EXE样本5X_266

QVM360

RT，未改后缀请小心食用，后果自负。。



载点：https://kafanealg.lanzous.com/ibknshe     密码：infected

病毒探索者

Malwarebytes


Scan
MD5         2/5 40.0%
Original    3/5 60.0%
UPX          2/3 66.7%


Run           
MD5         1/3 33.3%
Original    1/2 50.0%
UPX          0/1



In Total           69.2%

Xw1nd极风

Norton
扫描（10/13）=76.92%
双击（3/3）=100%

杀软小白鼠

Panda Dome
扫描2/13≈15.38%
双击1/11≈9.09%

ft-cai

Avira   


MD5  Scan 5/5  100%

Original  Scan 5/5  100%

UPX Scan 3/3  100% [1]

[1]:包含云2x：

1. 04/19/2020,10:43:17.419        [INFO]        FP 报告文件 'C:\Users\ft-cai\桌面\UPX\4.exe' 的“无误报”状态 [I:10, S:111]
   
2. 04/19/2020,10:43:17.424        [INFO]        文件 'C:\Users\ft-cai\桌面\UPX\4.exe' 已上传至 Protection Cloud 并已进行分析。 SHA256 = 64312A632066C16086FC993496FBFF88B8B5B09FB60DB0F4FCD65B429CCFB16A [I:2, S:0]
   
3. 04/19/2020,10:43:17.426        [INFO]        C:\Users\ft-cai\桌面\UPX\4.exe
   
4. 04/19/2020,10:43:17.428        [INFO]        [DETECTION] file contains 'TR/Ransom.CryptoWall.64312a'
   
5. 
   
6. 04/19/2020,10:43:50.139    [INFO]    FP 报告文件 'C:\Users\ft-cai\桌面\UPX\5.exe' 的“无误报”状态 [I:10, S:111]
   
7. 04/19/2020,10:43:50.142    [INFO]    文件 'C:\Users\ft-cai\桌面\UPX\5.exe' 已上传至 Protection Cloud 并已进行分析。 SHA256 = F84F712C4663A3D766C28AB06CD0431A34338D578850A210F5209708C51CB597 [I:2, S:0]
   
8. 04/19/2020,10:43:50.144    [INFO]    C:\Users\ft-cai\桌面\UPX\5.exe
   
9. 04/19/2020,10:43:50.145    [INFO]    [DETECTION] file contains 'TR/PSW.Stealer.f84f71'
   

复制代码

Nocria

IKARUS

不知是不是错觉，自从上次程序更新后，妖刀对抗MD5和UPX混淆的能力比之前强了不少。

Original - 4/5

1. [19.04.2020 10:57:15] On-demand scan started: "user_defined"
   
2. [19.04.2020 10:57:15] Found, 0.78s, SigName: "Trojan-PSW.Agent", SigId: 3775382, Type: "VIRUS", File: "C:\Users\promi\Desktop\EXE样本5X_266\EXE样本5X_266\Original\1.exe"
   
3. [19.04.2020 10:57:15] Found, 0.78s, SigName: "Trojan.MSIL.Crypt", SigId: 298177898, Type: "VIRUS", File: "C:\Users\promi\Desktop\EXE样本5X_266\EXE样本5X_266\Original\2.exe"
   
4. [19.04.2020 10:57:17] Found, 1.437s, SigName: "PUA.Multibar", SigId: 3548421, Type: "PUA", File: "C:\Users\promi\Desktop\EXE样本5X_266\EXE样本5X_266\Original\4.exe"
   
5. [19.04.2020 10:57:17] Found, 1.610s, SigName: "Trojan.Win32.Autoit", SigId: 3794850, Type: "VIRUS", File: "C:\Users\promi\Desktop\EXE样本5X_266\EXE样本5X_266\Original\5.exe"
   
6. [19.04.2020 10:57:17] On-demand scan FINISHED: "user_defined"
   
7. [19.04.2020 10:57:17] ----------------------------------------------------
   
8. [19.04.2020 10:57:17] Directories scanned: 1
   
9. [19.04.2020 10:57:17] Files scanned: 10
   
10. [19.04.2020 10:57:17] Virus found: 4
    
11. [19.04.2020 10:57:17] ----------------------------------------------------

复制代码

MD5 - 3/5

1. [19.04.2020 10:58:20] On-demand scan started: "user_defined"
   
2. [19.04.2020 10:58:20] Found, 0.62s, SigName: "Trojan-PSW.Agent", SigId: 3775382, Type: "VIRUS", File: "C:\Users\promi\Desktop\EXE样本5X_266\EXE样本5X_266\MD5\1.exe"
   
3. [19.04.2020 10:58:21] Found, 1.344s, SigName: "PUA.Multibar", SigId: 3548421, Type: "PUA", File: "C:\Users\promi\Desktop\EXE样本5X_266\EXE样本5X_266\MD5\4.exe"
   
4. [19.04.2020 10:58:22] Found, 1.484s, SigName: "Trojan.Win32.Autoit", SigId: 3794850, Type: "VIRUS", File: "C:\Users\promi\Desktop\EXE样本5X_266\EXE样本5X_266\MD5\5.exe"
   
5. [19.04.2020 10:58:22] On-demand scan FINISHED: "user_defined"
   
6. [19.04.2020 10:58:22] ----------------------------------------------------
   
7. [19.04.2020 10:58:22] Directories scanned: 1
   
8. [19.04.2020 10:58:22] Files scanned: 10
   
9. [19.04.2020 10:58:22] Virus found: 3
   
10. [19.04.2020 10:58:22] ----------------------------------------------------

复制代码

UPX - emptied

1. [19.04.2020 10:58:20] On-demand scan started: "user_defined"
   
2. [19.04.2020 10:58:20] Found, 0.62s, SigName: "Trojan-PSW.Agent", SigId: 3775382, Type: "VIRUS", File: "C:\Users\promi\Desktop\EXE样本5X_266\EXE样本5X_266\MD5\1.exe"
   
3. [19.04.2020 10:58:21] Found, 1.344s, SigName: "PUA.Multibar", SigId: 3548421, Type: "PUA", File: "C:\Users\promi\Desktop\EXE样本5X_266\EXE样本5X_266\MD5\4.exe"
   
4. [19.04.2020 10:58:22] Found, 1.484s, SigName: "Trojan.Win32.Autoit", SigId: 3794850, Type: "VIRUS", File: "C:\Users\promi\Desktop\EXE样本5X_266\EXE样本5X_266\MD5\5.exe"
   
5. [19.04.2020 10:58:22] On-demand scan FINISHED: "user_defined"
   
6. [19.04.2020 10:58:22] ----------------------------------------------------
   
7. [19.04.2020 10:58:22] Directories scanned: 1
   
8. [19.04.2020 10:58:22] Files scanned: 10
   
9. [19.04.2020 10:58:22] Virus found: 3
   
10. [19.04.2020 10:58:22] ----------------------------------------------------

复制代码

傲普斯顿

kaspersky:
MD5:清空
Original:清空
UPX:剩2个

a233

Avast
扫描(13/13) 100%

心醉咖啡

360

岚Azure

mcafee endpoint
扫描（13/13）=100%