File name: 29C8.tmp.exe Detection ratio: 2 / 55 加密勒索挂马 2

显示全部楼层 · 发表于 2016-3-4 08:50:16

SHA256: 5997b5cd01295aec145e88c639b48ec9ca7b30fa9381b44f59cc20bb660cf528
File name: 29C8.tmp.exe
Detection ratio: 2 / 55
Analysis date: 2016-03-04 00:47:26 UTC ( 1 minute ago )
https://www.virustotal.com/en/file/5997b5cd01295aec145e88c639b48ec9ca7b30fa9381b44f59cc20bb660cf528/analysis/1457052446/

McAfee Ransomware-FFR!571BAFA7A9C7 20160304
Qihoo-360 QVM07.1.Malware.Gen 20160304

显示全部楼层 · 发表于 2016-3-4 09:43:36

HMPA
[mw_shl_code=css,true]Mitigation CryptoGuard

Platform    6.1.7601/x86 06_3c*
PID       1820
Application  C:\Windows\dhxxhprjddti.exe
Description  Scholarly Resurrects Smears 0.138

Filename    C:\Windows\dhxxhprjddti.exe

C:\Users\Administrator.PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8ORKVNOM\blank[1].png
C:\Users\Administrator.PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8ORKVNOM\bkgrey[1].png
C:\$Recycle.Bin\S-1-5-21-2822333451-2535238799-2698388218-500\$RGGXS6Y.doc

Code Injection
00400000-00486000  536KB C:\Windows\dhxxhprjddti.exe [2888]
7FFD8000-7FFD9000 4KB
1  C:\Windows\dhxxhprjddti.exe [2888]
2  C:\Users\Administrator.PC\Desktop\29C8.tmp.exe [3084]
3  C:\Users\Administrator.PC\Desktop\29C8.tmp.exe [2824]
4  C:\Windows\explorer.exe [3528]
5  C:\Windows\System32\userinit.exe [3444]
6  C:\Windows\System32\winlogon.exe [3228]
winlogon.exe
7  C:\Windows\System32\smss.exe [3172]
\SystemRoot\System32\smss.exe 00000000 00000040

Process Trace
1  C:\Windows\dhxxhprjddti.exe [1820]
2  C:\Windows\dhxxhprjddti.exe [2888]
3  C:\Users\Administrator.PC\Desktop\29C8.tmp.exe [3084]
4  C:\Users\Administrator.PC\Desktop\29C8.tmp.exe [2824]
5  C:\Windows\explorer.exe [3528]
6  C:\Windows\System32\userinit.exe [3444]
7  C:\Windows\System32\winlogon.exe [3228]
winlogon.exe
8  C:\Windows\System32\smss.exe [3172]
\SystemRoot\System32\smss.exe 00000000 00000040
[/mw_shl_code]

显示全部楼层 · 发表于 2016-3-4 10:36:25

断网双击

显示全部楼层 · 发表于 2016-3-4 11:14:55

BD双击

显示全部楼层 · 发表于 2016-3-4 11:40:35

微点拦截

显示全部楼层 · 发表于 2016-3-4 11:51:58

eset拉黑

显示全部楼层 · 发表于 2016-3-4 12:52:55

红伞云查杀 'TR/Crypt.XPACK.Gen2 (Cloud)' [trojan]

[可疑文件] File name: 29C8.tmp.exe Detection ratio: 2 / 55 加密勒索挂马 2

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块