视频图标exe 之一（30x） 卡巴不报

浪滔天

有一大堆，先来30个

[ 本帖最后由 浪滔天 于 2009-1-2 23:37 编辑 ]

gomu887

全过费尔，附上VT报告

文件 001.exe 接收于 2009.01.02 16:31:53 (CET)

反病毒引擎	版本	最后更新	扫描结果
a-squared	4.0.0.73	2008.12.31	-
AhnLab-V3	2008.12.31.0	2009.01.02	-
AntiVir	7.9.0.45	2009.01.02	BDS/Hupigon.Gen
Authentium	5.1.0.4	2009.01.02	W32/Nilage.gen!GSA
Avast	4.8.1281.0	2009.01.02	Win32:Spyware-gen
AVG	8.0.0.199	2008.12.31	-
BitDefender	7.2	2009.01.02	GenPack:Generic.Malware.SYd!dldspg.60F1EC8C
CAT-QuickHeal	10.00	2009.01.02	-
ClamAV	0.94.1	2009.01.02	-
Comodo	851	2008.12.31	-
DrWeb	4.44.0.09170	2009.01.02	-
eTrust-Vet	31.6.6287	2009.01.01	-
Ewido	4.0	2008.12.31	-
F-Prot	4.4.4.56	2008.12.30	W32/Nilage.gen!GSA
F-Secure	8.0.14470.0	2009.01.02	-
Fortinet	3.117.0.0	2009.01.02	-
GData	19	2008.12.31	GenPack:Generic.Malware.SYd!dldspg.60F1EC8C
Ikarus	T3.1.1.45.0	2009.01.02	-
K7AntiVirus	7.10.572	2008.12.31	-
Kaspersky	7.0.0.125	2009.01.02	-
McAfee	5481	2009.01.02	-
McAfee+Artemis	5479	2008.12.30	-
Microsoft	1.4205	2009.01.02	TrojanSpy:Win32/Pophot.A
NOD32	3725	2008.12.31	a variant of Win32/Spy.Pophot
Norman	5.80.02	2009.01.02	W32/Hupigon.EVAO
Panda	9.0.0.4	2009.01.02	Suspicious file
PCTools	4.4.2.0	2008.12.31	Packed/MKFPack
Prevx1	V2	2009.01.02	-
Rising	21.10.22.00	2008.12.31	-
SecureWeb-Gateway	6.7.6	2008.12.31	Trojan.Backdoor.Hupigon.Gen
Sophos	4.37.0	2009.01.02	Sus/UnkPacker
Sunbelt	3.2.1809.2	2008.12.22	-
Symantec	10	2008.12.31	-
TheHacker	6.3.1.4.204	2009.01.02	-
TrendMicro	8.700.0.1004	2008.12.31	-
VBA32	3.12.8.10	2009.01.01	Trojan-Spy.Win32.Pophot.gsi
ViRobot	2008.12.30.1540	2008.12.31	-
VirusBuster	4.5.11.0	2009.01.01	Packed/MKFPack
附加信息
File size: 245114 bytes
MD5...: dc3bd2fa725a574f9c4b9febee54a67f
SHA1..: 3ac9796205e554334841ac900c73cefc381e4200
SHA256: b7a922365fc4220959cfdd2b478f5d89321e74ea8d150571a7c266bd58bc336d
SHA512: 09deb35ddcd20b215ee27e02e203e7f222f021496ea1efc96ddd759e21f50ac6<BR>3d3278976c7c0321a7c677fd1b835fc414f78376f8ec8795f25a48e5bbc44ef8<BR>
ssdeep: 6144:EdxCKjQDsRS2f62Hjwl160pKm+DP25kjep:oI/xNH6QWg<BR>
PEiD..: -
TrID..: File type identification<BR>Win32 Executable Generic (58.3%)<BR>Win16/32 Executable Delphi generic (14.1%)<BR>Generic Win/DOS Executable (13.7%)<BR>DOS Executable Generic (13.6%)<BR>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x4568bc<BR>timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 3 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>CODE 0x1000 0x10000 0x5200 7.88 86bf98bbaca526e1ba4bd9462781502a<BR>.rsrc 0x11000 0x45000 0x20e00 7.92 0e9b6cb8a9afb6baafac978990b3fd72<BR>.llydd 0x56000 0x2000 0x1400 4.20 fc952c14bd48611d6a5b129cb8b6d6b0<BR><BR>( 12 imports ) <BR>> Kernel32.dll: GetProcAddress, LoadLibraryA, GetModuleHandleA, VirtualAlloc, VirtualFree<BR>> kernel32.dll: DeleteCriticalSection<BR>> user32.dll: GetKeyboardType<BR>> advapi32.dll: RegQueryValueExA<BR>> oleaut32.dll: SysFreeString<BR>> kernel32.dll: TlsSetValue<BR>> advapi32.dll: RegQueryValueExA<BR>> kernel32.dll: lstrlenW<BR>> user32.dll: PeekMessageA<BR>> kernel32.dll: ExitProcess<BR>> user32.dll: SendMessageA<BR>> advapi32.dll: RegCreateKeyA<BR><BR>( 0 exports ) <BR>
packers (F-Prot): mkfpack
packers (Authentium): mkfpack

The EQs

[:27:] [:27:] [:27:] pophot，别以为换了MJ我就不认识你，以前是wmp的图标，现在换成real了

sam.to

to kl


有沒有视频图标exe 之二?

浪滔天

之三都有~

syfwxmh

你可以让他们更新gen了

The EQs

023是误报，winrar压缩的，解压缩只有wmv格式的文件

sam.to

这个是什么type也不知道,怎能这样做呢

The EQs

卡巴有pophot的通用检测，放一个上来

syfwxmh

TO KL Heur Detection Manager