精睿样本测试（16.1.14）

轩夏

地址：

http://kuai.xunlei.com/d/zuh.AcWeB92WVgQA900

http://pan.baidu.com/s/1dDYsewp  提取密码   capj

  
密码：bbs.vc52.cn
数量：50

cxy密斯

Mcafee kill 13x，包含1x修复，剩余37x

275751198

360云+QVM  改后缀名
删除30个剩余20个

275751198

13号小工具 目测白文件
27号VT上只有1家报
40号clean VT上0家报
39号 Linux Getshell
23号 小工具 目测白文件


50号小工具 功能是将主页生成为脚本 目测白文件

11号是一个PDF文件，全部内容如下
里面有个链接，点开后网页已失效，应该是看不到钓鱼网页了，如果真的是钓鱼网页，正常情况下应该是拉黑网址，我们也没有必要把PDF拉黑，随便编都能编出来，这要是拉黑那哪忙得过来啊？可是微软这么干了，微软把这个PDF拉黑了，命名为Trojan.PDFphish.


32号VT上一家报  目测又是邮件内涵钓鱼网站  
25号Linux.Rekoobe.A       
22号Linux.Rekoobe.A
38号 仍然是PDF ，里面有个链接http://berrak.com.tr/omo.html     现在已经打不开       

蓝天二号

卡巴

欧阳宣

BitDefender检测35，修复2个。
[mw_shl_code=css,true]D:\Virus\2016.1.14\09.vir Trojan.Generic.15593338 Deleted
D:\Virus\2016.1.14\45.vir Trojan.GenericKD.2970240 Deleted
D:\Virus\2016.1.14\01.vir Trojan.GenericKD.2971848 Deleted
D:\Virus\2016.1.14\25.vir Linux.Rekoobe.A Deleted
D:\Virus\2016.1.14\43.vir Gen:Variant.Symmi.57389 Deleted
D:\Virus\2016.1.14\47.vir Trojan.VBS.Downloader.JS Moved to Quarantine
D:\Virus\2016.1.14\29.vir Trojan.Generic.15591710 Deleted
D:\Virus\2016.1.14\05.vir Trojan.GenericKD.2973252 Deleted
D:\Virus\2016.1.14\33.vir=>(Embedded EXE g) Trojan.Spy.XXP Moved to Quarantine
D:\Virus\2016.1.14\41.vir Trojan.GenericKD.2973532 Deleted
D:\Virus\2016.1.14\49.vir Gen:Variant.MSILPerseus.19 Deleted
D:\Virus\2016.1.14\48.vir Gen:Variant.MSILPerseus.10869 Deleted
D:\Virus\2016.1.14\08.vir Trojan.GenericKD.2973519 Deleted
D:\Virus\2016.1.14\26.vir Trojan.GenericKD.2972491 Deleted
D:\Virus\2016.1.14\44.vir Trojan.VBS.Downloader.JS Moved to Quarantine
D:\Virus\2016.1.14\19.vir Trojan.GenericKD.2974931 Deleted
D:\Virus\2016.1.14\37.vir Trojan.GenericKD.2975875 Deleted
D:\Virus\2016.1.14\28.vir Trojan.Generic.15583566 Deleted
D:\Virus\2016.1.14\46.vir Gen:Variant.Kazy.220118 Deleted
D:\Virus\2016.1.14\15.vir W97M.Downloader.AOH Disinfected
D:\Virus\2016.1.14\36.vir Trojan.GenericKD.2973074 Deleted
D:\Virus\2016.1.14\17.vir Trojan.Generic.15539078 Deleted
D:\Virus\2016.1.14\35.vir Trojan.GenericKD.2967756 Deleted
D:\Virus\2016.1.14\12.vir Gen:Variant.Kazy.731174 Deleted
D:\Virus\2016.1.14\24.vir=>word=>embeddings=>oleObject1.bin=>_crypt1D2A7C0.exe Gen:Variant.Symmi.57467 Deleted
D:\Virus\2016.1.14\06.vir Generic.TeslaCrypt.02807463 Deleted
D:\Virus\2016.1.14\04.vir Trojan.Cripack.Gen.1 Moved to Quarantine
D:\Virus\2016.1.14\34.vir=>(NSIS o)=>lzma_solid_nsis0000 Application.Bundler.Somoto.AG Moved to Quarantine
D:\Virus\2016.1.14\22.vir Linux.Rekoobe.A Deleted
D:\Virus\2016.1.14\03.vir Trojan.GenericKD.2974768 Deleted
D:\Virus\2016.1.14\07.vir=>(bz2_data)=>Formulario_gestion_traslado_de_cesantias_4124789536366236566.exe Trojan.Generic.15568739 Moved to Quarantine
D:\Virus\2016.1.14\21.vir Trojan.GenericKD.2972739 Deleted
D:\Virus\2016.1.14\34.vir=>(Dropped 0)=>(7z 2g)  Moved to Quarantine
D:\Virus\2016.1.14\34.vir=>(NSIS o)=>lzma_solid_nsis0001=>(7z o)  Moved to Quarantine
D:\Virus\2016.1.14\02.vir Trojan.GenericKD.2972522 Deleted
D:\Virus\2016.1.14\20.vir Trojan.GenericKD.1581182 Deleted
D:\Virus\2016.1.14\14.vir Gen:Win32.ExplorerHijack.dqX@aO9ui3p Deleted [/mw_shl_code]

windows7爱好者

360TS，后缀为vir时，杀31个
后缀改为exe，补杀两个，
总共查杀33个，剩下17个

T.Yoshiyuki

FSCS
扫描删除36x


DG封锁全部8个exe


算44x吧

P.S. 最近断网给DG测了好几个样本 基本一个也拦不下来啊……说好的行为分析呢？

毛豆新人

CIS    5x

14.vir         Malware@#62xoxa4kfvl7        
28.vir         Packed.Win32.MUPX.Gen@129019204
34.vir         Application.Win32.Somoto.GH@351704186        
46.vir         TrojWare.Win32.PWS.Fareit.GS@351459011        
50.vir         Heur.Packed.Unknown@4294967295

昨天的库

神迹般存在

卡巴斯基安全软件2016 MR1：
删除25个，修复1个。
已经上报。