刚提取的一个过NOD32跟红伞的样本

弧光

此样本卡巴等都暴。只是NOD32，红伞，跟国内杀软不暴
样本
样本下载

luxiao200888

Filename	Result
shuangkai.exe	CLEAN

[ 本帖最后由 luxiao200888 于 2008-11-22 19:14 编辑 ]

wxb1994

红伞被过了    就实机运行

EQ拦截日记：

2008-11-22 19:15:03    运行应用程序      操作:允许
进程路径:C:\windows\EXPLORER.EXE
文件路径:C:\Documents and Settings\Administrator\桌面\shuangkai.exe
触发规则:应用程序规则->Windows系统程序->%Windir%\explorer.exe->*

2008-11-22 19:15:06    运行应用程序      操作:允许
进程路径:C:\windows\EXPLORER.EXE
文件路径:C:\windows\system32\taskmgr.exe
触发规则:应用程序规则->Windows系统程序->%Windir%\explorer.exe->*

2008-11-22 19:15:16    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\shuangkai.exe
文件路径:C:\Documents and Settings\Administrator\桌面\破解文件.EXE
触发规则:所有程序规则->*

2008-11-22 19:15:21    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\破解文件.EXE
文件路径:C:\windows\system32\d812a079.sys
触发规则:所有程序规则->系统文件夹反病毒保护->%WinDir%\*.sys

2008-11-22 19:15:26    创建注册表值      操作:阻止
进程路径:C:\windows\system32\SERVICES.EXE
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\d812a079
注册表名称:[Key]
触发规则:应用程序规则->系统程序->%WinDir%\system32\services.exe->HKEY_LOCAL_MACHINE\SYSTEM\ControlSet*\Services\*

2008-11-22 19:15:28    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\破解文件.EXE
文件路径:C:\windows\system32\122B901E.dll
触发规则:所有程序规则->系统文件夹反病毒保护->%WinDir%\*.dll

2008-11-22 19:15:28    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\破解文件.EXE
文件路径:C:\windows\system32\122B901E.dll
触发规则:应用程序规则->自动创建规则->C:\Documents and Settings\Administrator\桌面\破解文件.EXE->C:\windows\system32\122B901E.dll

2008-11-22 19:15:28    删除文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\破解文件.EXE
文件路径:C:\windows\system32\VErCLSiD.exe
触发规则:高优先规则->！Windows重要文件保护！->%Windir%\system32\verclsid.exe

2008-11-22 19:15:42    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\破解文件.EXE
文件路径:C:\windows\system32\VErCLSiD.exe
命令行:/C {122B901E-493F-4AD9-BC69-7DE8C3E52FCC} /I {00000000-0000-0000-C000-000000000046} /X 0x401
触发规则:所有程序规则->*

2008-11-22 19:15:44    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\破解文件.EXE
文件路径:C:\windows\system32\cmd.exe
命令行:/c del C:\DOCUME~1\ADMINI~1\桌面\破解文件.exe >> NUL
触发规则:所有程序规则->*

2008-11-22 19:15:47    运行应用程序      操作:允许
进程路径:C:\windows\EXPLORER.EXE
文件路径:C:\Documents and Settings\Administrator\桌面\破解文件.EXE
触发规则:应用程序规则->Windows系统程序->%Windir%\explorer.exe->*

2008-11-22 19:15:47    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\破解文件.EXE
文件路径:C:\windows\system32\d812a079.sys
触发规则:应用程序规则->自动创建规则->C:\Documents and Settings\Administrator\桌面\破解文件.EXE->C:\windows\system32\d812a079.sys

2008-11-22 19:15:50    创建注册表值      操作:阻止
进程路径:C:\windows\system32\SERVICES.EXE
注册表路径:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\d812a079
注册表名称:[Key]
触发规则:应用程序规则->系统程序->%WinDir%\system32\services.exe->HKEY_LOCAL_MACHINE\SYSTEM\ControlSet*\Services\*

2008-11-22 19:15:50    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\破解文件.EXE
文件路径:C:\windows\system32\122B901E.dll
触发规则:应用程序规则->自动创建规则->C:\Documents and Settings\Administrator\桌面\破解文件.EXE->C:\windows\system32\122B901E.dll

2008-11-22 19:15:50    创建文件      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\破解文件.EXE
文件路径:C:\windows\system32\122B901E.dll
触发规则:应用程序规则->自动创建规则->C:\Documents and Settings\Administrator\桌面\破解文件.EXE->C:\windows\system32\122B901E.dll

2008-11-22 19:15:51    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\破解文件.EXE
文件路径:C:\windows\system32\cmd.exe
命令行:/c del C:\DOCUME~1\ADMINI~1\桌面\破解文件.exe >> NUL
触发规则:应用程序规则->自动创建规则->C:\Documents and Settings\Administrator\桌面\破解文件.EXE->C:\windows\system32\cmd.exe

2008-11-22 19:15:54    运行应用程序      操作:允许
进程路径:C:\windows\EXPLORER.EXE
文件路径:C:\Documents and Settings\Administrator\桌面\完美双开外挂.exe
触发规则:应用程序规则->Windows系统程序->%Windir%\explorer.exe->*

[ 本帖最后由 wxb1994 于 2008-11-22 19:19 编辑 ]

尤金卡巴斯基

2008/11/22 19:15:14        检测到        木马程序 Trojan.Win32.Chifrax.a        http://sh.qiannao.com/servlet/FileDownload?filename=//huguang007/上传分享/2008/11/22/shuangkai.exe&vid=0&vid2=0

kingmuro

过诺顿10.1

sqsszzq

诺顿2009飘过

qwer9909

*** C:\Documents and Settings\Administrator\桌面\shuangkai.exe -> Virus W32/Packed_Upack.I ()

终于看到NORMAN的沙盘跳出来一次。太强大了！~

[ 本帖最后由 qwer9909 于 2008-11-22 21:46 编辑 ]

z8820086

红伞的回复 没问题
=================================
Thank you for your submission. Below you can see the current status of the uploaded files.


--------------------------------------------------------------------------------


We received the following archive files:



File ID  Filename Size (Byte) Result
25194936  shuangkai.rar 72.42 KB OK

A listing of files contained inside archives alongside their results can be found below:

File ID  Filename Size (Byte) Result
25010905  shuangkai.exe  101.31 KB  CLEAN


Please find a detailed report concerning each individual sample below:

Filename Result
shuangkai.exe  CLEAN

The file 'shuangkai.exe' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.


--------------------------------------------------------------------------------
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

woai_jolin

sandbox报壳

lpgo

NOD32 继续无视..