[94b6c]过红伞

godeye

文件信息            

文件名称 :	4.3ut.exe
文件大小 :	1503232 byte
文件类型 :	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 :	94b6c149e73cf90e80487a6ffc962f16
SHA1 :	b064f2aa8776b28f3da4c34ea0b6b9c9c680f980

a-squared	4.0.0.26	20081117060118	2008-11-17	Backdoor.Pcclient!IK	2.988
AntiVir	7.9.0.31	7.1.0.90	2008-11-16	-	1.712
Arcavir	1.0.5	200811161554	2008-11-16	-	1.254
Authentium	5.1.1	200811170013	2008-11-17	-	1.173
AVAST!	3.0.1	081116-1	2008-11-16	Win32:PcClient-NM [Trj]	0.055
AVG	7.5.52.442	270.9.4/1793	2008-11-16	-	1.744
BitDefender	7.81008.2198124	7.21907	2008-11-17	Win32.Huhc.A	2.069
CA (VET)	9.0.0.143	31.6.6210	2008-11-14	-	4.039
ClamAV	0.94.1	8642	2008-11-17	-	0.318
Comodo	2.11	2.0.0.708	2008-11-16	-	0.457
CP Secure	1.1.0.715	2008.11.14	2008-11-14	-	6.478
Dr.Web	4.44.0.9170	2008.11.17	2008-11-17	-	4.086
ewido	4.0.0.2	2008.11.16	2008-11-16	-	3.125
F-Prot	4.4.4.56	20081116	2008-11-16	-	1.143
F-Secure	5.51.6100	2008.11.16.02	2008-11-16	-	0.121
GData	19.1550/19.110	20081117	2008-11-17	Win32:PcClient-NM [Trj] [Engine:B]	4.007
Ikarus	T3.1.01.45	2008.11.17.71867	2008-11-17	Backdoor.Pcclient	3.469
Microsoft	1.4104	2008.11.17	2008-11-17	-	4.692
mks_vir	2.01	2008.11.17	2008-11-17	-	2.652
Norman	5.93.01	5.93.00	2008-11-14	-	6.087
nProtect	2008-11-17.01	2542707	2008-11-17	Win32.Huhc.A	3.324
Quick Heal	10.00	2008.11.15	2008-11-15	-	1.812
Sophos	2.80.0	4.35	2008-11-17	-	2.030
Sunbelt	4474	4474	2008-11-04	-	4.924
The Hacker	6.3.1.1	v00155	2008-11-15	-	0.485
VBA32	3.12.8.9	20081116.1932	2008-11-16	-	1.735
ViRobot	20081115	2008.11.15	2008-11-15	-	1.275
VirusBuster	4.5.11.10	10.93.4/671777	2008-11-16	-	2.062
卡巴斯基	5.5.10	2008.11.16	2008-11-16	-	0.101
安博士V3	2008.11.17.03	2008.11.17	2008-11-17	-	1.076
安天	2.0.18	20081114.1573099	2008-11-14	-	0.120
江民杀毒	11.0.706	2008.11.17	2008-11-17	-	1.327
熊猫卫士	9.05.01	2008.11.16	2008-11-16	-	2.921
瑞星	20.0	21.04.00.00	2008-11-17	-	2.256
赛门铁克	1.3.0.24	20081116.003	2008-11-16	-	0.102
趋势科技	8.700-1004	5.656.01	2008-11-16	-	0.392
迈克菲	5.3.00	5436	2008-11-16	New Win32	2.540
金山毒霸	2008.9.8.18	2008.11.13.23	2008-11-13	Win32.Huhk.c.1300	9.250
飞塔	2.81-3.117	9.714	2008-11-15	-	0.710

Table of Contents
expand all	collapse all
General information                  [url=]sample.exe[/url]                              [url=]C:\sample.exe[/url]                          [url=]Primary Analysis Subject[/url]                          General Information                              a)                                 Registry Activities                              b)                                 File Activities                              c)                                 Process Activities                              d)                                 Other Activities                  [url=]temparation.tmp[/url]

Summary:                                                                    

Description	Risk
Performs File Modification and Destruction: The executable modifies and destructs files which are not temporary.
Spawns Processes: The executable produces processes during the execution.
Performs Registry Activities: The executable reads and modifies register values. It also creates and monitors register keys.

File ID	Filename	Size (Byte)	Result
25190047	4.3UT.RAR	597.59 KB	OK

A listing of files contained inside archives alongside their results can be found below:

File ID	Filename	Size (Byte)	Result
25190048	4.3ut.exe	1.43 MB	UNDER ANALYSIS

[ 本帖最后由 godeye 于 2008-11-17 15:26 编辑 ]

西风萧雨

will

vista下跑不起来

yybcym

过了红伞和卡巴，但没有过AVG

godeye

We received the following archive files:

File ID	Filename	Size (Byte)	Result
25190047	4.3UT.RAR	597.59 KB	OK

A listing of files contained inside archives alongside their results can be found below:

File ID	Filename	Size (Byte)	Result
25190048	4.3ut.exe	1.43 MB	MALWARE

Please find a detailed report concerning each individual sample below:

Filename

Result

4.3ut.exe

MALWARE

The file '4.3ut.exe' has been determined to be 'MALWARE'.
Our analysts named the threat TR/PSW.Wow.ndz.The term "TR/" denotes a trojan horse that is able to spy out data, toviolate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

walkman660

是毒吗 ？ 虚拟机下开HIPS没反应

loveyuwei

Dr.Web 0

leonfg

蜘蛛不识，诺顿不认

BING126

McAfee New Win32

尤金卡巴斯基

To KL