#1 (18.7.13)

petr0vic

https://my.mixtape.moe/borvut.7z

infected

https://support.emsisoft.com/top ... ents#comment-185679
poor OEM BD engine.......

Jerry.Lin

1. 
   
2. HitmanPro 3.8.0.292
   
3. www.hitmanpro.com
   
4. 
   
5.    Computer name . . . . : DESKTOP-VPBE70N
   
6.    Windows . . . . . . . : 10.0.0.17134.X64/4
   
7.    User name . . . . . . : DESKTOP-VPBE70N\zhong
   
8.    UAC . . . . . . . . . : Enabled
   
9.    License . . . . . . . : Paid (255 days left)
   
10. 
    
11.    Scan date . . . . . . : 2018-07-13 21:49:28
    
12.    Scan mode . . . . . . : Context
    
13.    Scan duration . . . . : 12s
    
14.    Disk access mode  . . : Direct disk access (FsdHigh)
    
15.    Cloud . . . . . . . . : Internet
    
16.    Reboot  . . . . . . . : No
    
17. 
    
18.    Threats . . . . . . . : 3
    
19. 
    
20.    Objects scanned . . . : 3
    
21.    Files scanned . . . . : 3
    
22.    Remnants scanned  . . : 0 files / 0 keys
    
23. 
    
24. Malware _____________________________________________________________________
    
25. 
    
26.    C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\borvut\Vir\md5change.exe
    
27.       Size . . . . . . . : 79,488 bytes
    
28.       Age  . . . . . . . : 0.0 days (2018-07-13 21:49:09)
    
29.       Entropy  . . . . . : 8.0
    
30.       SHA-256  . . . . . : 1CC379BFC2CFC33BD0EC846218CFA366185EAE5E2C721ECD51C07502D61CC13C
    
31.     > Kaspersky  . . . . : Worm.VBS.Dinihou.au
    
32. 
    
33.    C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\borvut\Vir\unpack.exe
    
34.       Size . . . . . . . : 143,872 bytes
    
35.       Age  . . . . . . . : 0.0 days (2018-07-13 21:49:09)
    
36.       Entropy  . . . . . : 6.9
    
37.       SHA-256  . . . . . : 21E2DE9376B7492877F4F1618EEA2EDFE31312BC2234A3880EBE7177DEAD14E2
    
38.     > Kaspersky  . . . . : Worm.VBS.Dinihou.au
    
39.     > HitmanPro  . . . . : VBS/Agent-RTH
    
40. 
    
41.    C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\borvut\Vir\upx-pack.exe
    
42.       Size . . . . . . . : 79,360 bytes
    
43.       Age  . . . . . . . : 0.0 days (2018-07-13 21:49:09)
    
44.       Entropy  . . . . . : 8.0
    
45.       SHA-256  . . . . . : BC8F3693F5545D251B4096558BF7ACB239836C742A9C2DE3D5685D354B92912C
    
46.     > Kaspersky  . . . . : Worm.VBS.Dinihou.au
    
47. 
    
48. 
    
49. 
    

复制代码

1. 2018-7-13 21:49|C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\borvut\Vir\md5change.exe|Heur.ML.PE.E
   
2. 2018-7-13 21:49|C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\borvut\Vir\unpack.exe|Heur.ML.PE.E
   
3. 2018-7-13 21:49|C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\borvut\Vir\upx-pack.exe|Heur.ML.PE.E

复制代码

dreams521

13.07.2018 21.58.09;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\Vir\md5change.exe;Microsoft Windows Search Protocol Host;C:\Users\Administrator\Desktop\Vir\md5change.exe;07/13/2018 21:58:09;Worm.VBS.Dinihou.au
13.07.2018 21.58.10;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\Vir\unpack.exe;Windows Explorer;C:\Users\Administrator\Desktop\Vir\unpack.exe;07/13/2018 21:58:10;Worm.VBS.Dinihou.au
13.07.2018 21.58.10;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\Vir\upx-pack.exe;Windows Explorer;C:\Users\Administrator\Desktop\Vir\upx-pack.exe;07/13/2018 21:58:10;Worm.VBS.Dinihou.au

嶝鄇

360 total secutity kill

pal家族

But BD also do not detect the packed one.
I believe you should blame BD instead of Emsisoft? Since its own engine is so poor.

petr0vic

pal家族 发表于 2018-7-13 23:33
But BD also do not detect the packed one.
I believe you should blame BD instead of Emsisoft? Since  ...

yep

#1
poor OEM BD engine.......

do not unpack UPX ?

pal家族

petr0vic 发表于 2018-7-13 23:38
yep

Lol
emm~~I see Avira just ML the packed one with unpacked one missed.

petr0vic

pal家族 发表于 2018-7-13 23:41
Lol
emm~~I see Avira just ML the packed one with unpacked one missed.

Avira vs Ransomware

pal家族

petr0vic 发表于 2018-7-13 23:52
Avira vs Ransomware

Well, sadly the APC is the last defense.
Although we do know that there is NO perfect proactive defense that can block ALL ransomwares and APC can significantly increase the detection ratio( as well as AMS from ESET),
But the existence of so called proactive defense( Especially those with rollback function) indeed give us more sense of trust.

I must be mad, practicing english with you at midnight Beijing time.

petr0vic

While the Bitdefender engine can and does unpack UPX packed files, it seems some automatically generated signatures stop working in such cases. We have reported it to Bitdefender.

https://support.emsisoft.com/top ... ents#comment-185691