12X

biue

火绒8/11（已删除被密码保护的文档）

Mod123xsd

Norton 全灭

心心相印

红伞kill：11/12x，余glib

Nocria

IKARUS - 10/12

1. [04.09.2021 17:44:01] On-demand scan started: "user_defined"
   
2. [04.09.2021 17:44:01] Found, 0.31s, SigName: "Trojan-Dropper.VBA.Agent", SigId: 4184138, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected\2021-09-02-Hancitor-malware-and-artifacts\0902_2448248612.doc"
   
3. [04.09.2021 17:44:01] Found, 0.47s, SigName: "Trojan-Dropper.VBA.Agent", SigId: 4184138, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected\2021-09-02-Hancitor-malware-and-artifacts\0902_3783180107.doc"
   
4. [04.09.2021 17:44:01] Found, 0.47s, SigName: "Trojan-Dropper.VBA.Agent", SigId: 4184138, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected\2021-09-02-Hancitor-malware-and-artifacts\0902_4237617752.doc"
   
5. [04.09.2021 17:44:01] Found, 0.47s, SigName: "Trojan-Dropper.VBA.Agent", SigId: 4184138, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected\2021-09-02-Hancitor-malware-and-artifacts\0902_4553378130.doc"
   
6. [04.09.2021 17:44:01] Found, 0.47s, SigName: "Trojan-Dropper.VBA.Agent", SigId: 4184138, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected\2021-09-02-Hancitor-malware-and-artifacts\0902_5006434265.doc"
   
7. [04.09.2021 17:44:01] Found, 0.31s, SigName: "Trojan-Dropper.VBA.Agent", SigId: 4184138, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected\2021-09-02-Hancitor-malware-and-artifacts\0902_5252728028.doc"
   
8. [04.09.2021 17:44:01] Found, 0.32s, SigName: "Trojan-Dropper.VBA.Agent", SigId: 4184138, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected\2021-09-02-Hancitor-malware-and-artifacts\0902_5388730233.doc"
   
9. [04.09.2021 17:44:01] Found, 0.16s, SigName: "Trojan-Dropper.VBA.Agent", SigId: 4184138, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected\2021-09-02-Hancitor-malware-and-artifacts\0902_6686864155.doc"
   
10. [04.09.2021 17:44:01] Found, 0.15s, SigName: "Trojan.Win32.Krypt", SigId: 333672364, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected\2021-09-02-Hancitor-malware-and-artifacts\yefff.dll"
    
11. [04.09.2021 17:44:01] Found, 0.125s, SigName: "Trojan-Spy.FormBook", SigId: 4199508, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected\2021-09-03-malware-and-artifacts-from-GuLoader-possible-Remcos-RAT-infection\vbc.exe"
    
12. [04.09.2021 17:44:01] On-demand scan FINISHED: "user_defined"
    
13. [04.09.2021 17:44:01] ----------------------------------------------------
    
14. [04.09.2021 17:44:01] Directories scanned: 3
    
15. [04.09.2021 17:44:01] Files scanned: 12
    
16. [04.09.2021 17:44:01] Virus found: 10
    
17. [04.09.2021 17:44:01] ----------------------------------------------------

复制代码

wwwab

Invoice & Packing List .xlsx - HEUR:Exploit.MSOffice.CVE-2018-0802.gen
vbc.exe - HEUR:Trojan.Win32.Injects.gen

They are already detected too.

ANY.LNK

MS DEFENDER：目前暂时剩余1个glib.doc

白崎桑

wwwab 发表于 2021-9-4 16:59
已整包上报至卡巴（不用谢我）

整包上报是上报到哪个邮箱？之前给技术支持上报给我拆成几个工单了

秋日之殇

白崎桑 发表于 2021-9-4 18:24
整包上报是上报到哪个邮箱？之前给技术支持上报给我拆成几个工单了

上报给newvirus@kaspersky.com，如果是误报正文加false positive。如果是漏报，正文部分加false negative。也可以通过https://opentip.kaspersky.com/ 要附带false positive或false negative的评论才会有回复。

正在缓冲

Avast 11x，剩余glib.doc。既然是有密码的，那就当kill all吧

ly9327

毒霸 kill 11个