#PACKAGE 0704

command360

20:57 管家国际版

13/20（65%）

dreams521

191196846 发表于 2018-7-4 20:52
你双击怎么是特征报法？

PDM，复制报告没显示

Jerry.Lin

dreams521 发表于 2018-7-4 21:01
PDM，复制报告没显示

?不应该呀…… 日志里面肯定有

dreams521

191196846 发表于 2018-7-4 21:02
?不应该呀…… 日志里面肯定有

发现，隔离，删除，我只复制了删除

www-tekeze

command360 发表于 2018-7-4 19:28
我也觉得奇怪

我的绒儿报的是4,7,8，10,14,18,20

我的报5个，7/8/10/14/20，why？  

小坏爷

win10 家庭版WD 默认设置4.18 1.271.470病毒库  Time 22：01


(11/20) 55% 剩余9个样本MISS

小飞侠.net

Dr.Web CureIt! 简体中文绿色免费版---（ Windows 7 Ultimate with SP1 简体中文旗舰版....）：

-----------------------------------------------------------------------------
Start scanning
-----------------------------------------------------------------------------
Command line used:-rpcep:\pipe\3BE5BA927 -rpcpr:np

Limit the use of the computer resources to 100%
Instances used for this session: 10
Object(s) to scan:
- C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704


>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(1).exe - packed by FLY-CODE
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(17).exe - packed by FLY-CODE
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(13).exe - infected with Trojan.PWS.Stealer.23680
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(13).exe - infected
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(12).exe - packed by FLY-CODE
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(1).exe - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(16).exe is BINARYRES container
>>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(16).exe\data001 is NET container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(16).exe\data002 - infected with Trojan.PWS.Stealer.19347
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(16).exe - infected container
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(18).exe - infected with Trojan.PWS.Stealer.23950
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(18).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(2).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(11).exe - infected with Trojan.PWS.Stealer.23807
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(11).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(3).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(15).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(4).exe - infected with Trojan.PWS.Stealer.23950
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(4).exe - infected
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(10).exe - packed by FLY-CODE
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(19).exe - packed by UPX
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(5).exe - infected with Trojan.Inject3.4015
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(5).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(10).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(14).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(20).exe - Ok
>C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(9).exe - packed by FLY-CODE
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(19).exe - infected with Trojan.PWS.Stealer.18836
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(19).exe - infected
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(9).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(17).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(7).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(8).exe - Ok
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(6).exe - Ok
Error to send CureIt! statistics:  (12002)
Error to send CureIt! statistics:  (12002)
C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(12).exe - Ok

Total 8541093 bytes in 20 files scanned (22 objects)
Total 13 files (14 objects) are clean
Total 7 files are infected---很好没人上传VirusTotal
Scan time is 00:00:25.726


火绒安全---（ Windows 7 Ultimate with SP1 简体中文旗舰版....）：部分未知文件已发送到seclab@huorong.cn，等处理中。。。

病毒库：2018-07-04 15:56
开始时间：2018-07-04 22:55
总计用时：00:00:20
扫描对象：83个
扫描文件：20个
发现风险：6个
已处理风险：0个
发现系统修复项：0个
处理系统修复项：0个

病毒详情

风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(10).exe, 病毒名：HEUR:Trojan/VBCode.be, 病毒ID：[58ecd128ab121f57], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(14).exe, 病毒名：HVM:VirTool/Obfuscator.gen!A, 病毒ID：[b27d4294cde6a1ec], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(4).exe, 病毒名：HVM:VirTool/Obfuscator.gen!A, 病毒ID：[b27d4294cde6a1ec], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(7).exe, 病毒名：HEUR:Trojan/VBCode.be, 病毒ID：[58ecd128ab121f57], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(20).exe, 病毒名：HVM:VirTool/Obfuscator.gen!A, 病毒ID：[b27d4294cde6a1ec], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704\0704(8).exe, 病毒名：HVM:VirTool/Obfuscator.gen!A, 病毒ID：[b27d4294cde6a1ec], 处理结果：已忽略

文件名称: C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE  0704.zip
文件大小: 5.01 MB (5,261,009 字节)
修改时间: 2018年07月04日，22:53:48
MD5: 44872B2D82FE691F5331B2B302A48567
SHA1: 3F5DFEF14E46A46EED7F897F9772E49987F0A599
SHA256: 1B18576E3C317F450CDBBA72EF9DCD8E9C359CD024C3E6D2AF18A388522419D9
SHA512: 0DE8297E4F41197A9D2C81EC26758A065E38DCC0B78625F4ABBCF553891538044B93BB4E8357FEED1CBA6B14BFBE7421AA47D0DA2E76A42EF408B073DE1508B1
CRC32: C13EFE43
计算时间: 0.34s

command360

www-tekeze 发表于 2018-7-4 21:29
我的报5个，7/8/10/14/20，why？

4号样本有点皮……

直接双击了，火绒提示有毒

WhiteCruel

ESET双击剩余的2个

6号miss
13号杀衍生物

1. C:\Users\admin\AppData\Local\Temp\hail.dll;Win32/Injector.DYZN 特洛伊木马;通过删除清除;WIN-6IFN7FH5R7B\admin;在应用程序新建的文件上发生事件: C:\Users\admin\Desktop\PACKAGE  0704\0704(13).exe (450A3E4D53450E03AF8C8AD3506951BC43BBF860).;59E4BB59A25BC07568041CDD753A8B66BC198E42
   

复制代码

petr0vic

Emsisoft
19/20

1. 0704(13).exe -> (NSIS o) -> zlib_solid_nsis0000          Gen:Variant.Nemesis.244 (B) [krnl.xmd]
   
2. 0704(1).exe          Trojan.GenericKD.31042441 (B) [krnl.xmd]
   
3. 0704(12).exe          Trojan.Emotet (A) [294542]
   
4. 0704(10).exe          Trojan.Injector (A) [294543]
   
5. 0704(15).exe          Trojan.Injector (A) [294543]
   
6. 0704(17).exe          Trojan.Emotet (A) [294542]
   
7. 0704(18).exe          Trojan.Agent (A) [294540]
   
8. 0704(14).exe          Trojan.GenericKD.31045741 (B) [krnl.xmd]
   
9. 0704(2).exe          Trojan.GenericKD.31042992 (B) [krnl.xmd]
   
10. 0704(16).exe          Gen:Variant.Ursu.91343 (B) [krnl.xmd]
    
11. 0704(3).exe          Trojan.GenericKD.31042465 (B) [krnl.xmd]
    
12. 0704(11).exe          Gen:Variant.Graftor.499161 (B) [krnl.xmd]
    
13. 0704(4).exe          Trojan.GenericKD.31043204 (B) [krnl.xmd]
    
14. 0704(6).exe          Trojan.Agent (A) [294539]
    
15. 0704(7).exe          Trojan.Injector (A) [294543]
    
16. 0704(19).exe          Gen:Variant.Graftor.499818 (B) [krnl.xmd]
    
17. 0704(5).exe          Gen:Variant.Razy.358355 (B) [krnl.xmd]
    
18. 0704(8).exe          Trojan.GenericKD.31042827 (B) [krnl.xmd]
    
19. 0704(9).exe          Trojan.GenericKD.31043550 (B) [krnl.xmd]

复制代码