郵箱伺服器收到的可疑文件X1

megakotaro

12/21卡巴斯基回覆

Dear customer,

Based on the provided information we can suggest you the following solution:

Thanks for your wait.

For the provided opentip scan report:
>> We received an img file. The img file is HEUR:Trojan.Win32.Generic
>> https://opentip.kaspersky.com/1F ... /results?tab=upload
This detection is correct.

The detection of the file "Payment Confirmation 789001_pdf.exe" will be included in the next update.
HEUR:Trojan.MSIL.Agent.gen


If suggested solution did not help or you need more information, please reply to this message. We remind you that you can contact Kaspersky Lab Technical Support via email (in this case, please, do not change Subject field) or, in case if you created your request on the portal, you will see the direct link below for the quick answer.
https://companyaccount.kaspersky.com/request/view/INC000014854112

If we do not receive a response from you within 6 days, the incident will be closed.

Best regards,
Kaspersky Lab Customer Service

密碼：infected
https://pan.huang1111.cn/s/LbXmt6

裡面有一個img檔案
解壓縮後得到一個exe檔

opentip:

Payment Confirmation 789001_pdf.img
https://opentip.kaspersky.com/1FAC9541B7DCC422062C4333B3120415A67B21200398B4A51D4B2A83C039828D/results?tab=upload



Payment Confirmation 789001_pdf.exe
https://opentip.kaspersky.com/070C305A1B0FCB2ED40811153C6B1C8E9D5B0B693B07D0CE8DC38D2BFB9C0C59/results?tab=upload



虛擬機無法執行
使用企業帳號回報樣本

因為opentip免費帳號一天只能生成一篇動態分析報告
今天問台灣省的經銷商
opentip的進階服務一天可以分析100個文件，價格一年新台幣600萬，約136萬人民幣
現在搞企業版都在賣服務，軟體不值錢，賣企業版服務才能賺錢

心醉咖啡

360

UNknownOoo

智量
双击程序自退

对对对对

KAV 扫描miss

sichuanwenxuan

MES双击杀。

PianoA

金山毒霸kill all

呵呵大神001

BD企业版，沙盒随便用。微步申请企业账号（不花钱）一天也可以提交500次，大小限制100m。
Kaspersky这种还是太贵，这个价格买joesandbox/VMRAY/Intezer这种专门做沙盒的大厂不好吗。。我觉得KATA（EDR expert）和opentip高级会员一点性价比也没有，除了和卡巴系产品能集成以外单测的话和友商相比排名并不靠前，还是部署开放XDR架构，集成多个供应商的比较好。卡巴这种更适合打包卖给不差钱的大氪户。

另外
Heimdal HEUR/APC

anthonyqian

ESET LiveGuard检测到 ->   MSIL/Kryptik.AHNW 特洛伊木马 的变量

心心相印

bdts kill

GDHJDSYDH

MD:Trojan:Win32/Wacatac.H!ml