VBA downloader

Dolby123

ORDER-2691888-7694.doc

Arcabit	HEUR.VBA.Trojan.e	20170510
Avast	Other:Malware-gen [Trj]	20170510
AVware	LooksLike.Macro.Malware.gen!d2 (v)	20170508
ESET-NOD32	VBA/TrojanDownloader.Agent.DEU	20170510
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi	20170510
Sophos	Troj/DocDl-IXI	20170510
Symantec	W97M.Downloader	20170510
TrendMicro	W2KM_DLOADR.YYTAA	20170510
TrendMicro-HouseCall	W2KM_DLOADR.YYTAA	20170510
VIPRE	LooksLike.Macro.Malware.gen!d2 (v)	20170510

Z.exe

Baidu	Win32.Trojan.WisdomEyes.16070401.9500.9964	20170503
CMC	Trojan-Downloader.Win32.Gamarue.2!O	20170510
CrowdStrike Falcon (ML)	malicious_confidence_100% (D)	20170130
Endgame	malicious (high confidence)	20170503
Invincea	backdoor.win32.kasidet.c	20170413
Palo Alto Networks (Known Signatures)	generic.ml	20170510
Qihoo-360	HEUR/QVM10.1.0CE5.Malware.Gen	20170510
Rising	Malware.Heuristic!ET#83% (rdm+)	20170510
Webroot	W32.Trojan.Gen	20170510

挂马url :

hxxp://nachtaktiv.biz/PT-55620674.dokument/
hxxp://tylerleisher.com/13-20-06/INVOICE-3449973-6139/
hxxp://celebrities-staffing.com/INVOICE-8049666-4042/
hxxp://shcsclan.com/13-40-15/Cust-5206651-2927/
hxxp://stenild.net/GMOXW-BHS-91681-DE/
hxxp://dvdvitrini.com/14-00-08/Invoice-8823120-7490
hxxp://debom.com.br/14-40-37/INVOICE-1972083-1477
hxxp://lindsayallikas.com/15-00-07/INVOICE-5760067-5966/
hxxp://debom.com.br/14-40-37/INVOICE-1972083-1477/
hxxp://itsallforphotography.com/15-24-07/INVOICE-4183834-1070
hxxp://gladwynecapital.com/15-26-25/Invoice-0698099-0624/
hxxp://marklyford.com/15-32-26/ORDER-5679913-4651
hxxp://zvarga.com/15-12-07/CUST-9405847-8348/
hxxp://nextgaming.it/15-43-58/Invoice-4161736-2749
hxxp://bitnoots.com/15-36-07/ORDER-7987125-4573
hxxp://macrocephalus.com/14-52-07/CUST-1938488-5959/
hxxp://jagsecurity.co.nz/INVOICE-6692576-2094/
hxxp://bitnoots.com/15-36-07/ORDER-7987125-4573/
hxxp://music111.com/VAQT-DYBC-27274-DE/
hxxp://thebestshot.com/OOIZ-SL-35220-DE/
hxxp://nothingreally.com/Invoice-194489-83545/
hxxp://rareclarity.com/SJCE-ZI-55411-DE/
hxxp://barquegifts.com/14-31-32/INVOICE-5120875-6636/
hxxp://ehowland.com/EQOJP-QA-15626-DE/
hxxp://esportphoto.pl/13-28-07/ORDER-2456898-2968/

心醉咖啡

管家扫描miss

Eset小粉絲

avira
VBA
W2000/Dldr.Agent.HG

z.exe
Detection:        TR/AD.PSLoader.0da597 (Cloud)

a15073324542

Agu

GData -
DOC檔執行後GData攔截觸發的惡意網址

ELOHIM

WIEP SCAN MISS ALL

540923555

ELOHIM 发表于 2017-5-10 23:40
WIEP SCAN MISS ALL

WD现在解压全干掉

轩夏

a445441

微点拦截EXE程序

XZ8SM7Sx0bVkoUV

火绒