珠海海鹦 MacroClean 宏病毒专杀，Trojan/Win32.Meredrop，火绒静态查杀无毒，未双击

3306-1

来源：https://www.52pojie.cn/thread-2118134-1-1.html#pid55577227
回帖：jyxsjj0722

回帖者描述

1. jyxsjj0722
   
2. 2026-7-22 08:53
   
3. 通过网盘分享的文件：宏病毒专杀.rar
   
4. 链接: *** 提取码: nydd 复制这段内容后打开百度网盘手机App，操作更方便哦
   
5. 宏病毒用这个查杀

复制代码

文件指纹
宏病毒专杀 2026-07-22.rar
大小: 812474 字节 : 793 KiB
CRC32: 073DA3D6
CRC64: 41BD0B8FC0F52F04
XXH64: 791045E26E289A8D
SHA256: 6c94827f751417c70586a2aea0eca61cef71d4e70f1f6c50e58cbceb4beaf1c0

setup.exe
大小: 837331 字节 : 817 KiB
CRC32: 3FBFC916
CRC64: 9C4B2F7CA8A9E040
XXH64: 3B9304B3D9DC7AAC
SHA256: d117888c9b7263a125a9de3b7097e451ea1c5c2b2b24a4d22c1a1a009e28f57f

cleanmacroSetup.exe
大小: 48186856 字节 : 45 MiB
CRC32: B32913F9
CRC64: EC1F6C5C1FDE7AEF
XXH64: 0CF2F93890BB7110
SHA256: b048a9d317594431d0ba822b33d44810564112d9b28cb9dbb558835ae9f13027

曾经旧站（本样本）
域　名　starwoodd[.]net
注册商　Xin Net Technology Corporation
省／州　广东（GD）
地　区　中国（CN）
注册人
邮　箱
注册日　2010-02-24 21:19:37 UTC+8
过期日　2029-02-24 21:19:37 UTC+8
更新日　2021-10-09 09:41:11 UTC+8
IANA_ID　120
状　态　正常
DNS　　ns11[.]xincache[.]com
　　　　ns12[.]xincache[.]com
DNSSEC　未配置

疑似新站（日志相关）
域　名　officesec[.]cn
注册商　阿里云计算有限公司（万网）
注册人　珠海海鹦安全科技有限公司
邮　箱　bHVja3l6aHV3eEAxNjMuY29t
许可号　粤ICP备20044563号
注册日　2019-12-10 13:07:53 UTC+8
过期日　2028-12-10 13:07:53 UTC+8
通过日　2023-11-27
状　态　正常
DNS　　dns7[.]hichina[.]com
　　　　dns8[.]hichina[.]com
DNSSEC　未配置

疑似总站（日志相关）
域　名　haiyingsec[.]cn
注册商　阿里巴巴云计算（北京）有限公司
注册人　珠海海鹦安全科技有限公司
邮　箱　bHVja3l6aHV3eEAxNjMuY29t
许可号　粤ICP备20044563号
注册日　2020-06-24 12:55:58 UTC+8
过期日　2028-06-24 12:55:58 UTC+8
通过日　2023-11-27
状　态　正常
DNS　　dns15[.]hichina[.]com
　　　　dns16[.]hichina[.]com
DNSSEC　未配置

火绒扫描（我自己的本地扫描结果）
6.0.11.1 版本
07-20 20:07 病毒库

2026/07/22 09:54:29
2026/07/22 17:21:40
病毒防护
病毒查杀
自定义扫描(手动执行)，发现0个风险项目

病毒库时间：2026-07-20 20:07
开始时间：2026-07-22 09:54
执行类型：手动执行
扫描类型：自定义扫描
总计用时：00:00:04
扫描对象：402
扫描文件：1
发现风险：0
已处理风险：0

病毒库时间：2026-07-21 19:23
开始时间：2026-07-22 17:21
执行类型：手动执行
扫描类型：自定义扫描
总计用时：00:00:14
扫描对象：419
扫描文件：1
发现风险：0
已处理风险：0

Inno Setup Setup Data (5.4.2)
Inno Setup Messages (5.1.11)

关联主页

1. http://www.starwoodd.net/MacroClean/web/wt.html

复制代码

疑似总站

1. https://haiyingsec.cn
   
2. https://haiyingsec.com

复制代码

疑似新站

1. https://downloadcdn.officesec.cn/bin/cleanmacroSetup.exe
   
2. https://www.officesec.cn/officesecurity/lastupdate#:~:text=2012.5.10
   
3. 
   
4. 日志片段与下方相符

复制代码

日志片段

1. news.txt = License.txt
   
2. 
   
3. Office 病毒专杀更新日志:
   
4. 2012.5.10:
   
5.         1、解决office 2007录制个人宏时误报的问题。
   
6.         2、增加清除宏病毒时常见问题和问题解决方案。
   
7.         3、改进没有office的用户交互。
   
8.         4、更新专杀启动logo。
   
9.         5、增加新版本特性提示。

复制代码

解包目录

1. ├── app
   
2. │   ├── CleanMacro.exe　＃Office Macro cleaner Copyright (C)2009-2011 NetSafe.Dev studio 2012.5.0.10
   
3. │   ├── CMIFW.dll　＃Clean Macro Anti-MacroVirus shield. by loveboom 2012.2.0.13
   
4. │   ├── ImmOffice.dlll　＃mmune plugin for Ms Office by loveboom 2012.5.10.0
   
5. │   ├── MacroCTray.exe　＃MacroCTray application 2012.2.14.0
   
6. │   ├── mcupdate.exe　＃clean macro update application. 2011.10.11.0
   
7. │   ├── news.txt
   
8. │   ├── rar.exe　＃2008/08/06 01:57
   
9. │   └── ShowTip.exe　＃2011.11.0.16
   
10. ├── tmp
    
11. │   ├── PostQuit.exe　＃Project1 kingsoft 1.0.0.0 2011/08/04 02:37
    
12. │   ├── psvince.dll　＃psvince.dll for lnnoSetup Extensions Copyright © 2001 Vincenzo Giordano 意大利 2006/12/31 19:19
    
13. │   ├── waterctrl.dll　＃restools-inno setup 插件(水纹特效) waterctrl 2.0.0.0 2008/05/31 13:56
    
14. │   └── WizModernImage-Is.bmp
    
15. ├── embedded
    
16. │   ├── chinesesimp.isl
    
17. │   ├── CompiledCode.bin
    
18. │   ├── License.txt
    
19. │   ├── WizardImage0.bmp
    
20. │   └── WizardSmallImage0.bmp
    
21. ├── install_script.iss
    
22. ├── RegistrySection.reg
    
23. └── SetupIcon.ico

复制代码

安装脚本

1. ???; Created by "innounp" version 2.67.3
   
2. ; Setup file: setup.exe
   
3. ; Inno Setup Version: 5.4.2
   
4. 
   
5. [Setup]
   
6. AppName=Office病毒专杀
   
7. AppId={{BD7FA13F-66D5-42DB-8536-664B00CA7DD9}
   
8. AppVersion=v2012.5.10
   
9. AppPublisher=loveboom
   
10. AppPublisherURL=http://www.starwoodd.net/
    
11. AppSupportURL=http://www.starwoodd.net/
    
12. AppUpdatesURL=http://www.starwoodd.net/
    
13. DefaultDirName={pf}\CleanMacro
    
14. DefaultGroupName=Office病毒专杀
    
15. OutputBaseFilename=setup
    
16. Compression=lzma
    
17. DisableProgramGroupPage=yes
    
18. ChangesAssociations=no
    
19. ShowLanguageDialog=yes
    
20. LicenseFile=embedded\License.txt
    
21. WizardImageFile=embedded\WizardImage0.bmp
    
22. WizardSmallImageFile=embedded\WizardSmallImage0.bmp
    
23. 
    
24. [Files]
    
25. Source: "{tmp}\psvince.dll"; DestDir: "{tmp}"; Flags: deleteafterinstall dontcopy
    
26. Source: "{tmp}\waterctrl.dll"; DestDir: "{tmp}"; Flags: deleteafterinstall dontcopy
    
27. Source: "{tmp}\WizModernImage-Is.bmp"; DestDir: "{tmp}"; Flags: deleteafterinstall dontcopy
    
28. Source: "{tmp}\PostQuit.exe"; DestDir: "{tmp}"; Flags: deleteafterinstall dontcopy
    
29. Source: "{app}\CleanMacro.exe"; DestDir: "{app}"; Flags: ignoreversion
    
30. Source: "{app}\MacroCTray.exe"; DestDir: "{app}"; Flags: ignoreversion
    
31. Source: "{app}\mcupdate.exe"; DestDir: "{app}"; Flags: ignoreversion
    
32. Source: "{app}\rar.exe"; DestDir: "{app}"; Flags: ignoreversion
    
33. Source: "{app}\CMIFW.dll"; DestDir: "{app}"; Flags: regserver ignoreversion
    
34. Source: "{app}\ImmOffice.dll"; DestDir: "{app}"; Flags: ignoreversion
    
35. Source: "{app}\ShowTip.exe"; DestDir: "{app}"; Flags: ignoreversion
    
36. Source: "{app}\news.txt"; DestDir: "{app}"; Flags: ignoreversion
    
37. 
    
38. [Registry]
    
39. Root: HKCU; Subkey: "Software\Microsoft\Windows\CurrentVersion\Run"; ValueName: "CleanMacro"; ValueType: String; ValueData: "{app}\MacroCTray.exe"; Flags: uninsdeletevalue
    
40. Root: HKCR; Subkey: "SystemFileAssociations\.xls\shell"; Flags: uninsdeletekeyifempty
    
41. Root: HKCR; Subkey: "SystemFileAssociations\.xls\shell\MacroClean"; ValueType: String; ValueData: "查office病毒"; Flags: uninsdeletekey
    
42. Root: HKCR; Subkey: "SystemFileAssociations\.xls\shell\MacroClean\command"; ValueType: String; ValueData: "{app}\CleanMacro.exe /sf %1"; Flags: uninsdeletekey
    
43. Root: HKCR; Subkey: "SystemFileAssociations\.xlsx\shell"; Flags: uninsdeletekeyifempty
    
44. Root: HKCR; Subkey: "SystemFileAssociations\.xlsx\shell\MacroClean"; ValueType: String; ValueData: "查office病毒"; Flags: uninsdeletekey
    
45. Root: HKCR; Subkey: "SystemFileAssociations\.xlsx\shell\MacroClean\command"; ValueType: String; ValueData: "{app}\CleanMacro.exe /sf %1"; Flags: uninsdeletekey
    
46. Root: HKCR; Subkey: "SystemFileAssociations\.doc\shell"; Flags: uninsdeletekeyifempty
    
47. Root: HKCR; Subkey: "SystemFileAssociations\.doc\shell\MacroClean"; ValueType: String; ValueData: "查office病毒"; Flags: uninsdeletekey
    
48. Root: HKCR; Subkey: "SystemFileAssociations\.doc\shell\MacroClean\command"; ValueType: String; ValueData: "{app}\CleanMacro.exe /sf %1"; Flags: uninsdeletekey
    
49. Root: HKCR; Subkey: "SystemFileAssociations\.docx\shell"; Flags: uninsdeletekeyifempty
    
50. Root: HKCR; Subkey: "SystemFileAssociations\.docx\shell\MacroClean"; ValueType: String; ValueData: "查office病毒"; Flags: uninsdeletekey
    
51. Root: HKCR; Subkey: "SystemFileAssociations\.docx\shell\MacroClean\command"; ValueType: String; ValueData: "{app}\CleanMacro.exe /sf %1"; Flags: uninsdeletekey
    
52. Root: HKCR; Subkey: "SystemFileAssociations\Directory\shell\MacroClean"; ValueType: String; ValueData: "查office病毒"; Flags: uninsdeletekey
    
53. Root: HKCR; Subkey: "SystemFileAssociations\Directory\shell\MacroClean\command"; ValueType: String; ValueData: "{app}\CleanMacro.exe /sf %1"; Flags: uninsdeletekey
    
54. Root: HKCU; Subkey: "Software\Microsoft\Office\Excel\Addins\CMIFW.Connect"; ValueName: "FriendlyName"; ValueType: String; ValueData: "CMIFW.Connect"; Flags: uninsdeletekey
    
55. Root: HKCU; Subkey: "Software\Microsoft\Office\Excel\Addins\CMIFW.Connect"; ValueName: "Description"; ValueType: String; ValueData: "Immune-Office macro virus"; Flags: uninsdeletekey
    
56. Root: HKCU; Subkey: "Software\Microsoft\Office\Excel\Addins\CMIFW.Connect"; ValueName: "LoadBehavior"; ValueType: Dword; ValueData: "$3"; Flags: uninsdeletekey
    
57. Root: HKCU; Subkey: "Software\Microsoft\Office\Excel\Addins\CMIFW.Connect"; ValueName: "CommandLineSafe"; ValueType: Dword; ValueData: "$0"; Flags: uninsdeletekey
    
58. 
    
59. [Run]
    
60. Filename: "{app}\CleanMacro.exe"; Description: "{cm:LaunchProgram,Office病毒专杀}"; Flags: postinstall skipifsilent nowait
    
61. Filename: "{app}\news.TXT"; Description: "View the news file."; Flags: shellexec postinstall skipifsilent nowait
    
62. 
    
63. [Icons]
    
64. Name: "{group}\Office病毒专杀"; Filename: "{app}\CleanMacro.exe";
    
65. Name: "{group}\{cm:UninstallProgram,Office病毒专杀}"; Filename: "{uninstallexe}";
    
66. Name: "{commondesktop}\Office病毒专杀"; Filename: "{app}\CleanMacro.exe"; Tasks: desktopicon;
    
67. Name: "{userappdata}\Microsoft\Internet Explorer\Quick Launch\Office病毒专杀"; Filename: "{app}\CleanMacro.exe"; Tasks: quicklaunchicon;
    
68. 
    
69. [Tasks]
    
70. Name: "desktopicon"; Description: "{cm:CreateDesktopIcon}"; GroupDescription: "{cm:AdditionalIcons}";
    
71. Name: "quicklaunchicon"; Description: "{cm:CreateQuickLaunchIcon}"; GroupDescription: "{cm:AdditionalIcons}";
    
72. 
    
73. [CustomMessages]
    
74. chinesesimp.NameAndVersion=%1 version %2
    
75. chinesesimp.AdditionalIcons=Additional icons:
    
76. chinesesimp.CreateDesktopIcon=Create a &desktop icon
    
77. chinesesimp.CreateQuickLaunchIcon=Create a &Quick Launch icon
    
78. chinesesimp.ProgramOnTheWeb=%1 on the Web
    
79. chinesesimp.UninstallProgram=Uninstall %1
    
80. chinesesimp.LaunchProgram=Launch %1
    
81. chinesesimp.AssocFileExtension=&Associate %1 with the %2 file extension
    
82. chinesesimp.AssocingFileExtension=Associating %1 with the %2 file extension...
    
83. 
    
84. [Languages]
    
85. ; These files are stubs
    
86. ; To achieve better results after recompilation, use the real language files
    
87. Name: "chinesesimp"; MessagesFile: "embedded\chinesesimp.isl";

复制代码

新站相关
https://s.threatbook.com/report/url/abb18c7cb1203cc6805c78ba983afa96
https://s.threatbook.com/report/url/dc7bb033f101ade6f2288eda6d6250a4

旧站老版
https://virusscan.jotti.org/zh-CN/filescanjob/2b4dedpqjp
https://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=AZ-Hi9IqmTITNisAI2G4
https://virus.cverc.org.cn/#/entirety/file/searchResult?hash=316e01e7ee1b3a35b2f9ab877655ac2b
https://www.virscan.org/report/d117888c9b7263a125a9de3b7097e451ea1c5c2b2b24a4d22c1a1a009e28f57f
https://www.virustotal.com/gui/file/d117888c9b7263a125a9de3b7097e451ea1c5c2b2b24a4d22c1a1a009e28f57f
https://sandbox.qianxin.com/tq/report/toNewReport.do?rid=901ef03e0fdc0fa87b8a2064df8d3688&sk=11358480
https://s.threatbook.com/report/file/d117888c9b7263a125a9de3b7097e451ea1c5c2b2b24a4d22c1a1a009e28f57f
https://opentip.kaspersky.com/D117888C9B7263A125A9DE3B7097E451EA1C5C2B2B24A4D22C1A1A009E28F57F/results?tab=upload

疑似新站
https://virusscan.jotti.org/zh-CN/filescanjob/f801xoroor
https://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=AZ-JNm2fmTITNisAI5Rj
https://virus.cverc.org.cn/#/entirety/file/searchResult?hash=6d2de9cadded19d1a75555dfcc564d44
https://www.virscan.org/report/b048a9d317594431d0ba822b33d44810564112d9b28cb9dbb558835ae9f13027
https://sandbox.qianxin.com/tq/report/toNewReport.do?rid=c4912db2f7d2c051996e5a937ea9258e&sk=69406098
https://s.threatbook.com/report/file/b048a9d317594431d0ba822b33d44810564112d9b28cb9dbb558835ae9f13027
https://opentip.kaspersky.com/B048A9D317594431D0BA822B33D44810564112D9B28CB9DBB558835AE9F13027/results?tab=upload

旧站老版提取后自解压
https://virusscan.jotti.org/zh-CN/filescanjob/3dzwndy6oh
https://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=AZ-IC4bXONZSmF3-xMOo
https://virus.cverc.org.cn/#/entirety/file/searchResult?hash=ced1c97c64f3c624d02d7399fdbbc51a
https://www.virscan.org/report/634c319e7d7b114a64fe0e371ee15c701c2af0d2e002cceb3463f9f5ebe5d29d
https://s.threatbook.com/report/file/634c319e7d7b114a64fe0e371ee15c701c2af0d2e002cceb3463f9f5ebe5d29d
https://sandbox.qianxin.com/tq/report/toNewReport.do?rid=b7065c961139bcf3ff577445f002fdd9&sk=10097622
https://opentip.kaspersky.com/634C319E7D7B114A64FE0E371EE15C701C2AF0D2E002CCEB3463F9F5EBE5D29D/results?tab=upload

样本（回帖者提供）
提取码：nydd，解压码：无

1. https://pan.baidu.com/s/1dcV6piD8VkT5DSEYrpFmbQ?pwd=nydd

复制代码

样本（疑似新站提供）
提取码：无，解压码：无

1. https://downloadcdn.officesec.cn/bin/cleanmacroSetup.exe

复制代码

GDHJDSYDH

红伞扫描kill

3306-1

GDHJDSYDH 发表于 2026-7-22 16:05
红伞扫描kill

麻烦帮忙看看新样本（第二个）是否会被ｋ

fdsax

TsAgent 2x

post88

avast missed new one

心醉咖啡

360扫描miss

c199529

腾讯电脑管家18

双链接不报毒

GDHJDSYDH

新链接红伞扫描miss，沙盒内运行冰盾拦截数次，随后样本服务启动失败，保留了一个后台进程

wertcky

卡巴斯基两个扫描都不报。