收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › #PACKAGE 0625
1234
返回列表 发新帖
楼主: Jerry.Lin
 收起左侧

[病毒样本] #PACKAGE 0625

[复制链接]
小飞侠.net
发表于 2018-6-26 20:06:11 | 显示全部楼层
本帖最后由 小飞侠.net 于 2018-6-26 20:56 编辑

X-Sec Antivirus ---（Windows 10 Creators Update（Redstone 4）....1803）：

Basic Info:
---------------------
Database Version: 2018.06.24.01
Program Version: 2.1.1.0
Heuristic Engine: Enabled
Cloud Engine: Enabled
Enhanced Mode: Disabled
Backup Before Resolve: Yes
Resolve Threats: Scan only
Scan Priority: Normal
---------------------
Targets:
---------------------
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector
---------------------
2018-06-26 20:54:23 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(10).exe -- [Cloud] Cloud:Trojan.Win32.Infostealer
2018-06-26 20:54:25 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(1).exe -- [Cloud] Cloud:Trojan.Win32.Generic
2018-06-26 20:54:28 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(11).exe -- [Cloud] Cloud:Trojan.Win32.Infostealer
2018-06-26 20:54:30 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(12).exe -- [Cloud] Cloud:Trojan.Win32.LokiBot
2018-06-26 20:54:30 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(14).msi -- [Cloud] Cloud:Trojan.Win32.Injector
2018-06-26 20:54:59 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(13).exe -- [Cloud] Cloud:Trojan.Win32.Generic
2018-06-26 20:55:00 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(3).exe -- [Cloud] Cloud:Trojan.Win32.Emotet
2018-06-26 20:55:06 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(4).exe -- [Cloud] Cloud:Trojan.Win32.Injector
2018-06-26 20:55:10 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(5).exe -- [Cloud] Cloud:Trojan.Win32.Autoit
2018-06-26 20:55:11 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(6).exe -- [Cloud] Cloud:Trojan.Win32.Generic
2018-06-26 20:55:16 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(2).exe -- [Cloud] Cloud:Trojan.Win32.Generic
2018-06-26 20:55:17 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(8).exe -- [Cloud] Cloud:Trojan.Win32.Emotet
2018-06-26 20:55:17 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(9).exe -- [Cloud] Cloud:Trojan.Win32.Generic
2018-06-26 20:55:19 Threat Detected: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(7).exe -- [Cloud] Cloud:Trojan.Win32.LokiBot



   瑞星---（Windows 10 Creators Update（Redstone 4）....1803）：云引擎（开）RDM+引擎（开）     
                瑞星反恶软引擎命令行扫描器（社区交流版）                 


编译于：Sep 22 2017   15:07:50

提示：
  - 本工具供社区交流使用，请勿用于其他用途
  - 本工具没有恶意软件删除、清除、隔离功能
  - 本工具包含开发中的新特性，结果仅供参考

* 命令行中的选项开关：-output-json -log=C:\瑞星RDM+引擎\ScanLog_180626205006.log
* 获取恶软签名库最新版本 ...
* 下载恶软签名库配置文件 ...
* 创建恶软签名库升级组件 ...
* 计算并下载增量文件 ...
* 升级恶软签名库 ...
* 恶软签名库升级成功
* 扫描目标 : (1) C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector

* 加载恶软签名库： C:\瑞星RDM+引擎/malware.rmd
* 恶软签名库加载成功，发布序号为 4479
* 读取恶软签名库配置 ...
* 云辅助扫描组件初始化失败.
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
* 初始化引擎环境 ...
扫描开始: Tue Jun 26 20:50:29 2018

{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE0625Injector\\PACKAGE0625\\0625(14).msi","type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE0625Injector\\PACKAGE0625\\0625(12).exe","infect":{"engine":"md5","signature":"bWQ1OijIRuaCAsKGHbZFJ4wC/1k","threat":"Backdoor.Androm!8.113"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE0625Injector\\PACKAGE0625\\0625(11).exe","infect":{"engine":"md5","signature":"bWQ1OoaCHVKAp1skwqNE+tJdAtA","threat":"Trojan.Injector!8.C4"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE0625Injector\\PACKAGE0625\\0625(1).exe","infect":{"engine":"md5","signature":"bWQ1OupeJ4QrYShpVKUy9DiETSo","threat":"Backdoor.Androm!8.113"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE0625Injector\\PACKAGE0625\\0625(3).exe","infect":{"engine":"md5","signature":"bWQ1Ool1v+IPS5VlvlxxZctlo0Q","threat":"Trojan.GenKryptik!8.AA55"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE0625Injector\\PACKAGE0625\\0625(4).exe","infect":{"engine":"md5","signature":"bWQ1OgkcJwjIHYKKmYJVCaUP9W8","threat":"Malware.Undefined!8.C"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE0625Injector\\PACKAGE0625\\0625(10).exe","infect":{"engine":"md5","signature":"bWQ1Oogciwa6EZ6BvLIp0T81PEQ","threat":"Trojan.GenKryptik!8.AA55"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE0625Injector\\PACKAGE0625\\0625(2).exe","infect":{"engine":"md5","signature":"bWQ1OuVyuYwFQaYnRKW4jeikj5A","threat":"Trojan.Agent!8.B1E"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE0625Injector\\PACKAGE0625\\0625(13).exe","infect":{"engine":"md5","signature":"bWQ1OhlE7xzy06yQ1hR1ff/RvN0","threat":"Trojan.Tinukebot!8.E873"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE0625Injector\\PACKAGE0625\\0625(8).exe","infect":{"engine":"md5","signature":"bWQ1OmZkkMxksdxDugw2CHGvQEU","threat":"Trojan.Emotet!8.B95"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE0625Injector\\PACKAGE0625\\0625(6).exe","infect":{"engine":"md5","signature":"bWQ1Or6D5/sWdZOBUlMrLm3w/R8","threat":"Ransom.Enestedel!8.E513"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE0625Injector\\PACKAGE0625\\0625(9).exe","infect":{"engine":"md5","signature":"bWQ1Ojol1fKvedIAAfMMs78ZuTM","threat":"Backdoor.Agent!8.C5D"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE0625Injector\\PACKAGE0625\\0625(5).exe","infect":{"engine":"md5","signature":"bWQ1Ou1NfmUF8s9jOd9sWTloaZk","threat":"Trojan.Autoit!8.150"},"type":"scan"}
{"filename":"C:\\Users\\Admin\\Desktop\\AVtest100\\PACKAGE0625Injector\\PACKAGE0625\\0625(7).exe","infect":{"engine":"md5","signature":"bWQ1OiX5KxnT9jeeUCr+JXcho44","threat":"Backdoor.Noancooe!8.176"},"type":"scan"}

扫描结束: Tue Jun 26 20:50:30 2018

总扫描耗时: 0:0:795(m:s:ms)
总扫描对象: 14
总扫描文件: 14
总恶意文件: 13
有效检出率: 92.86%---？？？感觉又。。。



Emsisoft Emergency Kit - 版本 2018.4
上次更新： 2018-06-26 20:44:53
用户帐号： TECLAST\Admin
电脑名称： TECLAST
操作系统版本： Windows 10 x64

Emsisoft Emergency Kit 绿色免费版
(已开启)加入 Emsisoft 云、更新源：测试版
    Bitdefender（B）+Emsisoft（A） 双引擎

扫描设置：

扫描方式： 自定义扫描
对象： Rootkits, C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\

检测流氓软件(PUPs)： On
扫描压缩包： On
扫描邮件存档： Off
ADS数据流： On
文件扩展名过滤： Off
直接磁盘访问： Off

扫描开始于：        2018-06-26 20:46:59
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(6).exe -> (NSIS o) -> zlib_nsis0003         发现风险： Trojan.GenericKD.31008955 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(5).exe -> (AutoIT o) -> (AutoIT Script) -> (unicode)         发现风险： AIT:Trojan.Nymeria.219 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(5).exe -> (AutoIT Script) -> (unicode)         发现风险： AIT:Trojan.Nymeria.219 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(11).exe         发现风险： Trojan.Injector (A) [294429]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(12).exe         发现风险： Trojan.Injector (A) [294429]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(10).exe         发现风险： Trojan.GenericKD.31009565 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(3).exe         发现风险： Trojan.Emotet (A) [294317]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(1).exe         发现风险： Trojan.GenericKD.40298134 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(14).msi -> (Embedded EXE)         发现风险： Trojan.Injector (A) [294429]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(4).exe         发现风险： Trojan.GenericKD.31008824 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(7).exe         发现风险： Trojan.Injector (A) [294430]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(8).exe         发现风险： Trojan.Emotet (A) [294427]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(9).exe         发现风险： Trojan.GenericKD.31010453 (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(2).exe         发现风险： Trojan.Agent.DAOR (B) [krnl.xmd]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(13).exe         发现风险： Trojan.Agent.DAOP (B) [krnl.xmd]

已扫描        608
发现        15

扫描完成后：        2018-06-26 20:47:14
扫描时间：        0:00:15



ESET Smart Security Premium 64位（高级启发式（Y）+压缩文件（Y）+自解压加壳（Y）+DNA智能签名（Y）++（Windows 10 Creators Update（Redstone 4）....1803）：

日志
正在扫描日志
检测引擎的版本: 17615P (20180626)
日期: 2018-06-26  时间: 20:39:45
已扫描的磁盘、文件夹和文件: C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(1).exe - MSIL/Kryptik.OPT 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(10).exe - Win32/GenKryptik.CDNT 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(11).exe - Win32/Injector.DYVR 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(12).exe - Win32/Injector.DYVR 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(14).msi > MSI > Binary._D7D112F049BA1A655B5D9A1D0702DEE5 - Win32/Injector.DYVR 特洛伊木马 的变种 - 扫描完成后再选择处理方式
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(2).exe - Win32/Agent.ZLP 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(3).exe - Win32/Kryptik.GICB 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(4).exe - Win32/Kryptik.GICA 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(5).exe > UPX v13_m8 > AUTOIT > script.bin - Win32/Autoit.CO 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(5).exe > AUTOIT - 正常
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(6).exe > NSIS > dings.dll - Win32/Injector.DYVS 特洛伊木马 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(7).exe - Win32/Injector.DXTA 特洛伊木马 的变种 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(8).exe - Win32/Emotet.BK 特洛伊木马 - 通过删除清除 [1]
C:\Users\Admin\Desktop\AVtest100\PACKAGE0625Injector\PACKAGE0625\0625(9).exe - Win32/PSW.Fareit.L 特洛伊木马 - 通过删除清除 [1]
已扫描的对象数: 100
发现的威胁数: 13
已清除对象数: 13
完成时间: 20:40:21  总扫描时间: 36 秒 (00:00:36)

备注:
[1] 由于对象中仅包含病毒主体，因此已被删除。



火绒安全---（ Windows 7 Ultimate with SP1 简体中文旗舰版....）：部分未知文件已发送到seclab@huorong.cn，等处理中。。。

病毒库：2018-06-26 15:02
开始时间：2018-06-26 20:04
总计用时：00:00:15
扫描对象：120个
扫描文件：14个
发现风险：13个
已处理风险：0个
发现系统修复项：0个
处理系统修复项：0个

病毒详情

风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(1).exe, 病毒名：Trojan/Generic!5015B83F17375A31, 病毒ID：[5015b83f17375a31], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(10).exe, 病毒名：Trojan/Generic!A2563702EA4ED0AF, 病毒ID：[a2563702ea4ed0af], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(12).exe, 病毒名：HEUR:VirTool/VB.Obfuscator.gen!A, 病毒ID：[636e99dfed83873b], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(14).msi, 病毒名：HEUR:VirTool/VB.Obfuscator.gen!A, 病毒ID：[636e99dfed83873b], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(3).exe, 病毒名：Trojan/Generic!38CCD40C43B7BF76, 病毒ID：[38ccd40c43b7bf76], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(2).exe, 病毒名：Trojan/Generic!E8BCFFEED50BAC25, 病毒ID：[e8bcffeed50bac25], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(4).exe, 病毒名：HVM:VirTool/Obfuscator.gen!A, 病毒ID：[b27d4294cde6a1ec], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(6).exe, 病毒名：Trojan/Generic!FC470FB710A7F9BB, 病毒ID：[fc470fb710a7f9bb], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(7).exe, 病毒名：Trojan/Generic!54776283F10039A9, 病毒ID：[54776283f10039a9], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(8).exe, 病毒名：Trojan/Generic!8F0B2637E56E2E3C, 病毒ID：[8f0b2637e56e2e3c], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(9).exe, 病毒名：Trojan/Generic!683410ACE7F7771F, 病毒ID：[683410ace7f7771f], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(11).exe, 病毒名：HEUR:VirTool/VB.Obfuscator.gen!A, 病毒ID：[636e99dfed83873b], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(5).exe, 病毒名：Trojan/AutoIT.Injector.h, 病毒ID：[982e885c633ce320], 处理结果：已忽略


文件名称: C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625.rar
文件大小: 12.7 MB (13,395,283 字节)
修改时间: 2018年06月26日，20:02:43
MD5: 2AE38F64A2AF272CC2D7579765C1106A
SHA1: 3D13DAA2D182F3FA6480453904F9D5800370261B
SHA256: 4189E15FE7561F83CE49153822EB27CA957D26CBE436BD2C4AF784395B606FC2
SHA512: 706DB993E3AA535D785AADEC1FD02223EBED8864DF63F0C1E9C20A1CB094C6E4271CE07FBD491F2F5D3F962B7AAA84794F8F4542EC8F5F972D8FDDC32D91A5E5
CRC32: 6CC54BDA
计算时间: 0.34s
Dr.Web CureIt! 简体中文绿色免费版---（ Windows 7 Ultimate with SP1 简体中文旗舰版....）：

-----------------------------------------------------------------------------
Start scanning
-----------------------------------------------------------------------------
Command line used:-rpcep:\pipe\3212F8A4C -rpcpr:np

Limit the use of the computer resources to 100%
Instances used for this session: 10
Object(s) to scan:
- C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625


>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(14).msi is OLE container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(14).msi - container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(10).exe - infected with Trojan.PWS.Stealer.1932
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(10).exe - infected
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(6).exe is NSIS container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(6).exe - container
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(8).exe - packed by FLY-CODE
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(11).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(3).exe - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(1).exe is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(1).exe\data001 is NET container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(12).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(4).exe - infected with Trojan.PWS.Stealer.23949
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(4).exe - infected
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(1).exe\data002 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(1).exe\data003 is NET container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(1).exe\data004 is NET container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(1).exe - container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(9).exe - infected with Trojan.Inject3.4015
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(9).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(7).exe - infected with BackDoor.Tordev.976
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(7).exe - infected
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(5).exe - packed by UPX
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(5).exe - infected with Trojan.DownLoader26.53894
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(5).exe - infected
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(2).exe - packed by PESTUB
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(2).exe - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(13).exe is INNO SETUP container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(13).exe\Script2.bin is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(13).exe\{tmp}\libeay32.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(13).exe\{tmp}\libevent-2-0-5.dll is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(13).exe\{tmp}\libevent_extra-2-0-5.dll - packed by FLY-CODE
>>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(13).exe\{tmp}\libevent_extra-2-0-5.dll is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(13).exe\{tmp}\libgcc_s_sjlj-1.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(13).exe\{tmp}\libgmp-10.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(13).exe\{tmp}\libssp-0.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(13).exe\{tmp}\ssleay32.dll - packed by FLY-CODE
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(13).exe\{tmp}\tor.exe is BINARYRES container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(13).exe - container
Error to send CureIt! statistics:  (12002)
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE0625\0625(8).exe - Ok

Total 18343853 bytes in 14 files scanned (95 objects)
Total 9 files (90 objects) are clean
Total 5 files are infected--恩，很好，这回没人上传virustotal.com
Scan time is 00:00:21.698


回复

举报

dg1vg4
发表于 2018-6-26 20:18:52 | 显示全部楼层
瑞星安全云终端 6/26 20:18
12/14   

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

1234
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-5-1 03:32 , Processed in 0.105943 second(s), 14 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表