样本集奉上_53

www-tekeze

50枚exe样本送上，本来火绒已做了通杀处理，但被我全部加了UPX壳，扫描检出率下降为大概80%，当然双击后应该都能拦截。。。请其它杀软测试下，快来快来，扫描？ 双击？ 一概欢迎！  


蓝奏云盘，下载挺快。。。 https://www.lanzous.com/i1q3m2j     密码：infected

静影沉璧

BD2019

时间：20:42-21:20

扫描：25/50

C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(38).exe	Trojan.NSIS.Agent.BH	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(47).exe	Trojan.Agent.CHLO	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(10).exe	Trojan.Locky.BF	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(13).exe=>(NSIS o)=>zlib_solid_nsis0003	Trojan.Dropper.XMO	Moved to Quarantine
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(1).exe	Trojan.TeslaCrypt.DK	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(11).exe=>(NSIS o)=>lzma_solid_nsis0005	Trojan.RanSerKD.4151763	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(31).exe	Gen:Variant.Ursu.9987	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(17).exe	Gen:Variant.Symmi.89111	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(35).exe	Gen:Variant.Ursu.9987	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(42).exe	Gen:Variant.Ursu.12479	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(16).exe	Gen:Trojan.Heur.RP.ymHfa4hzI8pc	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(34).exe	Trojan.Agent.BEZW	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(14).exe	Gen:Variant.Ursu.9987	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(32).exe	Gen:Variant.Jaiko.3654	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(28).exe	Gen:Heur.ManBat.1	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(46).exe	Gen:Variant.Bredo.4	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(4).exe	Generic.Nymaim.E.97091F94	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(3).exe	Gen:Variant.Ursu.19853	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(39).exe	Trojan.Zlob.2.Gen	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(19).exe	Gen:Variant.Jaiks.5116	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(37).exe	Generic.Nymaim.E.BBAD4D67	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(27).exe	Trojan.Agent.COHO	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(36).exe	Trojan.Agent.BGHD	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(33).exe	Gen:Variant.Razy.379315	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(12).exe	Gen:Variant.Symmi.88997	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(11).exe=>(heurC)	Zum.Ransom.NSIS.Cerber.1	Deleted

双击：24/50
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(2).exe is infected with Gen:Suspicious.Cloud.8.pmKfaOcXqhji and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(5).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(6).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(7).exe is infected with Gen:Suspicious.Cloud.8.jmGfaKQJogni and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(8).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(9).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(15).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\VirusSamples_53\Samp(18).exe has been detected as infected. Bitdefender could not clean this item. A reboot is required to complete the cleaning process. Threat name: Gen:Suspicious.Cloud.8.wmHfa4BxscmO
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(20).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(21).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(22).exe is infected with Gen:Suspicious.Cloud.8.jmGfaCV6Iopi and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(23).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(25).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(26).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(29).exe is infected with Gen:Suspicious.Cloud.8.nmKfa8@e8icO and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(30).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(40).exe is infected with Gen:Suspicious.Cloud.8.nmLfa8ju!dek and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(41).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(43).exe is infected with Gen:Suspicious.Cloud.8.smLfaW8!sbkG and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(44).exe is infected with Gen:Suspicious.Cloud.8.rmLfaGETQBnO and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(45).exe is infected with Gen:Suspicious.Cloud.8.bmGfaWboVici and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(48).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(49).exe is infected with Gen:Suspicious.Cloud.8.tmLfaeXlVXkG and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\virussamples_53\samp(50).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
剩余样本双击结果：
24号样本报错，无法运行
Total：49/50=98%

dreams521

卡巴 20:39     

26/50    52%

24.08.2018 20.38.30;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(5).vir;C:\Users\Administrator\Desktop\123\Samp(5).vir;HEUR:Trojan.Win32.Generic;木马程序;08/24/2018 20:38:30
24.08.2018 20.38.30;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(5).vir//word/vbaProject.bin//form.o.Odish;C:\Users\Administrator\Desktop\123\Samp(5).vir//word/vbaProject.bin//form.o.Odish;Trojan-Downloader.VBS.Agent.cis;木马程序;08/24/2018 20:38:30
24.08.2018 20.38.30;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(5).vir//data0000;C:\Users\Administrator\Desktop\123\Samp(5).vir//data0000;not-a-virus:RiskTool.Win32.WFPDisabler.a;可被入侵者利用以破坏您的计算机或个人数据的合法软件;08/24/2018 20:38:30
24.08.2018 20.38.27;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(29).vir//JIM;C:\Users\Administrator\Desktop\123\Samp(29).vir//JIM;HEUR:Trojan.Script.Agent.gen;木马程序;08/24/2018 20:38:27
24.08.2018 20.38.27;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(29).vir;C:\Users\Administrator\Desktop\123\Samp(29).vir;HEUR:Trojan.Win32.Generic;木马程序;08/24/2018 20:38:27
24.08.2018 20.38.27;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(29).vir//word/embeddings/oleObject1.bin;C:\Users\Administrator\Desktop\123\Samp(29).vir//word/embeddings/oleObject1.bin;Trojan-Downloader.MSWord.Agent.bqe;木马程序;08/24/2018 20:38:27
24.08.2018 20.38.10;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(17).vir//data0000//-SWIFT-43f-.js;C:\Users\Administrator\Desktop\123\Samp(17).vir//data0000//-SWIFT-43f-.js;Trojan-Downloader.JS.Cryptoload.abc;木马程序;08/24/2018 20:38:10
24.08.2018 20.38.10;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(17).vir//data0000//-SWIFT-f48e-.js;C:\Users\Administrator\Desktop\123\Samp(17).vir//data0000//-SWIFT-f48e-.js;Trojan-Downloader.JS.Agent.lph;木马程序;08/24/2018 20:38:10
24.08.2018 20.38.10;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(17).vir;C:\Users\Administrator\Desktop\123\Samp(17).vir;HEUR:Trojan.Win32.Invader;木马程序;08/24/2018 20:38:10
24.08.2018 20.38.10;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(17).vir//Document(208).jse;C:\Users\Administrator\Desktop\123\Samp(17).vir//Document(208).jse;Trojan-Downloader.JS.Agent.asdfxs;木马程序;08/24/2018 20:38:10
24.08.2018 20.37.54;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(10).vir//data0000//TF.48678398483/TF.48678398483.bat;C:\Users\Administrator\Desktop\123\Samp(10).vir//data0000//TF.48678398483/TF.48678398483.bat;Trojan-Downloader.BAT.Agent.rv;木马程序;08/24/2018 20:37:54
24.08.2018 20.37.54;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(10).vir;C:\Users\Administrator\Desktop\123\Samp(10).vir;Trojan-Downloader.Win32.Dagozill.br;木马程序;08/24/2018 20:37:54
24.08.2018 20.37.53;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(11).vir;C:\Users\Administrator\Desktop\123\Samp(11).vir;HEUR:Trojan-Ransom.Win32.Agent.gen;木马程序;08/24/2018 20:37:53
24.08.2018 20.37.53;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(12).vir//data0000//DOC2708740260.js;C:\Users\Administrator\Desktop\123\Samp(12).vir//data0000//DOC2708740260.js;Trojan-Downloader.JS.Agent.oex;木马程序;08/24/2018 20:37:53
24.08.2018 20.37.53;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(12).vir//JIM;C:\Users\Administrator\Desktop\123\Samp(12).vir//JIM;HEUR:Trojan.Script.Agent.gen;木马程序;08/24/2018 20:37:53
24.08.2018 20.37.53;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(12).vir;C:\Users\Administrator\Desktop\123\Samp(12).vir;Trojan-Spy.Win32.Zbot.xwsw;木马程序;08/24/2018 20:37:53
24.08.2018 20.37.52;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(13).vir//JIM;C:\Users\Administrator\Desktop\123\Samp(13).vir//JIM;HEUR:Trojan.Script.Agent.gen;木马程序;08/24/2018 20:37:52
24.08.2018 20.37.52;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(13).vir;C:\Users\Administrator\Desktop\123\Samp(13).vir;Trojan-Downloader.NSIS.Agent.pp;木马程序;08/24/2018 20:37:52
24.08.2018 20.37.52;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(13).vir//data0000//16324.js;C:\Users\Administrator\Desktop\123\Samp(13).vir//data0000//16324.js;HEUR:Trojan.Script.Agent.gen;木马程序;08/24/2018 20:37:52
24.08.2018 20.37.52;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(14).vir//QvojzRsGS;C:\Users\Administrator\Desktop\123\Samp(14).vir//QvojzRsGS;HEUR:Trojan-Downloader.Script.Generic;木马程序;08/24/2018 20:37:52
24.08.2018 20.37.52;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(14).vir;C:\Users\Administrator\Desktop\123\Samp(14).vir;VHO:Backdoor.Win32.Cridex.gen;木马程序;08/24/2018 20:37:52
24.08.2018 20.37.51;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(15).vir;C:\Users\Administrator\Desktop\123\Samp(15).vir;HEUR:Trojan.Win32.Generic;木马程序;08/24/2018 20:37:51
24.08.2018 20.37.51;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(16).vir//JIM;C:\Users\Administrator\Desktop\123\Samp(16).vir//JIM;HEUR:Trojan.Script.Agent.gen;木马程序;08/24/2018 20:37:51
24.08.2018 20.37.51;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(16).vir;C:\Users\Administrator\Desktop\123\Samp(16).vir;Trojan.Win32.Inject.vmov;木马程序;08/24/2018 20:37:51
24.08.2018 20.37.51;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(16).vir//ThisDocument;C:\Users\Administrator\Desktop\123\Samp(16).vir//ThisDocument;HEUR:Trojan.Script.Agent.gen;木马程序;08/24/2018 20:37:51
24.08.2018 20.37.50;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(18).vir;C:\Users\Administrator\Desktop\123\Samp(18).vir;HEUR:Trojan.Win32.Generic;木马程序;08/24/2018 20:37:50
24.08.2018 20.37.48;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(23).vir;C:\Users\Administrator\Desktop\123\Samp(23).vir;HEUR:Packed.Win32.Mentiger.gen;木马程序;08/24/2018 20:37:48
24.08.2018 20.37.48;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(23).vir//data0002;C:\Users\Administrator\Desktop\123\Samp(23).vir//data0002;HEUR:Exploit.Script.Generic;木马程序;08/24/2018 20:37:48
24.08.2018 20.37.48;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(24).vir//data0000//01637815.zip//DIy.js;C:\Users\Administrator\Desktop\123\Samp(24).vir//data0000//01637815.zip//DIy.js;HEUR:Trojan.Script.Agent.gen;木马程序;08/24/2018 20:37:48
24.08.2018 20.37.48;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(24).vir;C:\Users\Administrator\Desktop\123\Samp(24).vir;HEUR:Trojan.NSIS.Agent.gen;木马程序;08/24/2018 20:37:48
24.08.2018 20.37.47;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(35).vir//JIM;C:\Users\Administrator\Desktop\123\Samp(35).vir//JIM;HEUR:Trojan.Script.Agent.gen;木马程序;08/24/2018 20:37:47
24.08.2018 20.37.47;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(35).vir//ThisDocument;C:\Users\Administrator\Desktop\123\Samp(35).vir//ThisDocument;Trojan-Downloader.MSWord.Agent.eg;木马程序;08/24/2018 20:37:47
24.08.2018 20.37.47;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(35).vir;C:\Users\Administrator\Desktop\123\Samp(35).vir;VHO:Backdoor.Win32.Cridex.gen;木马程序;08/24/2018 20:37:47
24.08.2018 20.37.46;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(30).vir//Ms07.dat;C:\Users\Administrator\Desktop\123\Samp(30).vir//Ms07.dat;Trojan.Win32.Scar.lhqa;木马程序;08/24/2018 20:37:46
24.08.2018 20.37.46;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(30).vir;C:\Users\Administrator\Desktop\123\Samp(30).vir;HEUR:Trojan.Win32.Generic;木马程序;08/24/2018 20:37:46
24.08.2018 20.37.46;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(31).vir//QvojzRsGS;C:\Users\Administrator\Desktop\123\Samp(31).vir//QvojzRsGS;HEUR:Trojan-Downloader.Script.Generic;木马程序;08/24/2018 20:37:46
24.08.2018 20.37.46;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(31).vir;C:\Users\Administrator\Desktop\123\Samp(31).vir;VHO:Backdoor.Win32.Cridex.gen;木马程序;08/24/2018 20:37:46
24.08.2018 20.37.46;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(31).vir//data0000//DOC4171785589-PDF.js;C:\Users\Administrator\Desktop\123\Samp(31).vir//data0000//DOC4171785589-PDF.js;HEUR:Trojan.Script.Agent.gen;木马程序;08/24/2018 20:37:46
24.08.2018 20.37.44;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(32).vir;C:\Users\Administrator\Desktop\123\Samp(32).vir;Trojan-PSW.Win32.FTPasso.eb;木马程序;08/24/2018 20:37:44
24.08.2018 20.37.44;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(34).vir;C:\Users\Administrator\Desktop\123\Samp(34).vir;HEUR:Trojan.Win32.Generic;木马程序;08/24/2018 20:37:44
24.08.2018 20.37.43;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(38).vir//word/vbaProject.bin//Module2;C:\Users\Administrator\Desktop\123\Samp(38).vir//word/vbaProject.bin//Module2;Trojan-Downloader.MSWord.Agent.ahu;木马程序;08/24/2018 20:37:43
24.08.2018 20.37.43;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(38).vir//word/vbaProject.bin//Module6;C:\Users\Administrator\Desktop\123\Samp(38).vir//word/vbaProject.bin//Module6;Trojan-Downloader.MSWord.Agent.ail;木马程序;08/24/2018 20:37:43
24.08.2018 20.37.43;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(38).vir//word/vbaProject.bin//ThisDocument;C:\Users\Administrator\Desktop\123\Samp(38).vir//word/vbaProject.bin//ThisDocument;Trojan-Downloader.MSWord.Agent.ahs;木马程序;08/24/2018 20:37:43
24.08.2018 20.37.43;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(38).vir;C:\Users\Administrator\Desktop\123\Samp(38).vir;HEUR:Trojan.Win32.Generic;木马程序;08/24/2018 20:37:43
24.08.2018 20.37.40;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(40).vir//data0000;C:\Users\Administrator\Desktop\123\Samp(40).vir//data0000;UDS:DangerousObject.Multi.Generic;08/24/2018 20:37:40
24.08.2018 20.37.40;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(40).vir//data0000//UPS-Package-07907895/UPS-Package-07907895.doc.js;C:\Users\Administrator\Desktop\123\Samp(40).vir//data0000//UPS-Package-07907895/UPS-Package-07907895.doc.js;Trojan-Downloader.JS.Agent.oam;木马程序;08/24/2018 20:37:40
24.08.2018 20.37.40;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(40).vir;C:\Users\Administrator\Desktop\123\Samp(40).vir;Trojan-Ransom.Win32.Zerber.iyx;木马程序;08/24/2018 20:37:40
24.08.2018 20.37.40;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(41).vir//JIM;C:\Users\Administrator\Desktop\123\Samp(41).vir//JIM;HEUR:Trojan.Script.Agent.gen;木马程序;08/24/2018 20:37:40
24.08.2018 20.37.40;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(41).vir//data0001;C:\Users\Administrator\Desktop\123\Samp(41).vir//data0001;Trojan-Downloader.JS.Agent.nxn;木马程序;08/24/2018 20:37:40
24.08.2018 20.37.40;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(41).vir//data0000//201708084410.js;C:\Users\Administrator\Desktop\123\Samp(41).vir//data0000//201708084410.js;HEUR:Trojan-Downloader.Script.Generic;木马程序;08/24/2018 20:37:40
24.08.2018 20.37.40;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(41).vir//data0000//word/vbaProject.bin//Module2;C:\Users\Administrator\Desktop\123\Samp(41).vir//data0000//word/vbaProject.bin//Module2;Trojan-Downloader.MSWord.Agent.bim;木马程序;08/24/2018 20:37:40
24.08.2018 20.37.40;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(41).vir//data0000;C:\Users\Administrator\Desktop\123\Samp(41).vir//data0000;UDS:DangerousObject.Multi.Generic;08/24/2018 20:37:40
24.08.2018 20.37.40;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(41).vir;C:\Users\Administrator\Desktop\123\Samp(41).vir;Trojan-Ransom.Win32.Snocry.hv;木马程序;08/24/2018 20:37:40
24.08.2018 20.37.39;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(7).vir//1.23.dat;C:\Users\Administrator\Desktop\123\Samp(7).vir//1.23.dat;HEUR:Backdoor.Win32.Generic;木马程序;08/24/2018 20:37:39
24.08.2018 20.37.39;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(7).vir//data0000//8270663088.zip//sowga.js;C:\Users\Administrator\Desktop\123\Samp(7).vir//data0000//8270663088.zip//sowga.js;HEUR:Trojan.Script.Agent.gen;木马程序;08/24/2018 20:37:39
24.08.2018 20.37.39;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(7).vir;C:\Users\Administrator\Desktop\123\Samp(7).vir;VHO:Backdoor.Multi.Carbanak.gen;木马程序;08/24/2018 20:37:39
24.08.2018 20.37.39;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(42).vir//data0000;C:\Users\Administrator\Desktop\123\Samp(42).vir//data0000;UDS:Trojan-Downloader.MSWord.Agent.asdfvs;木马程序;08/24/2018 20:37:39
24.08.2018 20.37.39;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(42).vir//data0000//21457.doc;C:\Users\Administrator\Desktop\123\Samp(42).vir//data0000//21457.doc;Trojan-Downloader.MSWord.Agent.baj;木马程序;08/24/2018 20:37:39
24.08.2018 20.37.39;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(42).vir;C:\Users\Administrator\Desktop\123\Samp(42).vir;Trojan.Win32.Agent.ijxt;木马程序;08/24/2018 20:37:39
24.08.2018 20.37.39;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(43).vir//ThisWorkbook;C:\Users\Administrator\Desktop\123\Samp(43).vir//ThisWorkbook;Trojan-Downloader.MSExcel.Agent.gb;木马程序;08/24/2018 20:37:39
24.08.2018 20.37.39;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(43).vir;C:\Users\Administrator\Desktop\123\Samp(43).vir;HEUR:Trojan.Win32.Generic;木马程序;08/24/2018 20:37:39
24.08.2018 20.37.39;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(49).vir//data0000;C:\Users\Administrator\Desktop\123\Samp(49).vir//data0000;UDS:Trojan-Downloader.MSExcel.Agent.gb;木马程序;08/24/2018 20:37:39
24.08.2018 20.37.39;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(49).vir//data0000//ThisWorkbook;C:\Users\Administrator\Desktop\123\Samp(49).vir//data0000//ThisWorkbook;Trojan-Downloader.MSExcel.Agent.gb;木马程序;08/24/2018 20:37:39
24.08.2018 20.37.39;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(49).vir//script.au3;C:\Users\Administrator\Desktop\123\Samp(49).vir//script.au3;HEUR:Trojan.Script.Generic;木马程序;08/24/2018 20:37:39
24.08.2018 20.37.39;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(49).vir;C:\Users\Administrator\Desktop\123\Samp(49).vir;HEUR:Trojan.Win32.Generic;木马程序;08/24/2018 20:37:39
24.08.2018 20.37.39;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(1).vir//data0000//QvojzRsGS;C:\Users\Administrator\Desktop\123\Samp(1).vir//data0000//QvojzRsGS;HEUR:Trojan-Downloader.Script.Generic;木马程序;08/24/2018 20:37:39
24.08.2018 20.37.39;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\123\Samp(1).vir;C:\Users\Administrator\Desktop\123\Samp(1).vir;HEUR:Trojan.Win32.Generic;木马程序;08/24/2018 20:37:39





剩余样本

静影沉璧

Symantec Endpoint Protection 14.2.0.770

时间20:55-21:31

自动防护扫描：44/50

1. Samp(1).vir        Packed.Generic.521        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 20:55:24
   
2. Samp(10).vir        Trojan Horse        已隔离        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        受感染        隔离        清除安全风险        隔离        已经成功地隔离了文件。        2018/8/24 20:55:50
   
3. Samp(11).vir        Ransom.Cerber!g14        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 20:56:16
   
4. Samp(12).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 20:56:43
   
5. Samp(13).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 20:57:09
   
6. Samp(14).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 20:57:36
   
7. Samp(15).vir        Ransom.Cerber        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 20:58:03
   
8. Samp(16).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 20:58:30
   
9. Samp(17).vir        Packed.Generic.530        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 20:58:56
   
10. Samp(18).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 20:59:23
    
11. Samp(19).vir        Downloader.Upatre!gen7        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 20:59:50
    
12. Samp(20).vir        Trojan.Gen.2        已隔离        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        受感染        隔离        清除安全风险        隔离        已经成功地隔离了文件。        2018/8/24 21:00:16
    
13. Samp(21).vir        Packed.Generic.456        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:00:42
    
14. Samp(23).vir        Ransom.Cerber        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:01:10
    
15. Samp(22).vir        Ransom.Locky!g13        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:01:36
    
16. Samp(25).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:02:03
    
17. Samp(26).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:02:03
    
18. Samp(27).vir        Ransom.Locky!g34        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:02:03
    
19. Samp(28).vir        Downloader.Upatre!gen7        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:02:03
    
20. Samp(29).vir        Packed.Generic.497        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:02:03
    
21. Samp(3).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:02:03
    
22. Samp(30).vir        Packed.Generic.463        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:02:03
    
23. Samp(31).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:02:03
    
24. Samp(32).vir        Downloader.Upatre        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:02:03
    
25. Samp(33).vir        Ransom.Cerber        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:02:03
    
26. Samp(34).vir        Packed.Generic.497        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:02:03
    
27. Samp(35).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:02:23
    
28. Samp(36).vir        Trojan.Asprox.B        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:02:33
    
29. Samp(37).vir        Ransom.Cerber        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:02:49
    
30. Samp(39).vir        Ransom.Cerber        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:03:01
    
31. Samp(4).vir        Trojan.Dropper        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:03:26
    
32. Samp(40).vir        Packed.Generic.459        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:03:44
    
33. Samp(42).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:04:09
    
34. Samp(43).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:04:19
    
35. Samp(44).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:04:35
    
36. Samp(45).vir        Trojan Horse        已隔离        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        受感染        隔离        清除安全风险        隔离        已经成功地隔离了文件。        2018/8/24 21:05:13
    
37. Samp(47).vir        Packed.Generic.530        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:05:18
    
38. Samp(48).vir        Ransom.Locky!gm        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:05:33
    
39. Samp(5).vir        Packed.Generic.497        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:06:06
    
40. Samp(50).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:06:26
    
41. Samp(6).vir        W32.Qakbot!gen12        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:06:53
    
42. Samp(7).vir        Ransom.Locky!g13        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:07:12
    
43. Samp(8).vir        Ransom.Cerber!g9        已通过删除清除        病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:07:22
    
44. Samp(9).vir        Heur.AdvML.B        已通过删除清除        启发式病毒        自动防护扫描        C:\Users\Administrator\AppData\Local\Temp\vmware-Administrator\VMwareDnD\6703f1b5\VirusSamples 53\        WIN-7L012NVDSMK        Administrator        已删除        已删除        清除安全风险        隔离        已成功地删除了文件。        2018/8/24 21:07:43

复制代码

双击：3/50



剩余样本双击结果：
2号样本MISS
24号样本报错无法运行
46号样本等了半天没跑出行为，似乎反虚拟机
Total：47/50=94%

静影沉璧

Emsisoft Anti-Malware - 版本 2018.7

最后更新： 2018/8/24 21:43:37

发起者： WIN-7L012NVDSMK\Administrator

电脑名称： WIN-7L012NVDSMK

操作系统版本： Windows 7x86 Service Pack 1

手动扫描：25/50

1. 扫描设置：
   
2. 
   
3. 扫描方式：
   
4. 对象： C:\Users\Administrator\Desktop\VirusSamples_53
   
5. 
   
6. 检测流氓软件(PUPs)： 开
   
7. 扫描存档： 开
   
8. 扫描邮件档案： 关
   
9. ADS数据流扫描： 开
   
10. 文件扩展名过滤： 关
    
11. 直接磁盘访问： 关
    
12. 
    
13. 扫描开始：        2018/8/24 21:44:38
    
14. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(13).exe -> (NSIS o) -> zlib_solid_nsis0003          Trojan.Dropper.XMO (B) [krnl.xmd]
    
15. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(11).exe -> (NSIS o) -> lzma_solid_nsis0005          Trojan.RanSerKD.4151763 (B) [krnl.xmd]
    
16. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(11).exe -> (heurC)          Zum.Ransom.NSIS.Cerber.1 (B) [krnl.xmd]
    
17. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(1).exe          Trojan.TeslaCrypt.DK (B) [krnl.xmd]
    
18. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(10).exe          Trojan.Locky.BF (B) [krnl.xmd]
    
19. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(16).exe          Gen:Trojan.Heur.RP.ymHfa4hzI8pc (B) [krnl.xmd]
    
20. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(14).exe          Gen:Variant.Ursu.9987 (B) [krnl.xmd]
    
21. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(12).exe          Gen:Variant.Symmi.88997 (B) [krnl.xmd]
    
22. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(19).exe          Gen:Variant.Jaiks.5116 (B) [krnl.xmd]
    
23. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(27).exe          Trojan.Agent.COHO (B) [krnl.xmd]
    
24. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(28).exe          Gen:Heur.ManBat.1 (B) [krnl.xmd]
    
25. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(17).exe          Gen:Variant.Symmi.89111 (B) [krnl.xmd]
    
26. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(31).exe          Gen:Variant.Ursu.9987 (B) [krnl.xmd]
    
27. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(32).exe          Gen:Variant.Jaiko.3654 (B) [krnl.xmd]
    
28. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(34).exe          Trojan.Agent.BEZW (B) [krnl.xmd]
    
29. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(35).exe          Gen:Variant.Ursu.9987 (B) [krnl.xmd]
    
30. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(38).exe          Trojan.NSIS.Agent.BH (B) [krnl.xmd]
    
31. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(3).exe          Gen:Variant.Ursu.19853 (B) [krnl.xmd]
    
32. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(33).exe          Gen:Variant.Razy.379315 (B) [krnl.xmd]
    
33. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(39).exe          Trojan.Zlob.2.Gen (B) [krnl.xmd]
    
34. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(4).exe          Generic.Nymaim.E.97091F94 (B) [krnl.xmd]
    
35. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(37).exe          Generic.Nymaim.E.BBAD4D67 (B) [krnl.xmd]
    
36. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(36).exe          Trojan.Agent.BGHD (B) [krnl.xmd]
    
37. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(42).exe          Gen:Variant.Ursu.12479 (B) [krnl.xmd]
    
38. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(47).exe          Trojan.Agent.CHLO (B) [krnl.xmd]
    
39. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(46).exe          Gen:Variant.Bredo.4 (B) [krnl.xmd]
    
40. 
    
41. 扫描        50
    
42. 发现        26
    
43. 
    
44. 扫描结束：        2018/8/24 21:44:49
    
45. 扫描时间：        0:00:11
    
46. 
    
47. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(46).exe        已删除： Gen:Variant.Bredo.4 (B)
    
48. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(47).exe        已删除： Trojan.Agent.CHLO (B)
    
49. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(42).exe        已删除： Gen:Variant.Ursu.12479 (B)
    
50. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(36).exe        已删除： Trojan.Agent.BGHD (B)
    
51. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(37).exe        已删除： Generic.Nymaim.E.BBAD4D67 (B)
    
52. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(11).exe        已删除： Zum.Ransom.NSIS.Cerber.1 (B)
    
53. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(39).exe        已删除： Trojan.Zlob.2.Gen (B)
    
54. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(33).exe        已删除： Gen:Variant.Razy.379315 (B)
    
55. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(3).exe        已删除： Gen:Variant.Ursu.19853 (B)
    
56. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(38).exe        已删除： Trojan.NSIS.Agent.BH (B)
    
57. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(35).exe        已删除： Gen:Variant.Ursu.9987 (B)
    
58. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(34).exe        已删除： Trojan.Agent.BEZW (B)
    
59. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(32).exe        已删除： Gen:Variant.Jaiko.3654 (B)
    
60. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(31).exe        已删除： Gen:Variant.Ursu.9987 (B)
    
61. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(17).exe        已删除： Gen:Variant.Symmi.89111 (B)
    
62. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(28).exe        已删除： Gen:Heur.ManBat.1 (B)
    
63. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(27).exe        已删除： Trojan.Agent.COHO (B)
    
64. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(19).exe        已删除： Gen:Variant.Jaiks.5116 (B)
    
65. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(12).exe        已删除： Gen:Variant.Symmi.88997 (B)
    
66. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(14).exe        已删除： Gen:Variant.Ursu.9987 (B)
    
67. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(16).exe        已删除： Gen:Trojan.Heur.RP.ymHfa4hzI8pc (B)
    
68. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(10).exe        已删除： Trojan.Locky.BF (B)
    
69. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(1).exe        已删除： Trojan.TeslaCrypt.DK (B)
    
70. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(4).exe        已删除： Generic.Nymaim.E.97091F94 (B)
    
71. C:\Users\Administrator\Desktop\VirusSamples_53\Samp(13).exe        已删除： Trojan.Dropper.XMO (B)
    
72. 
    
73. 已删除：        25

复制代码

双击：18/50

1. 2018/8/24 21:55:34        行为监控        检测        可疑行为 "HiddenInstallation" 来自于 "Samp(49).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
   
2. 2018/8/24 21:55:05        行为监控        检测        可疑行为 "HiddenInstallation" 来自于 "Samp(45).exe" -> 通知-> 用户判断：隔离       
   
3. 2018/8/24 21:54:01        行为监控        检测        可疑行为 "HiddenInstallation" 来自于 "Samp(44).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
   
4. 2018/8/24 21:53:49        行为监控        检测        可疑行为 "HiddenInstallation" 来自于 "Samp(43).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
   
5. 2018/8/24 21:53:38        行为监控        检测        可疑行为 "CodeInjector" 来自于 "Samp(41).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
   
6. 2018/8/24 21:53:11        行为监控        检测        可疑行为 "AutorunCreation" 来自于 "Samp(40).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
   
7. 2018/8/24 21:52:53        行为监控        检测        可疑行为 "CodeInjector" 来自于 "Samp(30).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
   
8. 2018/8/24 21:52:11        行为监控        检测        可疑行为 "TrojanDownloader" 来自于 "Samp(26).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
   
9. 2018/8/24 21:51:11        行为监控        检测        可疑行为 "CodeInjector" 来自于 "Samp(25).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
   
10. 2018/8/24 21:50:43        行为监控        检测        可疑行为 "HiddenInstallation" 来自于 "Samp(23).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
    
11. 2018/8/24 21:50:28        行为监控        检测        可疑行为 "CryptoMalware" 来自于 "Samp(7).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
    
12. 2018/8/24 21:50:15        行为监控        检测        可疑行为 "CodeInjector" 来自于 "Samp(21).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
    
13. 2018/8/24 21:50:03        行为监控        检测        可疑行为 "CodeInjector" 来自于 "Samp(20).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
    
14. 2018/8/24 21:49:18        行为监控        检测        可疑行为 "CodeInjector" 来自于 "Samp(18).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
    
15. 2018/8/24 21:48:54        行为监控        检测        可疑行为 "TrojanDownloader" 来自于 "Samp(9).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
    
16. 2018/8/24 21:47:05        行为监控        检测        可疑行为 "HiddenInstallation" 来自于 "Samp(6).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
    
17. 2018/8/24 21:46:50        行为监控        检测        可疑行为 "HiddenInstallation" 来自于 "Samp(5).exe" -> 通知-> 警报窗口 -> 用户判断：隔离       
    
18. 2018/8/24 22:07:22        行为监控        检测        可疑行为 "CryptoMalware" 来自于 "Samp(22).exe" -> 通知-> 警报窗口 -> 用户判断：隔离

复制代码

剩余样本双击结果：
2，8,15号样本运行后提示停止工作
24号样本报错无法运行
29，48,50号样本驻留内存，等了很久都没跑出行为

Total：43/50=86%

chenQK

36/50 72%

WHALE-FALL

360 清空

Pluto爱卡戎

Comodo Internet Security 解压后扫描剩1个文件（16号样本），重启后50个样本都被删光了。

WHALE-FALL

ESET 49/50   余4号   

Scan Log
Version of detection engine: 17937P (20180824)
Date: 2018/8/24  Time: 20:50:36
Scanned disks, folders and files: D:\下载\VirusSamples_53

dreams521

无语

在防病毒数据库中未找到有关指定文件的信息：
Samp(19).vir
Samp(20).vir
Samp(21).vir
Samp(22).vir
Samp(25).vir
Samp(26).vir
Samp(27).vir
Samp(28).vir
Samp(3).vir
Samp(33).vir
Samp(36).vir
Samp(37).vir
Samp(39).vir
Samp(4).vir
Samp(44).vir
Samp(45).vir
Samp(46).vir
Samp(47).vir
Samp(48).vir
Samp(50).vir
Samp(6).vir
Samp(8).vir
Samp(9).vir

在以下文件中检测到恶意代码：
Samp(2).vir - HEUR:Trojan.Win32.Generic