精睿样本测试（16.6.22）

狐狸糊涂

BD杀28，余21，我也不知道为什么

[mw_shl_code=css,true]D:\2016.6.22\04.vir Trojan.GenericKD.3311345 Deleted
D:\2016.6.22\22.vir Trojan.Generic.16269598 Deleted
D:\2016.6.22\40.vir=>xl=>embeddings=>oleObject1.bin=>bmiotmcyitomy_Num_34318.exe Trojan.GenericKD.3315520 Deleted
D:\2016.6.22\31.vir Generic.JS.DownloaderX.FFD0956D Deleted
D:\2016.6.22\41.vir Trojan.GenericKD.3317982 Deleted
D:\2016.6.22\05.vir Trojan.GenericKD.3316281 Deleted
D:\2016.6.22\23.vir Trojan.GenericKD.3314721 Deleted
D:\2016.6.22\50.vir Trojan.GenericKD.3308829 Deleted
D:\2016.6.22\14.vir Trojan.GenericKD.3317722 Deleted
D:\2016.6.22\32.vir W97M.Downloader.DLD Disinfected
D:\2016.6.22\10.vir=>Documento Corregido 13 junio de 2016.exe Gen:Variant.Midie.30460 Moved to Quarantine
D:\2016.6.22\18.vir Generic.MSIL.Bladabindi.78557C60 Deleted
D:\2016.6.22\47.vir Trojan.GenericKD.3304289 Deleted
D:\2016.6.22\29.vir W97M.Downloader.DLK Disinfected
D:\2016.6.22\01.vir=>(ZIP Sfx o)=>done.exe Trojan.GenericKD.3311326 Moved to Quarantine
D:\2016.6.22\28.vir=>(Quarantine-6) Gen:Variant.Razy.56712 Deleted
D:\2016.6.22\17.vir=>word\vbaProject.bin W97M.Downloader.CXJ Disinfected
D:\2016.6.22\26.vir Trojan.GenericKD.3311641 Deleted
D:\2016.6.22\24.vir Gen:Variant.Zusy.197405 Deleted
D:\2016.6.22\42.vir Gen:Variant.Razy.70833 Deleted
D:\2016.6.22\48.vir=>(RAR Sfx o)=>New AutoIt v3 Script.exe Trojan.Generic.17208777 Moved to Quarantine
D:\2016.6.22\07.vir Trojan.GenericKD.3329560 Deleted
D:\2016.6.22\25.vir Gen:Heur.MSIL.Krypt.2 Deleted
D:\2016.6.22\39.vir=>(RAR Sfx o)=>yuyvftmtrdc_Num18694.doc=>(INFECTED_JS) JS:Trojan.Script.DIB Moved to Quarantine
D:\2016.6.22\11.vir=>(INFECTED_JS) JS:Trojan.Script.DIB Deleted
D:\2016.6.22\34.vir Gen:Variant.Strictor.108744 Deleted
D:\2016.6.22\12.vir Trojan.GenericKD.3331272 Deleted
D:\2016.6.22\49.vir=>transfer copy.exe Gen:Variant.Symmi.63116 Moved to Quarantine
[/mw_shl_code]

T.Yoshiyuki

fzshot 发表于 2016-6-22 09:29
FSCS
[mw_shl_code=css,true]结果: 找到 21 恶意软件
Trojan.GenericKD.3311345 (病毒)

才21个……
全是BD引擎报的 当然FS自家启发引擎丧失存在感也不是一天两天了

T.Yoshiyuki

AVG kill 26x



沙盘运行48号，衍生物被杀




沙盘运行其他exe时IDP无反应

T.Yoshiyuki

叶无道 发表于 2016-6-22 09:24
小红伞pro 32

额……这应该是29个吧

XZ8SM7Sx0bVkoUV

火绒 20/50

叶无道

T.Yoshiyuki 发表于 2016-6-22 09:48
额……这应该是29个吧

哎，你都不看修复的啊

欧阳宣

gdata检测30，修复2个
[mw_shl_code=css,true]Analysis performed in full: 2016-06-21 10:32:08 PM
    50 files checked
    30 infected files detected
    0 suspicious files found


Object: 07.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Trojan.GenericKD.3329560 (Engine A)

Object: 04.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Trojan.GenericKD.3311345 (Engine A)

Object: 05.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Trojan.GenericKD.3316281 (Engine A)

Object: 12.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Trojan.GenericKD.3331272 (Engine A)

Object: 14.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Trojan.GenericKD.3317722 (Engine A)

Archive: 10.vir
        Path: D:\Virus\2016.6.22
        Status: Virus, file deleted
        Virus: Gen:Variant.Midie.30460 (Engine A)
Object: Documento Corregido 13 junio de 2016.exe
        In archive: D:\Virus\2016.6.22\10.vir
        Status: Virus detected
        Virus: Gen:Variant.Midie.30460

Archive: 17.vir
        Path: D:\Virus\2016.6.22
        Status: Virus, file deleted
        Virus: W97M.Downloader.CXJ (Engine A)
Object: word\vbaProject.bin
        In archive: D:\Virus\2016.6.22\17.vir
        Status: Virus detected
        Virus: W97M.Downloader.CXJ

Object: 20.vir
        Path: D:\Virus\2016.6.22
        Status: File moved to quarantine
        Virus: Script.Trojan-Downloader.Agent.PP (Engine B)

Object: 22.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Trojan.Generic.16269598 (Engine A)

Object: 23.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Trojan.GenericKD.3314721 (Engine A)

Archive: 11.vir
        Path: D:\Virus\2016.6.22
        Status: Virus, file deleted
        Virus: JS:Trojan.Script.DIB (Engine A)
Object: (INFECTED_JS)
        In archive: D:\Virus\2016.6.22\11.vir
        Status: Virus detected
        Virus: JS:Trojan.Script.DIB

Object: 18.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Generic.MSIL.Bladabindi.78557C60 (Engine A)

Object: 25.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Gen:Heur.MSIL.Krypt.2 (Engine A)

Object: 26.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Trojan.GenericKD.3311641 (Engine A)

Archive: 28.vir
        Path: D:\Virus\2016.6.22
        Status: Virus, file deleted
        Virus: Gen:Variant.Razy.56712 (Engine A)
Object: (Quarantine-6)
        In archive: D:\Virus\2016.6.22\28.vir
        Status: Virus detected
        Virus: Gen:Variant.Razy.56712

Object: 24.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Gen:Variant.Zusy.197405 (Engine A)

Object: 31.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Generic.JS.DownloaderX.FFD0956D (Engine A)

Object: 32.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: W97M.Downloader.DLD (Engine A)

Object: 34.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Gen:Variant.Strictor.108744 (Engine A)

Object: 29.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: W97M.Downloader.DLK (Engine A)

Archive: 39.vir
        Path: D:\Virus\2016.6.22
        Status: Virus, file deleted
        Virus: JS:Trojan.Script.DIB (Engine A)
Object: (RAR Sfx o)=>yuyvftmtrdc_Num18694.doc=>(INFECTED_JS)
        In archive: D:\Virus\2016.6.22\39.vir
        Status: Virus detected
        Virus: JS:Trojan.Script.DIB

Object: 41.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Trojan.GenericKD.3317982 (Engine A)

Object: 42.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Gen:Variant.Razy.70833 (Engine A)

Archive: 46.vir
        Path: D:\Virus\2016.6.22
        Status: Virus, file deleted
        Virus: Java.Trojan.Agent.45PW5Z (Engine B)
Object: cmoqrtuu.class
        In archive: D:\Virus\2016.6.22\46.vir
        Status: Virus detected
        Virus: Java.Trojan.Agent.45PW5Z

Archive: 40.vir
        Path: D:\Virus\2016.6.22
        Status: Virus, file deleted
        Virus: Trojan.GenericKD.3315520 (Engine A)
Object: xl/embeddings/oleObject1.bin=>bmiotmcyitomy_Num_34318.exe
        In archive: D:\Virus\2016.6.22\40.vir
        Status: Virus detected
        Virus: Trojan.GenericKD.3315520

Archive: 49.vir
        Path: D:\Virus\2016.6.22
        Status: Virus, file deleted
        Virus: Gen:Variant.Symmi.63116 (Engine A)
Object: transfer copy.exe
        In archive: D:\Virus\2016.6.22\49.vir
        Status: Virus detected
        Virus: Gen:Variant.Symmi.63116

Object: 47.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Trojan.GenericKD.3304289 (Engine A)

Archive: 01.vir
        Path: D:\Virus\2016.6.22
        Status: Virus, file deleted
        Virus: Trojan.GenericKD.3311326 (Engine A)
Object: (ZIP Sfx o)=>done.exe
        In archive: D:\Virus\2016.6.22\01.vir
        Status: Virus detected
        Virus: Trojan.GenericKD.3311326

Object: 50.vir
        Path: D:\Virus\2016.6.22
        Status: Virus removed
        Virus: Trojan.GenericKD.3308829 (Engine A)

Archive: 48.vir
        Path: D:\Virus\2016.6.22
        Status: Virus, file deleted
        Virus: Trojan.Generic.17208777 (Engine A)
Object: (RAR Sfx o)=>New AutoIt v3 Script.exe
        In archive: D:\Virus\2016.6.22\48.vir
        Status: Virus detected
        Virus: Trojan.Generic.17208777[/mw_shl_code]

900703

avast! Kill 32

360 AntiVirus 6.0 Kill 24


卡巴斯基Kill 31


F-Secure Protection Kill 27


ESET ESS Kill 42

T.Yoshiyuki

叶无道 发表于 2016-6-22 10:16
哎，你都不看修复的啊

不好意思 脑子秀逗了
记得你已经跟我说过一遍了

fzshot

T.Yoshiyuki 发表于 2016-6-21 19:39
才21个……
全是BD引擎报的 当然FS自家启发引擎丧失存在感也不是一天两天了

FS的启发引擎貌似一直没什么存在感啊。。。DG倒是不错的~