假ppt 可能是后门 x2

anthonyqian

来自大圣。

看文件名和图标基本是恶意的了。。VT 检测率 4/67

过ESET扫描和ELG，已上报ESET。

双击KART拦截：



https://cowtransfer.com/s/38c96d9114d946

Mr_Huang

卡巴扫描MISS all

日邢一珊

御点扫描MISS all

wwwab

卡巴斯基已上报

anthonyqian

wwwab 发表于 2022-5-24 16:15
卡巴斯基已上报

应该很快就能回复 毕竟这货卡巴主防就能杀

aboringman

360：0

全部过安全大脑

Jirehlov1234

Event: Object deleted
User: JIREHLOV-RESEAR\Jireh
User type: Active user
Component: Virus Scan
Result: Deleted
Result description: Deleted
Type: Trojan
Name: VHO:Trojan.Win64.Shelma.wfh
Precision: Exactly
Threat level: High
Object type: File
Object name: 绩效系统员工操作手册-目标管理+绩效管理_云公司考核者版.exe
Object path: C:\Users\Jireh\Downloads\two-samplesss.zip//
SHA256 of an object: 2E5364644255681AE085C113B6D88E4D3BC1DB18D3EF8C06B8264194A39687E9
MD5 of an object: E178CC94333D536AAF159B641AB71B2C

Event: Object deleted
User: JIREHLOV-RESEAR\Jireh
User type: Active user
Component: Virus Scan
Result: Deleted
Result description: Deleted
Type: Trojan
Name: VHO:Trojan.Win64.Shelma.wfg
Precision: Exactly
Threat level: High
Object type: File
Object name: 绩效系统员工操作手册-目标管理+绩效管理_云公司员工版.exe
Object path: C:\Users\Jireh\Downloads\two-samplesss.zip//
SHA256 of an object: DAC35A874CA47B8DE8103AC84B2DB9DEA4E6B44F9ED2081FCD5BFF1143A66D97
MD5 of an object: 032E7E721DFE5DBC95BB91A3BC2E935C

swizzer

jacksonsc

火绒扫描MISS all

sichuanwenxuan