每日甜点包

PINCER

来源：Anyrun
数量：应该是5个
质量：Just so so~ 有能全过的，也有能全杀的
口味：#Exploit 为主 可能会有 #Stealer

样本链接：https://send.firefox.com/downloa ... mDYodcJ-qwsf0OzA_3w

密码：infected

a233

AVG报11项清空

Nocria

IKARUS - 3/5

1. [21.05.2020 14:02:07] On-demand scan started: "user_defined"
   
2. [21.05.2020 14:02:08] Found, 0.188s, SigName: "Trojan.Win32.NjRat", SigId: 299887328, Type: "VIRUS", File: "C:\Users\promi\Desktop\1 vps\1 vps\2.bin"
   
3. [21.05.2020 14:02:08] Found, 0.15s, SigName: "Exploit.CVE-2017-11882", SigId: 3283595, Type: "VIRUS", File: "C:\Users\promi\Desktop\1 vps\1 vps\RFQ.xlsx"
   
4. [21.05.2020 14:02:08] Found, 0.00s, SigName: "Trojan.MSIL.Agent", SigId: 3692053, Type: "VIRUS", File: "C:\Users\promi\Desktop\1 vps\1 vps\TESTE.bin"
   
5. [21.05.2020 14:02:08] On-demand scan FINISHED: "user_defined"
   
6. [21.05.2020 14:02:08] ----------------------------------------------------
   
7. [21.05.2020 14:02:08] Directories scanned: 2
   
8. [21.05.2020 14:02:08] Files scanned: 5
   
9. [21.05.2020 14:02:08] Virus found: 3
   
10. [21.05.2020 14:02:08] ----------------------------------------------------
    

复制代码

G DATA emptied.

54ss

Bitdefender 清空
C:\Users\ljsjo\Downloads\1 vps.zip=>1 vps=>2.bin=>(RAR Sfx o)=>calc.exe Trojan.GenericKD.33753002 Moved to Quarantine
C:\Users\ljsjo\Downloads\1 vps.zip=>1 vps=>2.bin=>(RAR Sfx o)=>[Comment] Trojan.Uztuby.15 Moved to Quarantine
C:\Users\ljsjo\Downloads\1 vps.zip=>1 vps=>2.bin=>(RAR Sfx o)=>calculator.exe Gen:Variant.Zusy.93645 Moved to Quarantine
C:\Users\ljsjo\Downloads\1 vps.zip=>1 vps=>2.bin=>(RAR Sfx o)=>99.exe Trojan.GenericKD.33739367 Moved to Quarantine
C:\Users\ljsjo\Downloads\1 vps.zip=>1 vps=>RFQ.xlsx=>xl/embeddings/oleObject1.bin Exploit.CVE-2017-11882.Gen Deleted
C:\Users\ljsjo\Downloads\1 vps.zip=>1 vps=>2.bin=>(RAR Sfx o)=>calc.vbs=>(unicode) VBS.Worm.Dunihi.2.Gen Moved to Quarantine
C:\Users\ljsjo\Downloads\1 vps.zip=>1 vps=>ASD0493564QE.xlsx=>(Encrypted Package)=>xl/embeddings/oleObject1.bin Exploit.CVE-2017-11882.Gen Moved to Quarantine
C:\Users\ljsjo\Downloads\1 vps.zip=>1 vps/ASD0493564QE.xlsx  Moved to Quarantine
C:\Users\ljsjo\Downloads\1 vps.zip=>1 vps/Costco New Order Ref52120.xlsx  Moved to Quarantine
C:\Users\ljsjo\Downloads\1 vps.zip=>1 vps=>Costco New Order Ref52120.xlsx=>(Encrypted Package)=>xl/embeddings/oleObject1.bin Exploit.CVE-2017-11882.Gen Moved to Quarantine
C:\Users\ljsjo\Downloads\1 vps.zip=>1 vps/TESTE.bin Gen:Variant.Ransom.Samas.9 Deleted

我如浮云般飘过

卡巴 清空

1. 21.05.2020 14.05.35        检测到的对象 ( 文件 ) 已删除        E:\sample\1 vps\ASD0493564QE.xlsx//encrypted//xl/embeddings/oleObject1.bin//exploit        文件: E:\sample\1 vps\ASD0493564QE.xlsx//encrypted//xl/embeddings/oleObject1.bin//exploit        对象名称: HEUR:Exploit.MSOffice.Generic        对象类型: 木马程序        时间: 2020/5/21 14:05
   
2. 21.05.2020 14.05.35        检测到的对象 ( 文件 ) 已删除        E:\sample\1 vps\ASD0493564QE.xlsx        文件: E:\sample\1 vps\ASD0493564QE.xlsx        时间: 2020/5/21 14:05
   
3. 21.05.2020 14.05.34        检测到的对象 ( 文件 ) 已删除        E:\sample\1 vps\Costco New Order Ref52120.xlsx        文件: E:\sample\1 vps\Costco New Order Ref52120.xlsx        时间: 2020/5/21 14:05
   
4. 21.05.2020 14.05.34        检测到的对象 ( 文件 ) 已删除        E:\sample\1 vps\Costco New Order Ref52120.xlsx//encrypted//xl/embeddings/oleObject1.bin//exploit        文件: E:\sample\1 vps\Costco New Order Ref52120.xlsx//encrypted//xl/embeddings/oleObject1.bin//exploit        对象名称: HEUR:Exploit.MSOffice.Generic        对象类型: 木马程序        时间: 2020/5/21 14:05
   
5. 21.05.2020 14.05.34        检测到的对象 ( 文件 ) 已删除        E:\sample\1 vps\RFQ.xlsx        文件: E:\sample\1 vps\RFQ.xlsx        对象名称: UDS:DangerousObject.Multi.Generic        时间: 2020/5/21 14:05
   
6. 21.05.2020 14.05.34        检测到的对象 ( 文件 ) 已删除        E:\sample\1 vps\RFQ.xlsx//xl/embeddings/oleObject1.bin//exploit        文件: E:\sample\1 vps\RFQ.xlsx//xl/embeddings/oleObject1.bin//exploit        对象名称: HEUR:Exploit.MSOffice.Generic        对象类型: 木马程序        时间: 2020/5/21 14:05
   
7. 21.05.2020 14.05.33        检测到的对象 ( 文件 ) 已删除        E:\sample\1 vps\2.bin        文件: E:\sample\1 vps\2.bin        对象名称: UDS:DangerousObject.Multi.Generic        时间: 2020/5/21 14:05
   
8. 21.05.2020 14.05.33        检测到的对象 ( 文件 ) 已删除        E:\sample\1 vps\TESTE.bin        文件: E:\sample\1 vps\TESTE.bin        对象名称: HEUR:Backdoor.MSIL.Crysan.gen        对象类型: 木马程序        时间: 2020/5/21 14:05

复制代码

傻猪猪米走鸡

ESET
Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
2020/5/21 14:14:00;Real-time file system protection;file;C:\Users\Galaxy\Downloads\1 vps\1 vps\RFQ.xlsx;probably a variant of Win32/Exploit.CVE-2017-11882.C trojan;cleaned by deleting;DESKTOP-NV3EN59\Galaxy;Event occurred on a new file created by the application: C:\Program Files\Bandizip\Bandizip.exe (45DB9445A28E458404D6BEC38399ABE9631CB54C).;795A4BD846A4D0941C7DC5F582E6E01897D1BC6F;
2020/5/21 14:14:03;Real-time file system protection;file;C:\Users\Galaxy\Downloads\1 vps\1 vps\TESTE.bin;a variant of MSIL/Agent.CFQ trojan;cleaned by deleting;DESKTOP-NV3EN59\Galaxy;Event occurred on a new file created by the application: C:\Program Files\Bandizip\Bandizip.exe (45DB9445A28E458404D6BEC38399ABE9631CB54C).;8617D054868A777CE6579936DAB7B919816E969C;2020/5/20 2:08:49
2020/5/21 14:14:10;Real-time file system protection;file;C:\Users\Galaxy\Downloads\1 vps\1 vps\2.bin;multiple threats;cleaned by deleting;DESKTOP-NV3EN59\Galaxy;Event occurred on a new file created by the application: C:\Program Files\Bandizip\Bandizip.exe (45DB9445A28E458404D6BEC38399ABE9631CB54C).;C28BB395E035D8CC738BB7A88A24408B29178528;

Log
Scan Log
Version of detection engine: 21362P (20200521)
Date: 2020/5/21  Time: 14:14:24
Scanned disks, folders and files: C:\Users\Galaxy\Downloads\1 vps\1 vps\Costco New Order Ref52120.xlsx;C:\Users\Galaxy\Downloads\1 vps\1 vps\ASD0493564QE.xlsx
C:\Users\Galaxy\Downloads\1 vps\1 vps\ASD0493564QE.xlsx » OFFICECRYPTOGRAPHY » ASD0493564QE.xlsx » ZIP » xl/embeddings/oleObject1.bin - probably a variant of Win32/Exploit.CVE-2017-11882.C trojan - deleted
C:\Users\Galaxy\Downloads\1 vps\1 vps\Costco New Order Ref52120.xlsx » OFFICECRYPTOGRAPHY » Costco New Order Ref52120.xlsx » ZIP » xl/embeddings/oleObject1.bin - probably a variant of Win32/Exploit.CVE-2017-11882.C trojan - deleted
Number of scanned objects: 48
Number of detections: 2
Number of cleaned objects: 2
Time of completion: 14:14:25  Total scanning time: 1 sec (00:00:01)

心醉咖啡

应该被人扫过了，毒霸

1. 扫描时间：[2020-05-21 15:25:55]
   
2. 扫描用时：[00:00:10]
   
3. 扫描类型：自定义查杀
   
4. 扫描文件总数：19
   
5. 扫描速度：1文件/秒
   
6. 发现威胁：4个
   
7. 清除威胁：4个
   
8. =============================================
   
9. [2020-05-21 15:26:12]
   
10. 威胁：e:\浏览器下载\1 vps\2.bin
    
11. 类型：win32.troj.undef.(kcloud)
    
12. 处理方式：删除
    
13. 
    
14. [2020-05-21 15:26:12]
    
15. 威胁：e:\浏览器下载\1 vps\asd0493564qe.xlsx
    
16. 类型：win32.scriptc.undef.a.(kcloud)
    
17. 处理方式：修复
    
18. 
    
19. [2020-05-21 15:26:12]
    
20. 威胁：e:\浏览器下载\1 vps\costco new order ref52120.xlsx
    
21. 类型：win32.scriptc.undef.a.(kcloud)
    
22. 处理方式：修复
    
23. 
    
24. [2020-05-21 15:26:12]
    
25. 威胁：e:\浏览器下载\1 vps\teste.bin
    
26. 类型：win32.hack.undef.(kcloud)
    
27. 处理方式：删除
    
28. 
    

复制代码

虫の空灵

SEP 3/5 留ASD0493564QE 和 Costco New Order Ref52120

1. 文件名        风险        操作        风险类型
   
2. oleObject1.bin        Exp.CVE-2017-11882!g3        已隔离        压缩的文件; 启发式病毒
   
3. RFQ.xlsx        Exp.CVE-2017-11882!g3        已隔离        压缩的文件; 启发式病毒
   
4. 2.bin        Trojan.Gen.MBT        已通过删除清除        病毒
   
5. RFQ.xlsx        Exp.CVE-2017-11882!g2        已清除        启发式病毒
   
6. TESTE.bin        Heur.AdvML.C        已通过删除清除        启发式病毒
   
7. TESTE.bin        Trojan.Gen.MBT        已清除        病毒
   

复制代码

PINCER

居然没有人测火绒 我挺想看看火绒的入库效率的

火绒
20200520 16：26  毒库
scan miss all

Update：经上报，已可以查杀（火绒团队的服务态度是真的赞回复也很快）

ELOHIM

微软扫描剩下这个：Costco New Order Ref52120.xlsx。