样本

wwwab

z614606517

安全

dght432

类型:木马-Win64/Heur.Generic.H8oAYK8A
描述:木马是一种伪装成正常文件的恶意软件，会盗取您的帐号、密码等隐私资料。
扫描引擎:云安全引擎
文件路径:D:\360安全浏览器下载\关于省局设的三个准强制性公式-未解锁企业名单\未解锁成功企业名单-电脑版.exe.exe
文件大小:408.2K (418,032 字节)
文件版本:502.017.80.7372
文件描述:tmuyreqicg zyimqemzduigegqqcpj xwspyryv parkjdwv
文件指纹（MD5）:dd62abc08db08b25e95fe27a0fe491ba
数字签名:MEDIATEK INC.
数字签名是否有效:有效
处理建议:隔离文件

嘿嘿不能说

CC第一次分析超时（结果为左），再次分析后击杀（右）。

1. <ChestId>0000000C</ChestId>
   
2.                 <FileTime>1700290154</FileTime>
   
3.                 <OrigFileName>未解锁成功企业名单-电脑版.exe.exe</OrigFileName>
   
4.                 <OrigFolder>C:\Users\Killer\Desktop\关于省局设的三个准强制性公式-未解锁企业名单</OrigFolder>
   
5.                 <Comment></Comment>
   
6.                 <Virus>Custody</Virus>
   
7.                 <Category>Vir</Category>
   
8.                 <Restore>yes</Restore>
   
9.                 <TransferTime>1700290154</TransferTime>
   
10.                 <FileSize>4192904236606959707</FileSize>
    
11.                 <Viruses>Custody||;</Viruses>
    
12.                 <IDPBlob>05000000040000001819102830000000460000000000b1a48f2459034e4f9b290e02c7651002cbe52a58eb19da010400000001c2020000010105fc00010515fe000d89f019537f0c05275167af69e803d700805801000000000000008111020001000000000100000000bf754a1f13ba33eff53c91015f5c74010ce75950eb19da01808a43003a005c00550073006500720073005c004b0069006c006c00650072005c004400650073006b0074006f0070005c0073518e4e0177405cbe8b8476094e2a4ec6513a5f365227606c510f5f2d002a67e3890195014f1a4e0d5455535c002a67e389019510629f52014f1a4e0d5455532d003575118148722e006500780065002e0065007800650000001043007500730074006f00640079000000010400000010010200150000000000000000000000000000000028620000000000000061fab831d9a503c4521abcb360412994682c6baa97170cad50b22c32ec8090e60e4b0069006c006c00650072000000042000000080d7020001000000000400000000f4250000b63e6053eb19da0100000002e6e39057eb19da01808a43003a005c00550053004500520053005c004b0049004c004c00450052005c004400450053004b0054004f0050005c0073518e4e0177405cbe8b8476094e2a4ec6513a5f365227606c510f5f2d002a67e3890195014f1a4e0d5455535c002a67e389019510629f52014f1a4e0d5455532d003575118148722e004500580045002e0045005800450000000002000800000000000003000000000000000000000000000000001e1400000000000000a5f4b63e6053eb19da0180d70200010000000004000000003c0f000052f8bd30eb19da0100000002e6e39057eb19da01808a43003a005c00550053004500520053005c004b0049004c004c00450052005c004400450053004b0054004f0050005c0073518e4e0177405cbe8b8476094e2a4ec6513a5f365227606c510f5f2d002a67e3890195014f1a4e0d5455535c002a67e389019510629f52014f1a4e0d5455532d003575118148722e004500580045002e0045005800450000000002000800000000000003000000000000000000000000000000001e14000000000000008f3c52f8bd30eb19da0180d70200010000000004000000009c0e000035af2e33eb19da0100000002e6e39057eb19da01808a43003a005c00550053004500520053005c004b0049004c004c00450052005c004400450053004b0054004f0050005c0073518e4e0177405cbe8b8476094e2a4ec6513a5f365227606c510f5f2d002a67e3890195014f1a4e0d5455535c002a67e389019510629f52014f1a4e0d5455532d003575118148722e004500580045002e0045005800450000000002000800000000000003000000000000000000000000000000001e14000000000000008e9c35af2e33eb19da0180d70200010000000004000000009022000049f45053eb19da0100000002e6e39057eb19da01808a43003a005c00550053004500520053005c004b0049004c004c00450052005c004400450053004b0054004f0050005c0073518e4e0177405cbe8b8476094e2a4ec6513a5f365227606c510f5f2d002a67e3890195014f1a4e0d5455535c002a67e389019510629f52014f1a4e0d5455532d003575118148722e004500580045002e0045005800450000000002000800000000000003000000000000000000000000000000001e1400000000000000a29049f45053eb19da0180ca00000100000000040000000004060000c65c3b37eb19da0100000002e6e39057eb19da017e43003a005c00550053004500520053005c004b0049004c004c00450052005c0041005000500044004100540041005c004c004f00430041004c005c00540045004d0050005c0053004f004d0050004f005300410042004c0045005300480045004c004c002e005600370036002e003300370036002e0045005800450000000002000800000000000003000000000000000000000000000000001e14000000000000008604c65c3b37eb19da01</IDPBlob>
    
13.                 <SupportExceptions>yes</SupportExceptions>
    
14.                 <SendToAnalysis>yes</SendToAnalysis>

复制代码

117054487

HyperDetect 机器学习检测到威胁. 文件已删除。C:\Users\123456\AppData\Local\Temp\vmware-123456\VMwareDnD\d4bc3ad2\关于省局设的三个准强制性公式-未解锁企业名单.rar 是恶意软件 Gen:Illusion.Wrangler.2.36.2.2010200
事件: 检测到恶意对象
应用程序: 未解锁成功企业名单-电脑版.exe.exe
用户: DESKTOP-ICDT14E\123456
用户类型: 发起者
组件: 系统监控
结果说明: 检测到
类型: 木马
名称: PDM:Trojan.Win32.Generic
威胁级别: 高
对象类型: 进程
对象路径: C:\Users\123456\Desktop
对象名称: 未解锁成功企业名单-电脑版.exe.exe
原因: 行为分析
数据库发布日期: 今天，2023/11/18 3:48:00
MD5: DD62ABC08DB08B25E95FE27A0FE491BA


事件: 进程已终止
应用程序: SomposableShell.v24.668.exe
用户: DESKTOP-ICDT14E\123456
用户类型: 发起者
组件: 系统监控
结果说明: 已终止
类型: 木马
名称: PDM:Trojan.Win32.Generic
威胁级别: 高
对象类型: 进程
对象路径: C:\Users\123456\AppData\Local\Temp
对象名称: SomposableShell.v24.668.exe
MD5: DD62ABC08DB08B25E95FE27A0FE491BA

GDHJDSYDH

EIS扫描miss，沙箱内双击EIS+KART均miss，如果不改后缀则双击会被打开文件安全警告阻止，改后缀则样本运行时提示错误

UNknownOoo

火绒
扫描：MISS


X-Sec
扫描：云黑

1. ---------------------
   
2. 2023/11/18 16:37:39 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\未解锁成功企业名单-电脑版.exe.exe -- [xave-cloud] Backdoor.Generic

复制代码

心醉咖啡

金山毒霸扫描miss

嘿嘿不能说

GDHJDSYDH 发表于 2023-11-18 15:59
EIS扫描miss，沙箱内双击EIS+KART均miss，如果不改后缀则双击会被打开文件安全警告阻止，改后缀则样本运行 ...

那个是虚假的报错窗口，迷惑用户的（

不甘寂寞

卡巴斯基免费版扫描无威胁