CryptoLocker Virus

Dolby123

https://virustotal.com/en/file/9 ... 921d3230f/analysis/

SHA256:        9b37f8de327b7cd87bcf57b5fca39939b7c90ad7acedc118c46634b921d3230f
File name:        plbxelat.exe
Detection ratio:        5 / 56
Analysis date:        2016-12-02 13:40:13 UTC ( 5 minutes ago )

[mw_shl_code=css,true]Invincea        worm.win32.secrar.a        20161202
Baidu        Win32.Trojan.WisdomEyes.16070401.9500.9763        20161202
Kaspersky        UDS:DangerousObject.Multi.Generic        20161202
CrowdStrike Falcon (ML)        malicious_confidence_100% (W)        20161024
Qihoo-360        HEUR/QVM42.0.0000.Malware.Gen        20161202[/mw_shl_code]

a445441

微点拦截

诸葛亮

Filename: pfogpqas.exe
Threat name: SONAR.Heuristic.154Full Path: Not Available

____________________________

____________________________


On computers as of 
2016/12/2 at 21:55:09

Last Used 
2016/12/2 at 21:55:09

Startup Item 
No

Launched 
Yes

SONAR Protection monitors for suspicious program activity on your computer.


____________________________


pfogpqas.exe Threat name: SONAR.Heuristic.154
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media

Source File:
pfogpqas.exe

____________________________

File Actions

File: c:\users\m\desktop\pfogpqas\ pfogpqas.exe Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ effrontery.dll No Action Required
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ _hashlib.py Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ shlguid.h Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ castoff.yab Threat Removed
____________________________

System Settings Actions

Event: Process start (Performed by c:\users\m\desktop\pfogpqas\pfogpqas.exe, PID:5832) No action taken
Event: PE file creation: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ effrontery.dll (Performed by c:\users\m\desktop\pfogpqas\pfogpqas.exe, PID:5832) No action taken
Event: Process start: c:\users\m\desktop\pfogpqas\ pfogpqas.exe, PID:5832 (Performed by c:\users\m\desktop\pfogpqas\pfogpqas.exe, PID:5832) No action taken
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

心醉咖啡

毒霸扫描miss

心痛的伤不起

avg

"";"IDP.Program.D1B0A5C0, C:\Users\555555\Desktop\pfogpqas.exe";"已删除, 已隔离";"文件或目录";"2016/12/2, 22:27:41"
"";", C:\Users\555555\Desktop\pfogpqas.exe";"已阻止该对象";"进程";"2016/12/2, 22:27:41"
"";", C:\Sandbox\555555\DefaultBox\user\current\AppData\Local\Temp\effrontery.dll";"已删除, 已隔离";"文件或目录";"2016/12/2, 22:27:41"
"";", C:\Sandbox\555555\DefaultBox\user\current\AppData\Local\Temp\nswDCEF.tmp\System.dll";"已删除, 已隔离";"文件或目录";"2016/12/2, 22:27:41"
"";", C:\Users\555555\Desktop\pfogpqas.exe";"已阻止该对象";"进程";"2016/12/2, 22:27:41"

BDTS2017扫描miss，双击，ATC杀，已上报

欧阳宣

cylance kill

houtiancheng

AVG1013毒库IDP杀~

猪头无双

FSIS扫描无视了。

每顿需吃三大碗

红伞扫描miss