EXE样本5X_5

www-tekeze

RT，想双击自己改后缀，风险自负。。   密码：infected

ATP_synthase

卡巴清空

hsmAllen

avast premium
解压杀样本1234,5号扫描未发现问题，准备用沙盒
在沙盒中调用命令提示符

YU2711

Avira KILL ALL

1. 01/22/2019,20-29-48        [INFO]        FP reports status 'NO False Positive' for file 'c:\idm\idm\downloads\compressed\exe样本_5\Samp(1).vir'
   
2. 01/22/2019,20-29-48        [INFO]        c:\idm\idm\downloads\compressed\exe样本_5\Samp(1).vir
   
3. 01/22/2019,20-29-48        [INFO]        [DETECTION] file contains 'HEUR/AGEN.1007105'
   
4. 01/22/2019,20-29-51        [INFO]        FP reports status 'NO False Positive' for file 'c:\idm\idm\downloads\compressed\exe样本_5\Samp(2).vir'
   
5. 01/22/2019,20-29-51        [INFO]        Successful Cloud SDK initialization and license check.
   
6. 01/22/2019,20-29-51        [INFO]        The file 'c:\idm\idm\downloads\compressed\exe样本_5\Samp(2).vir' was scanned with the Protection Cloud. SHA256 = 52C84E9F8BE452405BDC6DAC12518A04509E8D34D16633E11F707F493ED4F9A7
   
7. 01/22/2019,20-29-51        [INFO]        c:\idm\idm\downloads\compressed\exe样本_5\Samp(2).vir
   
8. 01/22/2019,20-29-51        [INFO]        [DETECTION] file contains 'TR/AD.Gootkit.B'
   
9. 01/22/2019,20-29-52        [INFO]        FP reports status 'NO False Positive' for file 'c:\idm\idm\downloads\compressed\exe样本_5\Samp(3).vir'
   
10. 01/22/2019,20-29-52        [INFO]        The file 'c:\idm\idm\downloads\compressed\exe样本_5\Samp(3).vir' was scanned with the Protection Cloud. SHA256 = 98E832E8D670DAED18A0449113B7AE909CFCE32C49F6A2A048893C95CAD2BBE8
    
11. 01/22/2019,20-29-52        [INFO]        c:\idm\idm\downloads\compressed\exe样本_5\Samp(3).vir
    
12. 01/22/2019,20-29-52        [INFO]        [DETECTION] file contains 'TR/Crypt.ZPACK.98e832'
    
13. 01/22/2019,20-30-07        [INFO]        FP reports status 'NO False Positive' for file 'c:\idm\idm\downloads\compressed\exe样本_5\Samp(4).vir'
    
14. 01/22/2019,20-30-07        [INFO]        The file 'c:\idm\idm\downloads\compressed\exe样本_5\Samp(4).vir' has been uploaded to the Protection Cloud and analyzed. SHA256 = 74774BB12512E1266BFDAEBAF80151396B9433565B396DE0BC647988F018C6F2
    
15. 01/22/2019,20-30-07        [INFO]        c:\idm\idm\downloads\compressed\exe样本_5\Samp(4).vir
    
16. 01/22/2019,20-30-07        [INFO]        [DETECTION] file contains 'TR/Crypt.ZPACK.74774b'
    
17. 01/22/2019,20-30-21        [INFO]        FP reports status 'NO False Positive' for file 'c:\idm\idm\downloads\compressed\exe样本_5\Samp(5).vir'
    
18. 01/22/2019,20-30-21        [INFO]        The file 'c:\idm\idm\downloads\compressed\exe样本_5\Samp(5).vir' has been uploaded to the Protection Cloud and analyzed. SHA256 = 5649CF2E051F740FED67F9FA56DA3928389E5FF385E186EFD31DABF3947A50B9
    
19. 01/22/2019,20-30-21        [INFO]        c:\idm\idm\downloads\compressed\exe样本_5\Samp(5).vir
    
20. 01/22/2019,20-30-21        [INFO]        [DETECTION] file contains 'HEUR/APC'

复制代码

www-tekeze

安天智甲，kill 2X 。

傻瓜爱笨蛋

avast高级版 报毒四个剩余一个已上报

www-tekeze

管家无BD，kill 1X 。

zdlzp

360卫士12

发现3个危险项
建议隔离Win32/Trojan.Downloader.ald
C:\\Documents and Settings\\Adninistrator\\桌面\\EXE样本_5\\Samp(2）.exe
建议隔离HEUR/QVI20.1.AEEF.Malware.Gen
C：\\Docunents and Settings\\Adnministrator\\桌面\\EXE样本_5\\Samp(3）.exe
建议隔离ER/QVM13.0.B783.Malware.Gen
C：\\Docunents and Settings\\Adnministrator\\桌面\\EXE样本_5\\Samp (5）.exe

运行：

木马文件：C:\\Documents and Settings
\\Administrator\\桌面\\EXE样本_5\\Samp(4）.exe
木马名称：Win32/Trojan.9d7
有木马试图攻击您的电脑，360已成功拦截。

Samp(1).exe不是有效的WIN32位应用程序

WHALE-FALL

FSP
扫描报告
2019年1月22日 20:35:57 - 20:36:08
扫描类型： 病毒扫描
目标： "D:\下载\EXE样本_5"
结果
已扫描项目： 5
找到的恶意项目： 5
详细信息
Heuristic.HEUR/AGEN.1007105
D:\下载\EXE样本_5\Samp(1).vir: 已清除
TR/Crypt.ZPACK.98e832
D:\下载\EXE样本_5\Samp(3).vir: 已清除
TR/Crypt.ZPACK.74774b
D:\下载\EXE样本_5\Samp(4).vir: 已清除
TR/AD.GandCrab.5649cf
D:\下载\EXE样本_5\Samp(5).vir: 已清除
TR/AD.Gootkit.B
D:\下载\EXE样本_5\Samp(2).vir: 已清除

fever腾腾

360TS kill 4x

PS：处理失败，不知道是不是我自己的问题....