【开放测试】卡饭病毒样本包 第137期

金山毒霸  9个


剩余已反馈

kurakimai

NOD32 11个 ELG上传了5个。。全部SAFE。。

hipoxiaxxx

SEP扫描剩余5x

30eb.exe → 无法运行
httpd.exe → MISS
update.js → 运行出错
msi →  IPS：Atera Client Activity Attack
dll → 没反应

孤勇者

卡巴斯基kill13x

UNknownOoo

X-Sec
扫描：7x

1. C:\Users\UnknownOoo\Downloads\Compressed\1
   
2. ---------------------
   
3. 2024/07/04 19:31:51 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\1\42.exe -- [rame-classic] Trojan.Injector/Autoit!1.FD30
   
4. 2024/07/04 19:31:53 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\1\9AA1.exe -- [rame-cloud] Trojan.Agent!8.B1E
   
5. 2024/07/04 19:31:53 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\1\DHL Invoice 20240407.xls -- [rame-classic] Exploit.CVE-2017-0199!1.FDBF
   
6. 2024/07/04 19:31:54 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\1\dhl_awb_shipping_doc_03072024224782020031808174CN18030724000000324(991KB).vbs -- [rame-topis] Trojan.Agent/VBS!8.11E09
   
7. 2024/07/04 19:32:01 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\1\Revised PI_2024.exe -- [rame-cloud] Trojan.Guloader!8.11961
   
8. 2024/07/04 19:32:02 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\1\ss.exe -- [rame-classic] Trojan.Injector/Autoit!1.FD30
   
9. 2024/07/04 19:32:08 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\1\Order List Pdf.exe -- [rame-cloud] Trojan.Kryptik!8.8
   

复制代码

火绒
扫描：7x

1. 扫描文件：18
   
2. 发现风险：7
   
3. 已处理风险：0
   
4. 病毒详情：
   
5. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\1\dhl_awb_shipping_doc_03072024224782020031808174CN18030724000000324(991KB).vbs, 病毒名：HEUR:Trojan/VBS.Agent.p, 病毒ID：d8aa3f5e49a5df72, 处理结果：暂不处理
   
6. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\1\PTFE Coated Butterfly Valve Picture·pdf.exe >> [NSIS].nsi, 病毒名：Trojan/Injector.bfx, 病毒ID：5bc5535ddb7fd135, 处理结果：暂不处理
   
7. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\1\Revised PI_2024.exe >> [NSIS].nsi, 病毒名：Trojan/Injector.blu, 病毒ID：ed46968bd0d5d9e2, 处理结果：暂不处理
   
8. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\1\9AA1.exe, 病毒名：Trojan/Injector.biz, 病毒ID：9174874ed7d6b025, 处理结果：暂不处理
   
9. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\1\42.exe, 病毒名：HVM:VirTool/Obfuscator.gen!A, 病毒ID：b27d4294cde6a1ec, 处理结果：暂不处理
   
10. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\1\ss.exe, 病毒名：HVM:VirTool/Obfuscator.gen!A, 病毒ID：b27d4294cde6a1ec, 处理结果：暂不处理
    
11. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\1\httpd.exe, 病毒名：HVM:VirTool/WannaMine.gen!B, 病毒ID：8f5ec8d9b4ea4481, 处理结果：暂不处理

复制代码

驭龙

ESET又补杀一个，总计杀14个，剩余4

Version of detection engine: 29503P (20240704)
Date: 2024/7/5  Time: 1:40:56
Scanned disks, folders and files: D:\virus\18x (2024-07-04)
D:\virus\18x (2024-07-04)\1\starter.exe - a variant of MSIL/TrojanDownloader.Agent.QXC trojan - cleaned by deleting [1]
Number of scanned objects: 6
Number of detections: 1
Number of cleaned objects: 1
Time of completion: 1:41:08  Total scanning time: 12 sec (00:00:12)
============================================

补杀两个
Version of detection engine: 29502P (20240704)
Date: 2024/7/4  Time: 23:29:33
Scanned disks, folders and files: D:\virus\18x (2024-07-04)
D:\virus\18x (2024-07-04)\1\file.exe » NSIS » Script.nsi - NSIS/Injector.CTG trojan - cleaned by deleting [1]
D:\virus\18x (2024-07-04)\1\hestehaarene petalism.exe » NSIS » Script.nsi - NSIS/Injector.CTG trojan - cleaned by deleting [1]
Number of scanned objects: 28
Number of detections: 2
Number of cleaned objects: 2
Time of completion: 23:29:42  Total scanning time: 9 sec (00:00:09)


============================================
我也来测测火力全开的ESET，手动触发全部剩余文件到ELG无果，依然杀11个，剩余7


Log
Scan Log
Version of detection engine: 29501P (20240704)
Date: 2024/7/4  Time: 19:34:54
Scanned disks, folders and files: D:\virus\18x (2024-07-04)
D:\virus\18x (2024-07-04)\1\42.exe » AUTOIT » script.bin - a variant of Win32/Injector.Autoit.GDF trojan - cleaned by deleting [1]
D:\virus\18x (2024-07-04)\1\9AA1.exe - a variant of WinGo/Agent.VY trojan - cleaned by deleting [1]
D:\virus\18x (2024-07-04)\1\DriverDllX32.dll - a variant of Win32/Packed.VMProtect.ACR trojan - cleaned by deleting [1]
D:\virus\18x (2024-07-04)\1\Loader (3).exe - a variant of Win64/Packed.VMProtect.AC suspicious application - cleaned by deleting [1]
D:\virus\18x (2024-07-04)\1\Order List Pdf.exe - a variant of Win64/GenKryptik.GYQM trojan - cleaned by deleting [1]
D:\virus\18x (2024-07-04)\1\PTFE Coated Butterfly Valve Picture·pdf.exe » NSIS » Script.nsi - NSIS/Injector.ASH trojan - cleaned by deleting [1]
D:\virus\18x (2024-07-04)\1\Revised PI_2024.exe » NSIS » Script.nsi - NSIS/Injector.ASH trojan - cleaned by deleting [1]
D:\virus\18x (2024-07-04)\1\dhl_awb_shipping_doc_03072024224782020031808174CN18030724000000324(991KB).vbs - VBS/Agent.SCQ trojan - cleaned by deleting [1]
D:\virus\18x (2024-07-04)\1\new order.exe » AUTOIT » script.bin - a variant of Win32/Injector.Autoit.GBP trojan - cleaned by deleting [1]
D:\virus\18x (2024-07-04)\1\ss.exe » AUTOIT » script.bin - a variant of Win32/Injector.Autoit.GDF trojan - cleaned by deleting [1]
D:\virus\18x (2024-07-04)\1\update.js - JS/TrojanDownloader.Agent.AATF trojan - cleaned by deleting [1]
Number of scanned objects: 129
Number of detections: 11
Number of cleaned objects: 11
Time of completion: 19:36:36  Total scanning time: 102 sec (00:01:42)
Notes:
[1] Object has been deleted as it only contained the virus body.

dght432

卡巴扫描余5

双击就杀一个14/18

wuming_bpnes

BD killed 11x
ATD killed 2x

1. Application httpd.exe has been detected as potentially malicious and was blocked.
   
2. Application path: C:\Users\test\Downloads\18x (2024-07-04)\1\httpd.exe
   
3. Command line parameters: "C:\Users\test\Downloads\18x (2024-07-04)\1\httpd.exe"
   
4. Detection ID: SuspiciousBehavior.C832502F553C4D00

复制代码

1. Application new order.exe has been detected as potentially malicious and was blocked.
   
2. Application path: C:\Users\test\Downloads\18x (2024-07-04)\1\new order.exe
   
3. Command line parameters: "C:\Users\test\Downloads\18x (2024-07-04)\1\new order.exe"
   
4. Detection ID: SuspiciousBehavior.C832502F7AF9839A

复制代码

Chyxs

卡巴 miss 4

真小读者

金山安全终端
监控10X



扫描补1X



剩余