郵箱伺服器收到的可疑PDF X1

megakotaro

密碼：infected

來一個沒有任何內容的pdf檔
放到opentip，會執行cmd
但最後結果為乾淨
https://opentip.kaspersky.com/ce0170a8135d37d8b2fd9f701ab34996f5935b2aa9fc7035e02b3af3c482a78a/results



卡巴斯基企業帳號登入卡卡的，搞了好久才送出
俄羅斯人不要再划水了

卡巴斯基20:46回覆
滑水滑到其他人分析好就可以用這種回覆是吧

1. Dear Customer：
   
2. 
   
3. I opened the opentip link you sent and it shows that it is a malware.
   
4. 
   
5. 
   
6. We remind you that you can contact Kaspersky Lab Technical Support via email (in this case, please, do not change Subject field) or, in case if you created your request on the portal, you will see the direct link below for the quick answer.
   
7. https://companyaccount.kaspersky.com/request/view/INC000015105787
   
8. 
   
9. If we do not receive a response from you within 8 days, your incident will be considered resolved.
   
10. 
    
11. Best regards,
    
12. Kaspersky Lab Customer Service
    
13. 
    
14. Support web-site: http://support.kaspersky.com/corporate

复制代码

Mr_Huang

天守扫描MISS
补充：奇安信沙箱未检出




ip地址下载的Svchost.exe文件，奇安信沙箱报可疑




天守扫描，奇安信反病毒引擎（qowl）特征杀：Trojan.MPE.Stealer.M
更新：Svchost.exe已被置黑

chjs

mcafee 和 Norton 没检出，运行也无

117054487

微步云判断安全，打开里面的ip地址下载会被拦截

dght432

类型:木马-PDF/Exploit.Generic.HpAASAAB
描述:木马是一种伪装成正常文件的恶意软件，会盗取您的帐号、密码等隐私资料。
扫描引擎:云安全引擎
文件路径:D:\360安全浏览器下载\pending invoice\pending invoice.pdf
文件大小:4.83M (5,067,668 字节)
文件指纹（MD5）:9d424a909088c34527cecce57ec4bb9f
数字签名:
数字签名是否有效:无效
处理建议:隔离文件


360卫士检出，360杀毒无检出

huangzihang

BD沙盒也miss了
ChatGPT kill（）


补双击

流量扫描已检测到威胁。已拒绝访问网页。 www.upload.ee/download/14997302/248485ce16bf1c8e9399/Svchost.exe 包含类型为 Cloud.Variant.Jammy.1.456 的恶意软件

莒县小哥

UNknownOoo

火绒
扫描：MISS

特征杀衍生物

GDHJDSYDH

MD扫描双击均miss

117054487

Hello,

New malicious software was found in the attached file. Its detection will be included in the next update.\
Trojan-Downloader.BAT.Agent.acj
Thank you for your help.

Best regards, Maxim, Malware analyst, Kaspersky Lab
39A/3 Leningradskoe Shosse, Moscow, 125212, Russia Tel./Fax: + 7 (495) 797 8700 http://www.kaspersky.com https://securelist.com
https://opentip.kaspersky.com/ - get insights about suspicious files, hashes, URLs, IP addresses or domain names

__________________________________________

From: xxxxxxxx@qq.com
Received: 3/8/2023 4:05:24 AM (UTC)
Sent: 3/8/2023 4:05:23 AM (UTC)
To: newvirus@kaspersky.com
Subject: Kaspersky Anti-virus Lab replies to your request [VD3] [FILE:X] [LN:en]

Client feedback, query ce0170a8135d37d8b2fd9f701ab34996f5935b2aa9fc7035e02b3af3c482a78a, type [Hash], zone [Grey], was sent with the following commentary:
Kaspersky false positive and false negative： These files are malicious, pls re-check them..

This message is generated automatically by OpenTIP.
With Best regards,
OpenTIP Team.