File name: KB29703437.exe Detection ratio: 5 / 54

墨家小子

SHA256:        872eca971bced0adb3b0190a3289f7d1fdc714918dea5447a401a2dccf22153f
File name:        KB29703437.exe
Detection ratio:        5 / 54
Analysis date:        2015-12-27 12:46:50 UTC ( 0 minutes ago )
https://www.virustotal.com/en/fi ... nalysis/1451220410/

墨家小子

诺顿没有反应，过了

小飞侠.net

ESET Smart Security 64位（高级启发式+启发式+DNA+智能签名）++（Win 10 th2....）：
奇虎360杀毒 64位（QVM二代、360云查杀、Avira、BitDefender）++（Win 7....）：

。。。。查杀结果看图：Scan finished. 1/21 scanners reported malware.


样本MD5：Win32/Kryptik.EJMK
文件名: C:\Users\xfxnet2000\Desktop\MX Player Pro\刘嘉欣\7346797\958202\952802\馨妍\ZipX\KB29703437.rar
文件大小: 81545 字节 (79.63 KB)https://virusscan.jotti.org/en-GB/filescanjob/13cqow8ow5
修改日期: 2015-12-27 21:10
MD5: df318045c4d9e1c4ebbaa4d591e35749
SHA1: 1f9f2b12dca2d1174c08e68cb026384ab5aa90c1
SHA256: 6e31a0061865461feea3753da8d3d4e1b0dd965575e2d5610319c98610ca4e0c
CRC32: d7c0a781

nick20010117

开开心心卖手机

TR/Crypt.XPACK.289916 (Cloud)

墨家小子

高级货是过不了我H的 ，看来HitmanPro.Alert +  Norton Security 是灰常不错的选择

aboringman

KAV：

扫描：killed；

27.12.2015 21.17.29;Detected object (file) was deleted.;C:\Users\killer\Desktop\KB29703437.exe;C:\Users\killer\Desktop\KB29703437.exe;UDS:DangerousObject.Multi.Generic;Unknown threat;12/27/2015 21:17:29

双击：已入库样本，pass。


AVG：

扫描：miss；

双击：实机双击（不入沙），创建启动项后不久IDP击杀之（need reboot）。

"";"IDP.Program.D1B0A5C0, C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-18623451\we1a12a13a1ab.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/27, 21:20:45"
"";", C:\USERS\KILLER\DESKTOP\KB29703437.EXE";"Object was blocked";"Process";"2015/12/27, 21:20:45"
"";", C:\Windows\explorer.exe";"Object was blocked";"Process";"2015/12/27, 21:20:45"
"";", HKEY_USERS\S-1-5-21-1910074467-3606790842-1030588025-1005\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\WE121ZA13A1AB";"Deleted, Moved to Virus Vault";"Registry value";"2015/12/27, 21:20:45"
"";", HKEY_USERS\S-1-5-21-1910074467-3606790842-1030588025-1005\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\\WE121ZA13A1AB";"Deleted, Moved to Virus Vault";"Registry value";"2015/12/27, 21:20:45"

dongwenqi

aboringman 发表于 2015-12-27 22:43
KAV：

扫描：killed；

你恢复用卡巴KAV了

aboringman

dongwenqi 发表于 2015-12-28 11:24
你恢复用卡巴KAV了

不知道，因为现在很迷茫，处于漂浮状态，也就是所谓的裸奔。

dongwenqi

aboringman 发表于 2015-12-28 12:26
不知道，因为现在很迷茫，处于漂浮状态，也就是所谓的裸奔。

哦，好吧