希望大神帮忙分析一下

呼啸风影

VT上一半报毒，一半不报，很懵逼。求助大神

ELOHIM

SCEP > bitrep.b

和泉纱雾

扫描不报

断簪

卡巴不杀

MrDeep

FS UA

aboringman

看VT上面的报法基本上都偏向Hacktool，个人觉得没有问题。

安全守护者

分析任务

分析类型

虚拟机标签

开始时间

结束时间

持续时间

文件 (Windows)

win7-sp1-x64-hpdapp01-12017-11-18 20:38:302017-11-18 20:40:58

148 秒

魔盾分数
10.0Malicious病毒

---

文件详细信息

文件名	Foxit.PhantomPDF.Business.v9.0.x-patch.exe
文件大小	65024 字节
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	7d4ab169afe82175e211f5eef26cfd0e
SHA1	9dc0e7f33d330c6cb0e08f95d19e2707358067cd
SHA256	f94066fc9dd5a07f429b8ceb18e6d7b11706b53d5d30e554df7663a3b6a9b07f
SHA512	82ad89c6d602321c7b43ab765469b44923009fcafac932fb53f258a5c3ac3d0dda522b4c2aa9e4b19a6cfcab4f94ead311fbb0657473334326d85471513a6428
CRC32	EB29BB36
Ssdeep	1536:oxcqJRfbYJqClCgFA6FgMWXZsGlq1WunDQw:DmdClx7Fg/sCq1WuM
Yara	IsPE32 - IsWindowsGUI - IsPacked - Entropy Check HasRichSignature - Rich Signature Check Safeguard_103_Simonzh - without_attachments - Rule to detect the no presence of any attachment without_images - Rule to detect the no presence of any image without_urls - Rule to detect the no presence of any url win_files_operation - Affect private profile
	样本下载

---

特征低危险等级 中危险等级 高危险等级二进制文件可能包含加密或压缩数据
section: name: .rsrc, entropy: 7.98, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0000f200, virtual_size: 0x0000f038

异常的二进制特征
anomaly: Actual checksum does not match that reported in PE header

文件已被至少十个VirusTotal上的反病毒引擎检测为病毒
MicroWorld-eScan: Trojan.Generic.22589788
CAT-QuickHeal: Riskware.Dupatcher.A4
McAfee: Artemis!7D4AB169AFE8
Cylance: Unsafe
K7GW: Trojan ( 0040f3a51 )
K7AntiVirus: Trojan ( 0040f3a51 )
Invincea: heuristic
Baidu: Win32.Trojan.Generic.f
F-Prot: W32/Agent.KFY
Symantec: Trojan.Gen.2
ESET-NOD32: a variant of Win32/HackTool.Patcher.AD potentially unsafe
TrendMicro-HouseCall: TROJ_GEN.R002C0OK617
Paloalto: generic.ml
GData: Trojan.Generic.22589788
BitDefender: Trojan.Generic.22589788
ViRobot: Trojan.Win32.Agent.754688.B
SUPERAntiSpyware: Hack.Tool/Gen-Patcher
Avast: Win32:Malware-gen
Ad-Aware: Trojan.Generic.22589788
Sophos: Generic Patcher (PUA)
Comodo: TrojWare.Win32.Agent.WFN
F-Secure: Trojan.Generic.22589788
VIPRE: Trojan.Win32.Agent.wfn (v)
TrendMicro: TROJ_GEN.R002C0OK617
McAfee-GW-Edition: BehavesLike.Win32.MultiPlug.kc
Emsisoft: Trojan.Generic.22589788 (B)
SentinelOne: static engine - malicious
Cyren: W32/Agent.EWQQ-1275
Jiangmin: Trojan.Heur.tw
Webroot: W32.Hacktool.Gen
Antiy-AVL: RiskWare[RiskTool]/Win32.Patcher
Endgame: malicious (high confidence)
Arcabit: Trojan.Generic.D158B15C
AegisLab: Troj.Generic!c
ALYac: Trojan.Generic.22589788
AVware: Trojan.Win32.Agent.wfn (v)
MAX: malware (ai score=100)
Malwarebytes: HackTool.FilePatch
Yandex: Riskware.HackTool!LT2poWNG63M
eGambit: HackTool.Generic
Fortinet: Riskware/GamePatcher
AVG: Win32:Malware-gen
Cybereason: malicious.33d330
Panda: Trj/CI.A
CrowdStrike: malicious_confidence_70% (W)

---

运行截图

---

访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

域名解析 (可点击查询WPING实时安全评级)

无域名信息.

j2016

红伞安全

bambooslip

安天也报黑客工具

引领五基生活

WD不杀