【第二弹28个可疑文件】人脑识别可疑文件

claudgreen

【第二弹28个可疑文件】链接: http://pan.baidu.com/s/1dFxcTtZ 密码: t66u

SHA256:        f0cb4f2b3dacb3d6aad8edb98447637a0c36183c3685b5b246b888f8eef2e8ae
File name:        virs.rar
Detection ratio:        29 / 55
Analysis date:        2017-02-17 01:59:06 UTC ( 0 minutes ago )

https://www.virustotal.com/en/fi ... nalysis/1487296746/

----------------------------------------------------------------------------------------------------------
【第一弹】链接: http://pan.baidu.com/s/1jIc9MRG 密码: h66w

Iyyesms.exe Portable Executable 12051888 Bytes
SHA256 4abd26e8e31617d6664f3a98cd3c6fc3b2341ea1ae663780ea76b9b4f3e7f7e4
Datetime 2016-08-14 20:56:08
Detection ratio Unknown when this report was generated


Antivirus scan for eb61b7f8537f486335b3e8135970072595fdda6dd0e819ffbcd7feaa0777567c at UTC - VirusTotal https://www.virustotal.com/en/fi ... analysis/1487215861






腾讯哈勃分析了一个最可疑对象：

https://habo.qq.com/file/showdetail?pk=ADYGb11sB2QIMVs7



基本信息
文件名称：       
Iyyesms.exe
MD5：        87f8f1661f3d90983269ca3a86627734
文件类型：        EXE
上传时间：        2017-02-15 09:57:39
出品公司：        Thunder Network
版本：        1.0.0.1---1
壳或编译器信息：        PACKER:UPolyX v0.5
关键行为
行为描述：        探测 Virtual PC是否存在
详情信息：       
N/A
行为描述：        直接获取CPU时钟
详情信息：       
EAX = 0x131b0148, EDX = 0x00001197
EAX = 0x131b0194, EDX = 0x00001197
EAX = 0x131b01e0, EDX = 0x00001197
EAX = 0x131b022c, EDX = 0x00001197
EAX = 0x131b0278, EDX = 0x00001197
EAX = 0x131b02c4, EDX = 0x00001197
EAX = 0x131b0310, EDX = 0x00001197
EAX = 0x131b035c, EDX = 0x00001197
EAX = 0x131b03a8, EDX = 0x00001197
EAX = 0x131b03f4, EDX = 0x00001197
EAX = 0x87a730ea, EDX = 0x0000119b
EAX = 0x87a73136, EDX = 0x0000119b
EAX = 0x87a73182, EDX = 0x0000119b
EAX = 0x87a731ce, EDX = 0x0000119b
EAX = 0x87a7321a, EDX = 0x0000119b
行为描述：        尝试打开调试器或监控软件的驱动设备对象
详情信息：       
\??\SICE
\??\SIWVID
\??\NTICE
行为描述：        自删除
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe
行为描述：        打开注册表_检测虚拟机相关
详情信息：       
\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__
行为描述：        创建系统服务
详情信息：       
[服务创建成功]: Thunqwk Programc, C:\Program Files\Windows NT\Iyyesms.exe
行为描述：        获取TickCount值
详情信息：       
TickCount = 5443796, SleepMilliseconds = 5000.
TickCount = 5441265, SleepMilliseconds = 500.
TickCount = 5441281, SleepMilliseconds = 500.
TickCount = 5441296, SleepMilliseconds = 500.
TickCount = 5456031, SleepMilliseconds = 15000.
TickCount = 5456093, SleepMilliseconds = 15000.
TickCount = 5441282, SleepMilliseconds = 1.
TickCount = 5441376, SleepMilliseconds = 1.
TickCount = 5441751, SleepMilliseconds = 1.
TickCount = 5444907, SleepMilliseconds = 1.
行为描述：        查询注册表_检测虚拟机相关
详情信息：       
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
行为描述：        查找指定内核模块
详情信息：       
lstrcmpiA: ntice.sys <------> ntkrnlpa.exe Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> hal.dll Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> KDCOM.DLL Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> BOOTVID.dll Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> ACPI.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> WMILIB.SYS Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> pci.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> isapnp.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> compbatt.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> BATTC.SYS Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> intelide.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> PCIIDEX.SYS Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> MountMgr.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> ftdisk.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> dmload.sys Des: SoftICE驱动
行为描述：        查找反病毒常用工具窗口
详情信息：       
NtUserFindWindowEx: [Class,Window] = [OLLYDBG,]
NtUserFindWindowEx: [Class,Window] = [GBDYLLO,]
NtUserFindWindowEx: [Class,Window] = [pediy06,]
NtUserFindWindowEx: [Class,Window] = [FilemonClass,]
NtUserFindWindowEx: [Class,Window] = [,File Monitor - Sysinternals: www.sysinternals.com]
NtUserFindWindowEx: [Class,Window] = [PROCMON_WINDOW_CLASS,]
NtUserFindWindowEx: [Class,Window] = [,Process Monitor - Sysinternals: www.sysinternals.com]
NtUserFindWindowEx: [Class,Window] = [RegmonClass,]
NtUserFindWindowEx: [Class,Window] = [,Registry Monitor - Sysinternals: www.sysinternals.com]
行为描述：        VMWare特殊指令检测虚拟机
详情信息：       
N/A

linzh

ESET下载拦截

[mw_shl_code=css,true]时间;扫描程序;对象类型;对象;威胁;操作;用户;信息;哈希;此处首次所见
2017/2/14 21:52:15;HTTP 过滤器;文件;http://nj01ct01.baidupcs.com/fil ... ;to=njhb&fm=Yan,B,U,ny&sta_dx=8674249&sta_cs=2&sta_ft=zip&sta_ct=0&sta_mt=0&fm2=Yangquan,B,U,ny&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=00008da5c23c59520259c9fd027900a53990&sl=81068110&expires=8h&rt=sh&r=258103483&mlogid=1053948540608875494&vuk=1595516054&vbdid=2086257667&fin=VIRS(1).zip&fn=VIRS(1).zip&uta=0&rtype=1&iv=0&isw=0&dp-logid=1053948540608875494&dp-callid=0.1.1&csl=10&csign=Vf2+NSFkBIujvS+lCgkkpkyUeVY=&by=flowserver;多个威胁;连接中断;LINZH-NOTEBOOK\linzh;通过应用程序访问 web 时检测到威胁: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe.;;
[/mw_shl_code]

Eset小粉絲

[mw_shl_code=css,true]VIRS(1).zip
    [0] Archive type: ZIP
    --> 401.vbs
        [DETECTION] Contains recognition pattern of the HTML/Rce.Gen3 HTML script virus
        [WARNING]   Infected files in archives cannot be repaired
    --> 410.vbs
        [DETECTION] Contains recognition pattern of the HTML/Rce.Gen3 HTML script virus
        [WARNING]   Infected files in archives cannot be repaired
    --> xpcd.zip
        [1] Archive type: ZIP
      --> 410.vbs
          [DETECTION] Contains recognition pattern of the HTML/Rce.Gen3 HTML script virus
          [WARNING]   Infected files in archives cannot be repaired
      --> 401.vbs
          [DETECTION] Contains recognition pattern of the HTML/Rce.Gen3 HTML script virus
          [WARNING]   Infected files in archives cannot be repaired[/mw_shl_code]

Dolby123

avast

轩夏

MSE 断网
401.vbs
Infected: TrojanDownloader:HTML/Adodb.gen!A [generic]
410.vbs
Infected: TrojanDownloader:HTML/Adodb.gen!A [generic]
xpcd.zip->410.vbs
Infected: TrojanDownloader:HTML/Adodb.gen!A [generic]
xpcd.zip->401.vbs
Infected: TrojanDownloader:HTML/Adodb.gen!A [generic]

claudgreen

linzh 发表于 2017-2-15 10:54
ESET下载拦截

[mw_shl_code=css,true]时间;扫描程序;对象类型;对象;威胁;操作;用户;信息;哈希;此处首次 ...

这是下载就报出病毒个数和名字了？

linzh

claudgreen 发表于 2017-2-15 17:35
这是下载就报出病毒个数和名字了？

对啊

claudgreen

linzh 发表于 2017-2-15 23:17
对啊

小绿人什么时候这么牛逼了

a445441

Iyyesms.exe 微点拦截

claudgreen

a445441 发表于 2017-2-16 17:01
Iyyesms.exe 微点拦截

微点的理念值值得尊敬