一枚来自腾讯电脑管家论坛的小样本

ELOHIM

学雷锋做人 发表于 2016-5-31 23:20
腾讯云的密码错了，他们是之前百度云下载的

好的，知道了。

ELOHIM

学雷锋做人 发表于 2016-5-31 23:20
腾讯云的密码错了，他们是之前百度云下载的

密码输错了，文件也不一样大小？？？

学雷锋做人

ELOHIM 发表于 2016-5-31 23:26
密码输错了，文件也不一样大小？？？

zip与7Z，这应该好理解

ELOHIM

学雷锋做人 发表于 2016-5-31 23:26
zip与7Z，这应该好理解

没注意看，困了。压缩前文件大小是一样的。
睡了。。
IE 8 SS 提示病毒。SEP没反应。。

阿里小白帽

时间@ 发表于 2016-5-31 21:29
您是腾讯员工吧！不然根本看不了样本

版主也可以看的

阿里小白帽

腾管miSS

欧阳宣

Artemis!FDA69CA15F27

胖福

ymb668888 发表于 2016-5-31 18:59
文件名: Ann .exe
完整路径: D:\新建文件夹\Downloads\病毒测试\Ann .exe

Filename: ann .exe
Threat name: SONAR.Heuristic.144Full Path: Not Available

____________________________

____________________________


On computers as of 
2016-6-1 at 11:46:47

Last Used 
2016-6-1 at 11:46:47

Startup Item 
No

Launched 
Yes

SONAR Protection monitors for suspicious program activity on your computer.


____________________________


ann .exe Threat name: SONAR.Heuristic.144
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media

Source File:
ann .exe

____________________________

File Actions

File: f:\norton样本\临时收集\ ann .exe Threat Removed
File: c:\ windows.bmp Threat Removed
File: c:\ windows1.bmp Threat Removed
File: c:\windows\system32\ aver.ico Threat Removed
____________________________

Registry Actions

Registry change: HKEY_USERS\S-1-5-21-1429125506-3924845992-1376771031-500\Software\Google\ Google Pinyin 2->ActiveTime:1464752792 Repaired
Registry change: HKEY_USERS\S-1-5-21-1429125506-3924845992-1376771031-500\Software\Google\ Google Pinyin 2->ActiveSkin:... Repaired
Registry change: HKEY_USERS\S-1-5-21-1429125506-3924845992-1376771031-500\Software\Microsoft\Windows\CurrentVersion\ Run->Ann .exe No Action Required
____________________________

System Settings Actions

Event: Process start (Performed by f:\norton样本\临时收集\ann .exe, PID:6364) No action taken
(Performed by f:\norton样本\临时收集\ann .exe, PID:6364) No action taken
Event: Process start: c:\Windows\System32\ shutdown.exe, PID:5148 (Performed by f:\norton样本\临时收集\ann .exe, PID:6364) No action taken
Event: Process start: f:\norton样本\临时收集\ ann .exe, PID:6364 (Performed by f:\norton样本\临时收集\ann .exe, PID:6364) No action taken
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

请叫我德玛西亚

胖福 发表于 2016-6-1 11:49
Filename: ann .exe
Threat name: SONAR.Heuristic.144Full Path: Not Available

没防住？ 怎么图标都变了

胖福

请叫我德玛西亚 发表于 2016-6-1 12:12
没防住？ 怎么图标都变了

还行，除了图标变了和被关机外，没啥问题！