20x (19.10.09)

swizzer

MES Artemis&RealProtect均拉至最高敏感度，双击，最终剩余六个

cect258

www-tekeze 发表于 2019-10-10 11:47
多次扫描。。。360 Killed 14X，微点 Scan Killed 7X 。

微点 现在扫描 删除18个  剩余2个

桑德尔

瑞星剩余15个

mr_bean_forever

eset 删除12个，修复5个，共17个。剩余3个

jdsh

Emsisoft Anti-Malware
实时监控

双击运行


doc运行后都弹漏洞拦截

JS运行后

XLS运行后

2个DOCM运行后

最后剩余3个由WD拦截

wajika

SAVScan virus detection utility
Version 5.63.0 [Linux/AMD64]
Virus data version 5.68, September 2019
Includes detection for 41977552 viruses, Trojans and worms
Copyright (c) 1989-2019 Sophos Limited. All rights reserved.

System time 12:46:08 PM, System date 11 October 2019
Command line qualifiers are: -all -pua -archive -mime -suspicious

IDE directory is: /usr/local/sophos/lib/sav

Using IDE file dofoi-gd.ide
Using IDE file banl-csq.ide
Using IDE file spy-aya.ide
Using IDE file inje-enb.ide
Using IDE file teslaa-h.ide
Using IDE file rans-fpo.ide
Using IDE file blada-yp.ide
Using IDE file miner-up.ide
Using IDE file atmrip-b.ide
Using IDE file zbot-nnz.ide
Using IDE file steal-yv.ide
Using IDE file drid-abx.ide
Using IDE file msil-msc.ide
Using IDE file docd-vlz.ide
Using IDE file dneti-el.ide
Using IDE file fare-ist.ide
Using IDE file phis-fxg.ide
Using IDE file trikb-ek.ide
Using IDE file remco-li.ide
Using IDE file dneti-em.ide
Using IDE file encdo-mz.ide
Using IDE file hupig-xh.ide
Using IDE file puma-y.ide
Using IDE file orcusr-f.ide
Using IDE file truebo-c.ide
Using IDE file remco-lk.ide
Using IDE file apost-o.ide
Using IDE file lokib-dw.ide
Using IDE file andro-tv.ide
Using IDE file autinj-j.ide
Using IDE file miner-vb.ide
Using IDE file blada-zj.ide
Using IDE file bifro-bm.ide
Using IDE file grmasi-a.ide
Using IDE file netwi-nz.ide
Using IDE file wont-afr.ide
Using IDE file formb-by.ide
Using IDE file fare-ium.ide
Using IDE file blada-zz.ide
Using IDE file dldr-sd.ide
Using IDE file msil-mtj.ide
Using IDE file fare-iuo.ide
Using IDE file nanoc-xj.ide
Using IDE file docd-vob.ide
Using IDE file msil-mtl.ide
Using IDE file phobo-g.ide
Using IDE file vb-kme.ide
Using IDE file keylo-xh.ide
Using IDE file nukesp-d.ide
Using IDE file teslaa-k.ide
Using IDE file inje-eou.ide
Using IDE file pirpi-e.ide
Using IDE file darkc-it.ide
Using IDE file urela-ap.ide
Using IDE file bat-gp.ide
Using IDE file rans-fqc.ide
Using IDE file netwi-oa.ide
Using IDE file msil-mum.ide
Using IDE file zbot-noz.ide
Using IDE file fare-iwk.ide
Using IDE file gozi-su.ide
Using IDE file keylo-xk.ide
Using IDE file dofoi-ge.ide
Using IDE file batdrp-x.ide
Using IDE file upatr-yv.ide
Using IDE file zbot-npe.ide
Using IDE file msil-muu.ide
Using IDE file vb-kml.ide
Using IDE file msil-muv.ide
Using IDE file formb-rt.ide
Using IDE file trick-sq.ide
Using IDE file hawke-ya.ide
Using IDE file blada-af.ide
Using IDE file dneti-gz.ide
Using IDE file dofoi-gg.ide
Using IDE file emot-bgf.ide
Using IDE file emot-bgi.ide
Using IDE file emot-bgj.ide
Using IDE file formb-rv.ide
Using IDE file azoru-cg.ide
Using IDE file emot-bgl.ide
Using IDE file age-bcpy.ide
Using IDE file pdfu-hsd.ide
Using IDE file dofoi-gh.ide
Using IDE file remco-mb.ide
Using IDE file qakbo-dj.ide
Using IDE file inje-ept.ide
Using IDE file htmld-ml.ide
Using IDE file sinow-cj.ide
Using IDE file phis-gaq.ide
Using IDE file miner-vl.ide
Using IDE file cobmin-b.ide
Using IDE file emot-bhe.ide
Using IDE file blada-bd.ide
Using IDE file azden-b.ide
Using IDE file trick-sv.ide
Using IDE file xtbl-ei.ide
Using IDE file hawke-yi.ide
Using IDE file nanoc-yp.ide
Using IDE file docdr-no.ide
Using IDE file phis-gay.ide
Using IDE file inje-epx.ide
Using IDE file blada-bg.ide
Using IDE file vb-kmq.ide
Using IDE file docd-vuf.ide
Using IDE file emot-bhx.ide
Using IDE file dneti-ie.ide
Using IDE file spy-ayj.ide
Using IDE file qbot-fd.ide
Using IDE file bckd-rwg.ide
Using IDE file docd-vvm.ide
Using IDE file ryuk-v.ide
Using IDE file qakbo-dk.ide
Using IDE file trick-sx.ide
Using IDE file rtfd-alm.ide
Using IDE file docd-vwh.ide
Using IDE file drid-acd.ide
Using IDE file keylo-xu.ide
Using IDE file emot-bjo.ide
Using IDE file blada-rx.ide
Using IDE file emot-bfj.ide
Using IDE file hawke-uc.ide
Using IDE file zbot-nhi.ide
Using IDE file msil-miz.ide
Using IDE file emot-bjp.ide
Using IDE file steal-sa.ide
Using IDE file delf-hda.ide
Using IDE file phis-fjh.ide
Using IDE file htmld-kw.ide
Using IDE file nemty-c.ide
Using IDE file delf-hds.ide
Using IDE file phis-fkc.ide
Using IDE file zbot-nid.ide
Using IDE file qakbo-dl.ide
Using IDE file azoru-ck.ide
Using IDE file phorpi-o.ide
Using IDE file docd-uib.ide
Using IDE file netwi-nu.ide
Using IDE file psdl-dw.ide
Using IDE file emot-bib.ide
Using IDE file emot-bkm.ide
Using IDE file emot-bkp.ide
Using IDE file hawke-zf.ide
Using IDE file docd-urj.ide
Using IDE file keylo-xt.ide
Using IDE file offdde-j.ide
Using IDE file emot-blh.ide
Using IDE file emot-bli.ide
Using IDE file phis-gcp.ide
Using IDE file msil-mxy.ide
Using IDE file dneti-jc.ide
Using IDE file msil-mxz.ide
Using IDE file nanoc-pg.ide
Using IDE file azoru-cm.ide
Using IDE file lokib-du.ide
Using IDE file hawke-zi.ide
Using IDE file formb-sj.ide
Using IDE file fare-iyd.ide
Using IDE file emot-blq.ide
Using IDE file azoru-cq.ide
Using IDE file steal-we.ide
Using IDE file teslaa-r.ide
Using IDE file bank-gys.ide
Using IDE file formb-sl.ide
Using IDE file vb-kmp.ide
Using IDE file retefe-p.ide
Using IDE file wont-afq.ide
Using IDE file nemty-d.ide
Using IDE file teslaa-y.ide
Using IDE file emot-bms.ide

Quick Scanning

>>> Virus 'Mal/EncPk-APC' found in file /opt/samples_10_09_19_20x/Kafan_Sample_0ceb1ab2bc03b840c03b5fcaba8397ee8d0f3877b73fff22e7bc50ab5c596821.exe
>>> Virus 'Mal/EncPk-APC' found in file /opt/samples_10_09_19_20x/Kafan_Sample_289c04314df3679f04bf1817fbf1589fb19dbd481f8c20daac8861068a7c5a32.exe
>>> Virus 'Troj/Zbot-NRP' found in file /opt/samples_10_09_19_20x/Kafan_Sample_28c95db7f9ffb75819a67091135898c091256cacd0d764f8ff0b9e8261e295ed.exe
>>> Virus 'Mal/EncPk-APC' found in file /opt/samples_10_09_19_20x/Kafan_Sample_6d68d21a0635b1bbe2335d4e2cb3e34c8a0d69e320725849465ac3a5ab11b31e.exe
>>> Virus 'Troj/DocDl-UIQ' found in file /opt/samples_10_09_19_20x/Kafan_Sample_766c7fd921fc9ac3adccacfb7c85b028a18ae4e33667171163387ee465429df5.DOC
>>> Virus 'Troj/Netwire-MS' found in file /opt/samples_10_09_19_20x/Kafan_Sample_8467b9c03d03a88024fe8345be931fc831c21d62c0959affefeff9fb4038d7a0.exe
>>> Virus 'Troj/DocDl-VMC' found in file /opt/samples_10_09_19_20x/Kafan_Sample_931d1ad6bc9fdbe938fee3b750d58482060512dac3b1640147aff8d18804d968.DOC
>>> Virus 'Troj/DocDl-VMC' found in file /opt/samples_10_09_19_20x/Kafan_Sample_b30f1fd09bd273e81121a512243511aff9534a5aeb4ded398b14f3e58b10f45f.DOC
>>> Virus 'Mal/FareitVB-N' found in file /opt/samples_10_09_19_20x/Kafan_Sample_b3c9eea7b0b8247d81a8bfd94bb58d67afee08ae936b3ebe1303e89066c7dd51.exe
>>> Virus 'Mal/Generic-S' found in file /opt/samples_10_09_19_20x/Kafan_Sample_bdae5c4aef86d099c04ada5a2cca63c519199e19318da5558c3a3e16458d1571.exe
>>> Virus 'Troj/DocDl-VLR' found in file /opt/samples_10_09_19_20x/Kafan_Sample_ce2e6e21e48a05808a066b20bf233ba3963336ce10d272e9b4589eec9de0c57a.DOC
>>> Virus 'Troj/DocDrp-MJ' found in file /opt/samples_10_09_19_20x/Kafan_Sample_e9b9097bc5fd5501cac2ec5ec886fdaf00b60a48743393e8e8063357390e1b46.XLS
>>> Virus 'Mal/EncPk-APC' found in file /opt/samples_10_09_19_20x/Kafan_Sample_f4c4eec20fc332f2c59b3802f4e81bbcd85a54a5f54e627d6a2982f316af526f.exe
>>> Virus 'Troj/DocDl-VIM' found in file /opt/samples_10_09_19_20x/Kafan_Sample_f623bbeeea89387f78faf0f39fc1d2f082eee57683929657d652326ffb06d4d2.DOCM
>>> Virus 'Troj/DocDl-VMA' found in file /opt/samples_10_09_19_20x/Kafan_Sample_fb847e82ace6fa7c71a842b528ac6c6854cb62edc6b3e168522900507d261c67.DOC

20 files scanned in 35 seconds.
15 viruses were discovered.
No PUAs were discovered.
15 files out of 20 were infected.
If you need further advice regarding any detections please visit our
Threat Center at: http://www.sophos.com/en-us/threat-center.aspx
End of Scan.

wajika

F-PROT Antivirus CLS version 6.7.10.6267, 32bit (built: 2012-03-27T12-34-14)


FRISK Software International (C) Copyright 1989-2011
Engine version:   4.6.5.141
Arguments:        -r --adware --heurlevel=4 /opt/samples_10_09_19_20x/
Virus signatures: 201910110324
                  (/opt/f-prot/antivir.def)

[Found security risk] <W32/Agent.BGC.gen!Eldorado (generic, not disinfectable)>         /opt/samples_10_09_19_20x/Kafan_Sample_0ceb1ab2bc03b840c03b5fcaba8397ee8d0f3877b73fff22e7bc50ab5c596821.exe
[Found security risk] <W32/Agent.BGC.gen!Eldorado (generic, not disinfectable)>         /opt/samples_10_09_19_20x/Kafan_Sample_289c04314df3679f04bf1817fbf1589fb19dbd481f8c20daac8861068a7c5a32.exe
[Found security risk] <W32/Agent.BGC.gen!Eldorado (generic, not disinfectable)>         /opt/samples_10_09_19_20x/Kafan_Sample_6d68d21a0635b1bbe2335d4e2cb3e34c8a0d69e320725849465ac3a5ab11b31e.exe
[Found trojan] <New or modified W97M/Agent>         /opt/samples_10_09_19_20x/Kafan_Sample_766c7fd921fc9ac3adccacfb7c85b028a18ae4e33667171163387ee465429df5.DOC
[Found trojan] <New or modified W97M/Agent>         /opt/samples_10_09_19_20x/Kafan_Sample_931d1ad6bc9fdbe938fee3b750d58482060512dac3b1640147aff8d18804d968.DOC
[Found trojan] <New or modified W97M/Agent>         /opt/samples_10_09_19_20x/Kafan_Sample_b30f1fd09bd273e81121a512243511aff9534a5aeb4ded398b14f3e58b10f45f.DOC
[Found security risk] <W32/Agent.BGC.gen!Eldorado (generic, not disinfectable)>         /opt/samples_10_09_19_20x/Kafan_Sample_f4c4eec20fc332f2c59b3802f4e81bbcd85a54a5f54e627d6a2982f316af526f.exe
[Found trojan] <New or modified W97M/Agent>         /opt/samples_10_09_19_20x/Kafan_Sample_fb847e82ace6fa7c71a842b528ac6c6854cb62edc6b3e168522900507d261c67.DOC
Scanning: /

Results:

Files: 20
Skipped files: 0
MBR/boot sectors checked: 0
Objects scanned: 59
Infected objects: 8
Infected files: 14
Files with errors: 0
Disinfected: 0

wajika

McAfee VirusScan Command Line for Linux64 Version: 6.1.3.242
Copyright (C) 2019 McAfee, Inc.
(408) 988-3832 LICENSED COPY - September 24 2019

AV Engine version: 6010.8670 for Linux64.
Dat set version: 9406 created Oct 10 2019
Scanning for 668684 viruses, trojans and variants.

/opt/samples_10_09_19_20x/Kafan_Sample_01b924fe3d39db1b283dcfd602d8625913dcd34b5777b09471520f774912f537.JS ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_0ceb1ab2bc03b840c03b5fcaba8397ee8d0f3877b73fff22e7bc50ab5c596821.exe ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_289c04314df3679f04bf1817fbf1589fb19dbd481f8c20daac8861068a7c5a32.exe ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_28c95db7f9ffb75819a67091135898c091256cacd0d764f8ff0b9e8261e295ed.exe [MD5:5f2250ee99458c091bf9de55e20f6abc] ... Found the Fareit-FPT!5F2250EE9945 trojan !!!
/opt/samples_10_09_19_20x/Kafan_Sample_550723a6671cacf9252081a8ec0e110d63110942df7b4bccf34839e92f83c5be.vbs ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_6d68d21a0635b1bbe2335d4e2cb3e34c8a0d69e320725849465ac3a5ab11b31e.exe ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_766c7fd921fc9ac3adccacfb7c85b028a18ae4e33667171163387ee465429df5.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_766c7fd921fc9ac3adccacfb7c85b028a18ae4e33667171163387ee465429df5.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_766c7fd921fc9ac3adccacfb7c85b028a18ae4e33667171163387ee465429df5.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_766c7fd921fc9ac3adccacfb7c85b028a18ae4e33667171163387ee465429df5.DOC/WordDocument/ ... Found the W97M/Downloader.ip trojan !!!
/opt/samples_10_09_19_20x/Kafan_Sample_766c7fd921fc9ac3adccacfb7c85b028a18ae4e33667171163387ee465429df5.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_766c7fd921fc9ac3adccacfb7c85b028a18ae4e33667171163387ee465429df5.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_766c7fd921fc9ac3adccacfb7c85b028a18ae4e33667171163387ee465429df5.DOC/_VBA_PROJECT ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_766c7fd921fc9ac3adccacfb7c85b028a18ae4e33667171163387ee465429df5.DOC ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_8467b9c03d03a88024fe8345be931fc831c21d62c0959affefeff9fb4038d7a0.exe [MD5:34b271c62849aa29d2657d04f2a08b35] ... Found the GenericRXHY-GQ!34B271C62849 trojan !!!
/opt/samples_10_09_19_20x/Kafan_Sample_931d1ad6bc9fdbe938fee3b750d58482060512dac3b1640147aff8d18804d968.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_931d1ad6bc9fdbe938fee3b750d58482060512dac3b1640147aff8d18804d968.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_931d1ad6bc9fdbe938fee3b750d58482060512dac3b1640147aff8d18804d968.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_931d1ad6bc9fdbe938fee3b750d58482060512dac3b1640147aff8d18804d968.DOC/WordDocument/ ... Found the W97M/Downloader.ip trojan !!!
/opt/samples_10_09_19_20x/Kafan_Sample_931d1ad6bc9fdbe938fee3b750d58482060512dac3b1640147aff8d18804d968.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_931d1ad6bc9fdbe938fee3b750d58482060512dac3b1640147aff8d18804d968.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_931d1ad6bc9fdbe938fee3b750d58482060512dac3b1640147aff8d18804d968.DOC/_VBA_PROJECT ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_931d1ad6bc9fdbe938fee3b750d58482060512dac3b1640147aff8d18804d968.DOC ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_a64c48b7a8a1dc053cf1500c4b1c6957af53f5bffe9c1bb83ec0756381c48edb.exe/00202000.EXE ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_a64c48b7a8a1dc053cf1500c4b1c6957af53f5bffe9c1bb83ec0756381c48edb.exe ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_b30f1fd09bd273e81121a512243511aff9534a5aeb4ded398b14f3e58b10f45f.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_b30f1fd09bd273e81121a512243511aff9534a5aeb4ded398b14f3e58b10f45f.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_b30f1fd09bd273e81121a512243511aff9534a5aeb4ded398b14f3e58b10f45f.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_b30f1fd09bd273e81121a512243511aff9534a5aeb4ded398b14f3e58b10f45f.DOC/WordDocument/ ... Found the W97M/Downloader.ip trojan !!!
/opt/samples_10_09_19_20x/Kafan_Sample_b30f1fd09bd273e81121a512243511aff9534a5aeb4ded398b14f3e58b10f45f.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_b30f1fd09bd273e81121a512243511aff9534a5aeb4ded398b14f3e58b10f45f.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_b30f1fd09bd273e81121a512243511aff9534a5aeb4ded398b14f3e58b10f45f.DOC/_VBA_PROJECT ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_b30f1fd09bd273e81121a512243511aff9534a5aeb4ded398b14f3e58b10f45f.DOC ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_b3c9eea7b0b8247d81a8bfd94bb58d67afee08ae936b3ebe1303e89066c7dd51.exe [MD5:cded54e360b9383f991fbb9b67d5c0e3] ... Found the Fareit-FPT!CDED54E360B9 trojan !!!
/opt/samples_10_09_19_20x/Kafan_Sample_bdae5c4aef86d099c04ada5a2cca63c519199e19318da5558c3a3e16458d1571.exe ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_c025a6e1d81ade1fbfddfa968415e6344e869e1e44366158be304c446ca1578d.exe ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_ce2e6e21e48a05808a066b20bf233ba3963336ce10d272e9b4589eec9de0c57a.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_ce2e6e21e48a05808a066b20bf233ba3963336ce10d272e9b4589eec9de0c57a.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_ce2e6e21e48a05808a066b20bf233ba3963336ce10d272e9b4589eec9de0c57a.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_ce2e6e21e48a05808a066b20bf233ba3963336ce10d272e9b4589eec9de0c57a.DOC/WordDocument/ ... Found the W97M/Downloader.ip trojan !!!
/opt/samples_10_09_19_20x/Kafan_Sample_ce2e6e21e48a05808a066b20bf233ba3963336ce10d272e9b4589eec9de0c57a.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_ce2e6e21e48a05808a066b20bf233ba3963336ce10d272e9b4589eec9de0c57a.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_ce2e6e21e48a05808a066b20bf233ba3963336ce10d272e9b4589eec9de0c57a.DOC/_VBA_PROJECT ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_ce2e6e21e48a05808a066b20bf233ba3963336ce10d272e9b4589eec9de0c57a.DOC ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_df93a80147e7e52eb10e988ab7bd48610111f808c97bfb13bb26244245f34d1f.DOCM/word/_rels/document.xml.rels ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_df93a80147e7e52eb10e988ab7bd48610111f808c97bfb13bb26244245f34d1f.DOCM/word/document.xml ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_df93a80147e7e52eb10e988ab7bd48610111f808c97bfb13bb26244245f34d1f.DOCM/word/_rels/vbaProject.bin.rels ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_df93a80147e7e52eb10e988ab7bd48610111f808c97bfb13bb26244245f34d1f.DOCM/word/vbaProject.bin ... Found the RDN/Generic.ole trojan !!!
/opt/samples_10_09_19_20x/Kafan_Sample_df93a80147e7e52eb10e988ab7bd48610111f808c97bfb13bb26244245f34d1f.DOCM/word/media/image1.jpeg ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_df93a80147e7e52eb10e988ab7bd48610111f808c97bfb13bb26244245f34d1f.DOCM ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_e9b9097bc5fd5501cac2ec5ec886fdaf00b60a48743393e8e8063357390e1b46.XLS [MD5:9cc1c5833f94f4025dedd3fb625d403a] ... Found the RDN/Generic.com trojan !!!
/opt/samples_10_09_19_20x/Kafan_Sample_f4c4eec20fc332f2c59b3802f4e81bbcd85a54a5f54e627d6a2982f316af526f.exe [MD5:1ab175f95049f82ce936ac0fddadd7e9] ... Found the RDN/Generic.grp trojan !!!
/opt/samples_10_09_19_20x/Kafan_Sample_f623bbeeea89387f78faf0f39fc1d2f082eee57683929657d652326ffb06d4d2.DOCM/word/_rels/document.xml.rels ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_f623bbeeea89387f78faf0f39fc1d2f082eee57683929657d652326ffb06d4d2.DOCM/word/document.xml ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_f623bbeeea89387f78faf0f39fc1d2f082eee57683929657d652326ffb06d4d2.DOCM/word/_rels/vbaProject.bin.rels ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_f623bbeeea89387f78faf0f39fc1d2f082eee57683929657d652326ffb06d4d2.DOCM/word/vbaProject.bin/_VBA_PROJECT ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_f623bbeeea89387f78faf0f39fc1d2f082eee57683929657d652326ffb06d4d2.DOCM/word/vbaProject.bin ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_f623bbeeea89387f78faf0f39fc1d2f082eee57683929657d652326ffb06d4d2.DOCM/word/media/image1.jpeg ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_f623bbeeea89387f78faf0f39fc1d2f082eee57683929657d652326ffb06d4d2.DOCM ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_fb847e82ace6fa7c71a842b528ac6c6854cb62edc6b3e168522900507d261c67.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_fb847e82ace6fa7c71a842b528ac6c6854cb62edc6b3e168522900507d261c67.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_fb847e82ace6fa7c71a842b528ac6c6854cb62edc6b3e168522900507d261c67.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_fb847e82ace6fa7c71a842b528ac6c6854cb62edc6b3e168522900507d261c67.DOC/WordDocument/ ... Found the W97M/Downloader.ip trojan !!!
/opt/samples_10_09_19_20x/Kafan_Sample_fb847e82ace6fa7c71a842b528ac6c6854cb62edc6b3e168522900507d261c67.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_fb847e82ace6fa7c71a842b528ac6c6854cb62edc6b3e168522900507d261c67.DOC/WordDocument/ ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_fb847e82ace6fa7c71a842b528ac6c6854cb62edc6b3e168522900507d261c67.DOC/_VBA_PROJECT ... is OK.
/opt/samples_10_09_19_20x/Kafan_Sample_fb847e82ace6fa7c71a842b528ac6c6854cb62edc6b3e168522900507d261c67.DOC ... is OK.


Summary Report on /opt/samples_10_09_19_20x/
File(s)
        Total files:...................     20
        Clean:.........................     9
        Not Scanned:...................     0
        Possibly Infected:.............     11


Time: 00:00.01

QVM360

360和智量都是清空

LJC嘉成

卡绒 非启发式扫描 miss 1