EXE样本5X_176

swizzer

QVM360 发表于 2020-3-3 10:00
我记得有一个是msi文件

应该还有个vbs
----------------------更新----------------------
看错了，有一个是.iso

Nocria

IKARUS - 4/5

1. [03.03.2020 10:38:45] On-demand scan started: "user_defined"
   
2. [03.03.2020 10:38:45] Found, 0.16s, SigName: "Trojan-Downloader.VBS.Agent", SigId: 3493953, Type: "VIRUS", File: "C:\Users\promi\Desktop\EXE样本5X_176\EXE样本5X_176\#176 (2).vir"
   
3. [03.03.2020 10:38:45] Found, 0.16s, SigName: "Backdoor.Win32.DarkKomet", SigId: 2446933, Type: "VIRUS", File: "C:\Users\promi\Desktop\EXE样本5X_176\EXE样本5X_176\#176 (3).vir"
   
4. [03.03.2020 10:38:45] Found, 0.32s, SigName: "Trojan.Win32.Injector", SigId: 293778799, Type: "VIRUS", File: "C:\Users\promi\Desktop\EXE样本5X_176\EXE样本5X_176\#176 (4).vir"
   
5. [03.03.2020 10:38:45] Found, 0.234s, SigName: "PUA.InstallCore", SigId: 3761005, Type: "VIRUS", File: "C:\Users\promi\Desktop\EXE样本5X_176\EXE样本5X_176\#176 (5).vir"
   
6. [03.03.2020 10:38:46] On-demand scan FINISHED: "user_defined"
   
7. [03.03.2020 10:38:46] ----------------------------------------------------
   
8. [03.03.2020 10:38:46] Directories scanned: 2
   
9. [03.03.2020 10:38:46] Files scanned: 5
   
10. [03.03.2020 10:38:46] Virus found: 4
    
11. [03.03.2020 10:38:46] ----------------------------------------------------

复制代码

45her

诺顿余两个

www-tekeze

智量看8楼，火绒杀一个，双击不玩。

www-tekeze

swizzer 发表于 2020-3-3 09:49
智量3x，剩余双击报错

#2是msi，恢复后缀入库杀，#4是iso，装载后得到Scan_Document.exe，同样已入库。。

bbszy

anthonyqian 发表于 2020-3-3 10:04
诺顿 missed all

检查网络。。。

bbszy

诺顿剩余2、4号
2号是doc，双击诺顿没反应
4号是iso，解压后诺顿杀：
Filename: Scan_Document.exe
Threat name: Heur.AdvML.CFull Path: E:\Scan_Document.exe

____________________________

____________________________


On computers as of
3/3/2020 at 3:54:50 PM

Last Used
3/3/2020 at 3:54:50 PM

Startup Item
No

Launched
No

Threat type: Heuristic Virus. Detection of a threat based on malware heuristics.


____________________________


Scan_Document.exe Threat name: Heur.AdvML.C
Locate


Few Users
Fewer than 50 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media


____________________________

File Actions

File: E:\ Scan_Document.exe Blocked
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

心醉咖啡

360

1. 360杀毒扫描日志
   
2. 
   
3. 病毒库版本：
   
4. 扫描时间：2020-03-03 20:26:45
   
5. 扫描用时：00:00:01
   
6. 扫描类型：右键扫描
   
7. 扫描文件总数：5
   
8. 项目总数：3
   
9. 清除项目数：3
   
10. 
    
11. 扫描选项
    
12. ----------------------
    
13. 扫描所有文件：是
    
14. 扫描压缩包：是
    
15. 发现病毒处理方式：由用户选择处理
    
16. 扫描磁盘引导区：是
    
17. 扫描 Rootkit：是
    
18. 使用云查杀引擎：是
    
19. 使用QVM人工智能引擎：是
    
20. 扫描建议修复项：是
    
21. 常规引擎设置：未使用
    
22. 
    
23. 扫描内容
    
24. ----------------------
    
25. F:\浏览器下载\EXE样本5X_176
    
26. 
    
27. 
    
28. 白名单设置
    
29. ----------------------
    
30. 
    
31. 
    
32. 扫描结果
    
33. ======================
    
34. 高危风险项
    
35. ----------------------
    
36. F:\浏览器下载\EXE样本5X_176\#176 (1).vir        木马程序(Generic/Trojan.BO.dff)        已删除
    
37. F:\浏览器下载\EXE样本5X_176\#176 (3).vir        木马程序(Generic/Trojan.21a)        已删除
    
38. F:\浏览器下载\EXE样本5X_176\#176 (5).vir        木马程序(Generic/HEUR/QVM20.1.9E5D.Malware.Gen)        已删除
    
39. 
    

复制代码