04.615Z" id="9" type="LoadImageFile" path="C:\Windows\SysWOW64\shfolder.dll"/>
<activity timestamp="2015-12-17T05:19:04.618Z" id="10" type="LoadImageFile" path="C:\Windows\Globalization\Sorting\SortDefault.nls"/>
<activity timestamp="2015-12-17T05:19:04.655Z" id="11" type="LoadImageFile" path="C:\Windows\SysWOW64\propsys.dll"/>
<activity timestamp="2015-12-17T05:19:04.659Z" id="13" type="LoadImageFile" path="C:\Windows\SysWOW64\ntmarta.dll"/>
<activity timestamp="2015-12-17T05:19:04.661Z" id="14" type="LoadImageFile" path="C:\Users\Administrator\AppData\Local\Microsoft\Windows\Caches\cversions.1.db"/>
<activity timestamp="2015-12-17T05:19:04.663Z" id="15" type="LoadImageFile" path="C:\Users\Administrator\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000002e.db"/>
<activity timestamp="2015-12-17T05:19:04.669Z" id="16" type="LoadImageFile" path="C:\Windows\SysWOW64\profapi.dll"/>
<activity timestamp="2015-12-17T05:19:04.680Z" id="18" type="DeleteFile" path="C:\Users\Administrator\AppData\Local\Temp\nso82F6.tmp"/>
<activity timestamp="2015-12-17T05:19:04.699Z" id="20" type="DeleteFile" path="C:\Users\Administrator\AppData\Local\Temp\nst8316.tmp"/>
<activity timestamp="2015-12-17T05:19:04.741Z" id="23" type="ModifyFile" path="C:\Users\Administrator\AppData\Local\Temp\nst8316.tmp\System.dll"/>
<activity timestamp="2015-12-17T05:19:04.744Z" id="24" type="LoadImageFile" path="C:\Users\Administrator\AppData\Local\Temp\nst8316.tmp\System.dll"/>
<activity timestamp="2015-12-17T05:19:06.832Z" id="29" type="ModifyFile" path="C:\Users\Administrator\AppData\Local\Temp\nst8316.tmp\Inetc.dll"/>
<activity timestamp="2015-12-17T05:19:06.835Z" id="30" type="LoadImageFile" path="C:\Users\Administrator\AppData\Local\Temp\nst8316.tmp\Inetc.dll"/>
<activity timestamp="2015-12-17T05:19:08.860Z" id="34" type="LoadImageFile" path="C:\Windows\SysWOW64\dwmapi.dll"/>
<activity timestamp="2015-12-17T05:19:08.885Z" id="35" type="LoadImageFile" path="C:\Windows\Fonts\StaticCache.dat"/>
<activity timestamp="2015-12-17T05:19:08.890Z" id="36" type="LoadImageFile" path="C:\Windows\SysWOW64\ole32.dll"/>
<activity timestamp="2015-12-17T05:19:08.908Z" id="38" type="LoadImageFile" path="C:\Windows\SysWOW64\secur32.dll"/>
<activity timestamp="2015-12-17T05:19:08.964Z" id="39" type="LoadImageFile" path="C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat"/>
<activity timestamp="2015-12-17T05:19:08.965Z" id="40" type="ModifyFile" path=""/>
<activity timestamp="2015-12-17T05:19:08.976Z" id="41" type="LoadImageFile" path="C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\index.dat"/>
<activity timestamp="2015-12-17T05:19:08.988Z" id="43" type="LoadImageFile" path="C:\Users\Administrator\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat"/>
<activity timestamp="2015-12-17T05:19:09.031Z" id="45" type="LoadImageFile" path="C:\Windows\SysWOW64\dnsapi.dll"/>
<activity timestamp="2015-12-17T05:19:09.075Z" id="46" type="LoadImageFile" path="C:\Windows\SysWOW64\PeerDist.dll"/>
<activity timestamp="2015-12-17T05:19:09.077Z" id="48" type="LoadImageFile" path="C:\Windows\SysWOW64\userenv.dll"/>
<activity timestamp="2015-12-17T05:19:09.079Z" id="49" type="LoadImageFile" path="C:\Windows\SysWOW64\authz.dll"/>
<activity timestamp="2015-12-17T05:19:09.089Z" id="51" type="LoadImageFile" path="C:\Windows\SysWOW64\rasapi32.dll"/>
<activity timestamp="2015-12-17T05:19:09.091Z" id="52" type="LoadImageFile" path="C:\Windows\SysWOW64\rasman.dll"/>
<activity timestamp="2015-12-17T05:19:09.093Z" id="53" type="LoadImageFile" path="C:\Windows\SysWOW64\rtutils.dll"/>
<activity timestamp="2015-12-17T05:19:09.097Z" id="54" type="CreateKey" regKey="SOFTWARE\Wow6432Node\Microsoft\Tracing\gavilchila_RASAPI32"/>
<activity timestamp="2015-12-17T05:19:09.097Z" id="55" type="SetValueKey" regKey="SOFTWARE\Wow6432Node\Microsoft\Tracing\gavilchila_RASAPI32" regValName="EnableFileTracing" regValType="REG_DWORD" regValData="0"/>
<activity timestamp="2015-12-17T05:19:09.098Z" id="56" type="SetValueKey" regKey="SOFTWARE\Wow6432Node\Microsoft\Tracing\gavilchila_RASAPI32" regValName="EnableConsoleTracing" regValType="REG_DWORD" regValData="0"/>
<activity timestamp="2015-12-17T05:19:09.098Z" id="57" type="SetValueKey" regKey="SOFTWARE\Wow6432Node\Microsoft\Tracing\gavilchila_RASAPI32" regValName="FileTracingMask" regValType="REG_DWORD" regValData="-65536"/>
<activity timestamp="2015-12-17T05:19:09.098Z" id="58" type="SetValueKey" regKey="SOFTWARE\Wow6432Node\Microsoft\Tracing\gavilchila_RASAPI32" regValName="ConsoleTracingMask" regValType="REG_DWORD" regValData="-65536"/>
<activity timestamp="2015-12-17T05:19:09.098Z" id="59" type="SetValueKey" regKey="SOFTWARE\Wow6432Node\Microsoft\Tracing\gavilchila_RASAPI32" regValName="MaxFileSize" regValType="REG_DWORD" regValData="1048576"/>
<activity timestamp="2015-12-17T05:19:09.100Z" id="61" type="CreateKey" regKey="SOFTWARE\Wow6432Node\Microsoft\Tracing\gavilchila_RASMANCS"/>
<activity timestamp="2015-12-17T05:19:09.101Z" id="62" type="SetValueKey" regKey="SOFTWARE\Wow6432Node\Microsoft\Tracing\gavilchila_RASMANCS" regValName="EnableFileTracing" regValType="REG_DWORD" regValData="0"/>
<activity timestamp="2015-12-17T05:19:09.101Z" id="63" type="SetValueKey" regKey="SOFTWARE\Wow6432Node\Microsoft\Tracing\gavilchila_RASMANCS" regValName="EnableConsoleTracing" regValType="REG_DWORD" regValData="0"/>
<activity timestamp="2015-12-17T05:19:09.101Z" id="64" type="SetValueKey" regKey="SOFTWARE\Wow6432Node\Microsoft\Tracing\gavilchila_RASMANCS" regValName="FileTracingMask" regValType="REG_DWORD" regValData="-65536"/>
<activity timestamp="2015-12-17T05:19:09.102Z" id="65" type="SetValueKey" regKey="SOFTWARE\Wow6432Node\Microsoft\Tracing\gavilchila_RASMANCS" regValName="ConsoleTracingMask" regValType="REG_DWORD" regValData="-65536"/>
<activity timestamp="2015-12-17T05:19:09.102Z" id="66" type="SetValueKey" regKey="SOFTWARE\Wow6432Node\Microsoft\Tracing\gavilchila_RASMANCS" regValName="MaxFileSize" regValType="REG_DWORD" regValData="1048576"/>
<activity timestamp="2015-12-17T05:19:09.105Z" id="68" type="SetValueKey" regKey="S-1-5-21-405995492-4216430718-1867223844-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" regValName="ProxyEnable" regValType="REG_DWORD" regValData="0"/>
<activity timestamp="2015-12-17T05:19:09.106Z" id="69" type="SetValueKey" regKey="S-1-5-21-405995492-4216430718-1867223844-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" regValName="SavedLegacySettings" regValType="REG_BINARY" regValData="460000009E0F000009000000000000000000000000000000040000000000000018B8C0CE7B38D10100000000000000000000000001000000020000000A02926A000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"/>
<activity timestamp="2015-12-17T05:19:09.108Z" id="70" type="LoadImageFile" path="C:\Windows\SysWOW64\nlaapi.dll"/>
<activity timestamp="2015-12-17T05:19:09.114Z" id="72" type="LoadImageFile" path="C:\Windows\SysWOW64\rasadhlp.dll"/>
<activity timestamp="2015-12-17T05:19:09.116Z" id="73" type="LoadImageFile" path="C:\Windows\SysWOW64\mswsock.dll"/>
<activity timestamp="2015-12-17T05:19:09.119Z" id="75" type="LoadImageFile" path="C:\Windows\SysWOW64\wship6.dll"/>
<activity timestamp="2015-12-17T05:19:09.128Z" id="77" type="SetValueKey" regKey="S-1-5-21-405995492-4216430718-1867223844-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" regValName="UNCAsIntranet" regValType="REG_DWORD" regValData="0"/>
<activity timestamp="2015-12-17T05:19:09.129Z" id="78" type="SetValueKey" regKey="S-1-5-21-405995492-4216430718-1867223844-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" regValName="AutoDetect" regValType="REG_DWORD" regValData="1"/>
<activity timestamp="2015-12-17T05:19:09.132Z" id="79" type="SetValueKey" regKey="S-1-5-21-405995492-4216430718-1867223844-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" regValName="UNCAsIntranet" regValType="REG_DWORD" regValData="0"/>
<activity timestamp="2015-12-17T05:19:09.132Z" id="80" type="SetValueKey" regKey="S-1-5-21-405995492-4216430718-1867223844-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" regValName="AutoDetect" regValType="REG_DWORD" regValData="1"/>
<activity timestamp="2015-12-17T05:19:09.144Z" id="83" type="LoadImageFile" path="C:\Windows\SysWOW64\WSHTCPIP.DLL"/>
<activity timestamp="2015-12-17T05:19:08.955Z" id="84" type="AttributesFile" path="C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5" oldAttr="00000000" newAttr="00002086"/>
<activity timestamp="2015-12-17T05:19:09.151Z" id="85" type="LoadImageFile" path="C:\Windows\SysWOW64\FWPUCLNT.DLL"/>
<activity timestamp="2015-12-17T05:19:24.721Z" id="90" type="ModifyFile" path="C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AQNQ62E2\psb[1].gif"/>
<activity timestamp="2015-12-17T05:19:24.722Z" id="91" type="ModifyFile" path="C:\Users\Administrator\AppData\Local\Temp\nst8316.tmp\1.tmp"/>
<activity timestamp="2015-12-17T05:19:08.970Z" id="91" type="AttributesFile" path="C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies" oldAttr="00000000" newAttr="00002086"/>
<activity timestamp="2015-12-17T05:19:08.981Z" id="98" type="AttributesFile" path="C:\Users\Administrator\AppData\Local\Microsoft\Windows\History\History.IE5" oldAttr="00000000" newAttr="00002086"/>
</activities>[/mw_shl_code]

墨家小子

yuzhi3366853 发表于 2015-12-17 13:24
奇怪的是微点不杀，难道在沙盘运行的原因？
[mw_shl_code=css,true]

你说话挺搞笑的

yuzhi3366853

墨家小子 发表于 2015-12-17 23:16
你说话挺搞笑的

理论上这毒微点会杀的啊.....