RANSOM加壳免杀X1

schumi小粉

卡巴启发。。。。ESET还是挺给力的

https://virusscan.jotti.org/zh-CN/filescanjob/p61js7tgm5

诸葛亮

Filename: 1231.exe
Threat name: SONAR.Heuristic.154Full Path: Not Available

____________________________

____________________________


On computers as of 
2016/11/14 at 17:09:45

Last Used 
2016/11/14 at 17:09:45

Startup Item 
No

Launched 
Yes

SONAR Protection monitors for suspicious program activity on your computer.


____________________________


1231.exe Threat name: SONAR.Heuristic.154
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media

Source File:
winrar.exe

File Created:
1231.exe

____________________________

File Actions

File: c:\users\m\desktop\kk\kk\ 1231.exe Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ mosaic.css Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ feed132472238.xml Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ france.png Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ sunupcuh_bigger.png Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ common.js256844633.x-javascript Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ youtube.png Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ emailme.png Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ outlets.css Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\e0e58bcc\ 428f.tmp Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\e0e58bcc\ 2bb8.tmp Threat Removed
Directory: c:\Sandbox\M\defaultbox\user\current\AppData\Local\Temp\ nst30D.tmp Restart Required
Directory: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ e0e58bcc Threat Removed
____________________________

Network Actions

Event: Network activity (Performed by c:\users\m\desktop\kk\kk\1231.exe, PID:8832) No action taken
____________________________

System Settings Actions

Event: Process start (Performed by c:\users\m\desktop\kk\kk\1231.exe, PID:9948) No action taken
Event: PE file creation: c:\Sandbox\M\defaultbox\user\current\AppData\Local\Temp\nst30D.tmp\ System.dll (Performed by c:\users\m\desktop\kk\kk\1231.exe, PID:9948) No action taken
Event: Process start: c:\users\m\desktop\kk\kk\ 1231.exe, PID:8832 (Performed by c:\users\m\desktop\kk\kk\1231.exe, PID:9948) No action taken
Event: Process start (Performed by c:\users\m\desktop\kk\kk\1231.exe, PID:8832) No action taken
Event: Process start: c:\users\m\desktop\kk\kk\ 1231.exe, PID:9948 (Performed by c:\users\m\desktop\kk\kk\1231.exe, PID:9948) No action taken
Event: Process start: c:\users\m\desktop\kk\kk\ 1231.exe, PID:8832 (Performed by c:\users\m\desktop\kk\kk\1231.exe, PID:8832) No action taken
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

schumi小粉

诸葛亮 发表于 2016-11-14 17:11
Filename: 1231.exe
Threat name: SONAR.Heuristic.154Full Path: Not Available

扫描过了才双击测试的？

fireherman

我是给楼主补图的。

schumi小粉

fireherman 发表于 2016-11-14 17:19
我是给楼主补图的。

等的就是你的图

诸葛亮

schumi小粉 发表于 2016-11-14 17:12
扫描过了才双击测试的？

是的

schumi小粉

诸葛亮 发表于 2016-11-14 17:23
是的

过了B杀，还有sonar，铁壳太讨厌了

心醉咖啡

管家扫描miss

欧阳宣

我现在越来越喜欢手贱拿咖啡双击勒索了

d:\Virus\KK\1231.exe        1        1        Real Protect.gh!59CB3CBE68EF

Eset小粉絲

Avira
->TR/AD.NsisInject.Y (Cloud)