【开放测试】卡饭病毒样本包 20200203 第120期

QVM360

样本下载地址：https://mc163.lanzoui.com/ioRoEl8xywd
样本数量：11
MD5：6D8DA902D246F35F736EDA813DA45FCB
样本质量：中

压缩包密码：infected
感谢提供样本的会员：QVM360





回帖格式不做要求。

QVM360

ZNW5c14gYC8hlY41S84m.docx后缀为rar

renyifei

BD 剩四个 ATD杀一个，共8个，剩下双击运行不了


Contextual ScanLog File
C:\ProgramData\Bitdefender\Desktop\Profiles\Logs\S-1-5-21-92440486-937513793-3260501739-1001\2ab858ed-450b-4bb6-b67c-8e3c45ec13ac\1612319844_1_02.xml
Scan date:2021年2月3日 10:37:44

Scanned items33

C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\2cX6wVQOf8Ub81P66Da9.exe

C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\2LBdfb3D22puXz3R2sPj.exe

C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\3dAE1W75832i92X0y34B.exe

C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\3rjggDMDeVkp8B014p9i.xls

C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\aF1MXLFlo46rviwMxHNu.doc

C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\jt8xad6BUFITYHA3BiJf.exe

C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\KtF9fwvm51EJk97TSnu4.exe

C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\xuazQtrycsmJE5d961vT.exe

C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\zDfeW61j06uGj8ynwU2X.exe

C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\ZNW5c14gYC8hlY41S84m.docx

C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\0c7v31VR5578RXb4S59e.js

Scan Results Summary
Resolved issues
[td]

Item path	Threat Name	Action taken
C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\3dAE1W75832i92X0y34B.exe	Generic.MSIL.PasswordStealerA.3FB9D228	Deleted
C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\KtF9fwvm51EJk97TSnu4.exe	Gen:Variant.Razy.832814	Deleted
C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\jt8xad6BUFITYHA3BiJf.exe=>(NSIS o)=>xdf.dll	Gen:Variant.Zusy.365405	Deleted
C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\2LBdfb3D22puXz3R2sPj.exe	Gen:Variant.Razy.836612	Deleted
C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\xuazQtrycsmJE5d961vT.exe	Gen:Variant.Razy.576379	Deleted
C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\2cX6wVQOf8Ub81P66Da9.exe	Generic.MSIL.PasswordStealerA.287D43D9	Deleted
C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\ZNW5c14gYC8hlY41S84m.docx=>QuotationsProduct List#765890.exe	Trojan.GenericKD.36287123	Deleted
C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\jt8xad6BUFITYHA3BiJf.exe=>(Dropped 0)=>(Embedded EXE g)	Gen:Variant.Zusy.365405	Deleted
C:\Users\renyifei\Downloads\11x (2021-02-03)\11x (2021-02-03)\jt8xad6BUFITYHA3BiJf.exe=>(heurC)	Zum.Androm.1	Deleted

Detailed Scan Summary
Basic

Scanned items	33
Infected items	9
Suspicious items	0(no suspected items have been detected)
Resolved items	9
Unresolved items	0 (no issues remained unresolved)

Advanced

Scan time	00:00:08
Files per second	4
Skipped items	0
Password protected:	0
Overcompressed items	0
Scanned archives	1
Input-output errors	0
Scanned boot sectors	0
Scanned processes	0
Infected processes	0
Scanned registry keys	0
Infected registry keys	0
Scanned cookies	0
Infected cookies	0

Scan Options
Targeted threat types

Scan for threats	Yes
Scan for adware	Yes
Scan for spyware	Yes
Scan for applications	Yes
Scan for dialers	Yes
Scan for rootkits	No
Scan for keyloggers	Yes

Scan options

Scan registry keys	No
Scan cookies	No
Scan boot sectors	No
Scan memory processes	No
Scan archives	Yes
Scan runtime packers	Yes
Scan emails	Yes
Scan all files	Yes
Heuristic Scan	Yes
Scanned extensions	not configured
Excepted extensions	not configured

Target Processing

Primary action taken on infected items	None
Secondary action taken on infected items	None
Primary action taken on suspicious items	None
Secondary action taken on suspicious items	None
Action taken on hidden items	None
Action taken on password protected items	Prompt for password

Scan Engines Summary

Number of threat information updates

11098806

hsks

360

Kinhold

Avast standby  。。。

gqy

360卫士一扫7个上报5个

温馨小屋

Kaspersky

剩2个


js和xls都无法运行

z68436425

ESET 9个

Kinhold

Avast        10/11        90.9%

* Avast 扫描报告
* 该文件是自动生成的
*
* 扫描名称: 从 Windows 资源管理器进行扫描
* 开始于: 2021年2月3日 10:40:55
* VPS: 210202-8, 2021/02/03
*

1) ...\11x (2021-02-03)\xuazQtrycsmJE5d961vT.exe [L] Win32:DropperX-gen [Drp] (0)

2) ...\11x (2021-02-03)\KtF9fwvm51EJk97TSnu4.exe [L] Win32:MalwareX-gen [Trj] (0)

3) ...\11x (2021-02-03)\jt8xad6BUFITYHA3BiJf.exe|>$INSTDIR\$INSTDIR\xdf.dll [L] Win32:MalwareX-gen [Trj] (0)

3) ...\11x (2021-02-03)\jt8xad6BUFITYHA3BiJf.exe [L] Win32:Malware-gen (0)

4) ...\11x (2021-02-03)\zDfeW61j06uGj8ynwU2X.exe [L] Win32:MalwareX-gen [Trj] (0)

5) ...\11x (2021-02-03)\aF1MXLFlo46rviwMxHNu.doc|>[Embedded:vba_scremu] [L] Script:SNH-gen [Trj] (0)

5) ...\11x (2021-02-03)\aF1MXLFlo46rviwMxHNu.doc|>ObjectPool\_1673732636\_1_Ole10Native:Wh102yYa.tmp [L] Win32:MalwareX-gen [Trj] (0)

6) ...\11x (2021-02-03)\2LBdfb3D22puXz3R2sPj.exe [L] Win32:TrojanX-gen [Trj] (0)

7) ...\11x (2021-02-03)\3dAE1W75832i92X0y34B.exe [L] Win32:CrypterX-gen [Trj] (0)

8) ...\11x (2021-02-03)\0c7v31VR5578RXb4S59e.js [L] SNH:Script [Dropper] (0)

9) ...\11x (2021-02-03)\ZNW5c14gYC8hlY41S84m.docx|>QuotationsProduct List#765890.exe [L] Win32:PWSX-gen [Trj] (0)

10) ...\11x (2021-02-03)\2cX6wVQOf8Ub81P66Da9.exe [L] Win32:RATX-gen [Trj] (0)

感染文件: 12
文件总计: 46
文件夹总计: 1
大小总计: 8.3 MB

*
* 扫描已停止: 2021年2月3日 10:41:34
* 运行时间是 39 秒

hsks

顺便测下火绒