order.pdf.exe

显示全部楼层 · 发表于 2016-10-17 18:46:52

https://yunpan.lenovo.com/l/L1WKJj

（PW：infected）

KIS：17.10.2016 18.44.38;检测到的对象 ( 文件 ) 已删除;C:\0病毒测试\order.pdf.exe;C:\0病毒测试\order.pdf.exe;HEUR:Trojan.Win32.Generic

显示全部楼层 · 发表于 2016-10-17 18:59:14

显示全部楼层 · 发表于 2016-10-17 19:06:00

avast7.0

显示全部楼层 · 发表于 2016-10-17 19:18:41

Filename: order.pdf.exe
Threat name: Heur.AdvML.BFull Path: c:\users\m\desktop\新建文件夹\order.pdf\order.pdf.exe

____________________________

____________________________

On computers as of
2016/10/17 at 19:16:22

Last Used
2016/10/17 at 19:18:22

Startup Item
No

Launched
No

Threat type: Heuristic Virus. Detection of a threat based on malware heuristics.

____________________________

order.pdf.exe Threat name: Heur.AdvML.B
Locate

Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week ago.

High
This file risk is high.

____________________________

Source: External Media

Source File:
order.pdf.exe

____________________________

File Actions

File: c:\users\m\desktop\新建文件夹\order.pdf\ order.pdf.exe Removed
____________________________

File Thumbprint - SHA:
7a7299b835dd2dfecfdf032cbf658693771218edd0ea79961336b14aaa33b905
File Thumbprint - MD5:
Not available

显示全部楼层 · 发表于 2016-10-17 19:47:49

无压力拦截

显示全部楼层 · 发表于 2016-10-17 19:58:23

毒霸扫描miss

显示全部楼层 · 发表于 2016-10-17 20:18:43

显示全部楼层 · 发表于 2016-10-17 20:37:46

AVG：

扫描：miss；

双击：实机双击，IDP击杀之。

"";"IDP.SMP.15, C:\Users\abori\Desktop\order.pdf.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/10/17, 20:24:06"

"";", C:\Users\abori\Desktop\order.pdf.exe";"Object was blocked";"Process";"2016/10/17, 20:24:06"

"";", C:\Users\abori\Desktop\order.pdf.exe";"Object was blocked";"Process";"2016/10/17, 20:24:06"

"";", C:\USERS\ABORI\APPDATA\LOCAL\TEMP\HOPE.EXEHOPE.EXE";"Object was blocked";"Process";"2016/10/17, 20:24:06"

"";", C:\ProgramData\follow\follow.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/10/17, 20:24:06"

显示全部楼层 · 发表于 2016-10-17 21:37:52

本帖最后由不知道这是剑于 2016-10-17 21:40 编辑

火绒4.0 扫描MISS
虚拟机双击，系统防御拦截成功
操作者：C:\Windows\explorer.exe
命令行：C:\Windows\Explorer.EXE
风险动作：文档扩展名欺骗
可疑文件：C:\Users\Vtest\Desktop\order.pdf.exe
执行命令行："C:\Users\Vtest\Desktop\order.pdf.exe"
用户操作：已阻止

显示全部楼层 · 发表于 2016-10-17 21:38:11

Avira
->TR/Dropper.MSIL.Gen (Cloud)

[可疑文件] order.pdf.exe

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源