可疑非PE样本19x

QVM360

https://lanzous.com/i9m2dhi

a233

Avast Kill 11X
其中修复1X

Miostartos

ESET 8x

Nocria

IKARUS - 11/19

1. [23.02.2020 19:13:07] On-demand scan started: "user_defined"
   
2. [23.02.2020 19:13:07] Found, 0.00s, SigName: "Trojan.Win32.Rozena", SigId: 268543971, Type: "VIRUS", File: "C:\Users\promi\Desktop\19x（20200223）\19x（20200223）\1_borabora_metallurgy-invite.pdf.hta"
   
3. [23.02.2020 19:13:07] Found, 0.47s, SigName: "Trojan.JS.Crypt", SigId: 3379521, Type: "VIRUS", File: "C:\Users\promi\Desktop\19x（20200223）\19x（20200223）\1.jar"
   
4. [23.02.2020 19:13:07] Found, 0.63s, SigName: "Trojan.Java.GenericGB", SigId: 293032524, Type: "VIRUS", File: "C:\Users\promi\Desktop\19x（20200223）\19x（20200223）\3.jar"
   
5. [23.02.2020 19:13:07] Found, 0.00s, SigName: "Trojan.SuspectCRC", SigId: 288648239, Type: "VIRUS", File: "C:\Users\promi\Desktop\19x（20200223）\19x（20200223）\Employee-entitlements-2020.doc"
   
6. [23.02.2020 19:13:07] Found, 0.15s, SigName: "Trojan-Downloader.VBS.Ursnif", SigId: 293148856, Type: "VIRUS", File: "C:\Users\promi\Desktop\19x（20200223）\19x（20200223）\job_presentation_g2s.js"
   
7. [23.02.2020 19:13:07] Found, 0.31s, SigName: "VBS.ObfDldr", SigId: 293134568, Type: "VIRUS", File: "C:\Users\promi\Desktop\19x（20200223）\19x（20200223）\JVC_36998.vbs"
   
8. [23.02.2020 19:13:07] Found, 0.16s, SigName: "Trojan-Downloader.O97M.Donoff", SigId: 293076899, Type: "VIRUS", File: "C:\Users\promi\Desktop\19x（20200223）\19x（20200223）\Myriam_Marinna_987080.doc"
   
9. [23.02.2020 19:13:08] Found, 0.31s, SigName: "Exploit.Office.Doc", SigId: 3735052, Type: "VIRUS", File: "C:\Users\promi\Desktop\19x（20200223）\19x（20200223）\PO_6008570AZ.doc"
   
10. [23.02.2020 19:13:08] Found, 0.00s, SigName: "Trojan.PowerShell.Splitfuse", SigId: 293052137, Type: "VIRUS", File: "C:\Users\promi\Desktop\19x（20200223）\19x（20200223）\sample1.xlsm"
    
11. [23.02.2020 19:13:08] Found, 0.16s, SigName: "Trojan-Downloader.Script", SigId: 280856666, Type: "VIRUS", File: "C:\Users\promi\Desktop\19x（20200223）\19x（20200223）\test.xlsm"
    
12. [23.02.2020 19:13:08] Found, 0.16s, SigName: "Exploit.CVE2012-0158", SigId: 3393716, Type: "VIRUS", File: "C:\Users\promi\Desktop\19x（20200223）\19x（20200223）\x.doc"
    
13. [23.02.2020 19:13:08] On-demand scan FINISHED: "user_defined"
    
14. [23.02.2020 19:13:08] ----------------------------------------------------
    
15. [23.02.2020 19:13:08] Directories scanned: 2
    
16. [23.02.2020 19:13:08] Files scanned: 20
    
17. [23.02.2020 19:13:08] Virus found: 11
    
18. [23.02.2020 19:13:08] ----------------------------------------------------

复制代码

swizzer

智量13x

ox400000

gdata解压后报毒10x,右键扫描后报2x

浅暮、浅离

卡巴检测14x

cooling

智量扫描发现13个，火绒扫描发现4个

汝航

智量实防kill 12X，扫描kill 1X，剩下一些网页，双击微点，智量均miss

沈志鸣

卡巴斯基扫描 kill 15x，实杀 12x（打开了解析电子邮件格式）
双击kill
bUrxr_enc.vbe
cjLXbHZSRHeL.vbs
job_presentation_g2s.js
JVC_36998.vbs
另外两个html都指向钓鱼网站
还有一个php就不双击了