收集的样本一个

molicn

文件Setup.rar接收于2009.02.22 13:10:20 (CET)
当前状态:正在读取 ...队列中等待中扫描中完成未发现停止

结果:1/37 (2.71%)

未知样本 !
COMODO
检测报告:
File Info

Name	Value
Size	1036668
MD5	196de59f9e926aca8bb40dfd5434d033
SHA1	3bd09d7f7e01590c2988fa65f97b02147367887a
SHA256	840d128e297dde4fa7453f07d62011803a621d2b978903751e63ec7a9138ac8d
Process	Active

• Keys Created• Keys Changed• Keys Deleted• Values Created• Values Changed• Values Deleted• Directories Created

Name	Last Write Time	Creation Time	Last Access Time	Attr
C:\Documents and Settings\User\Local Settings\Temp\$inst	2009.01.12 15:12:54.968	2009.01.12 15:12:52.375	2009.01.12 15:12:54.968	0x10

• Directories Changed• Directories Deleted• Files Created

Name	Size	Last Write Time	Creation Time	Last Access Time	Attr
C:\Documents and Settings\User\Local Settings\Temp\$inst\2.tmp	29268	2009.01.12 15:12:52.625	2009.01.12 15:12:52.609	2009.01.12 15:12:52.609	0x20
C:\Documents and Settings\User\Local Settings\Temp\$inst\4.tmp	6968	2004.10.31 19:50:44.000	2004.10.31 19:50:44.000	2009.01.12 15:12:52.906	0x20
C:\Documents and Settings\User\Local Settings\Temp\$inst\5.tmp	52574	2004.12.14 19:10:44.000	2004.12.14 19:10:44.000	2009.01.12 15:12:53.484	0x20
C:\Documents and Settings\User\Local Settings\Temp\$inst\7.tmp	6968	2004.11.01 20:40:50.000	2004.11.01 20:40:50.000	2009.01.12 15:12:54.968	0x20

• Files Changed• Files Deleted• Directories Hidden• Files Hidden• Drivers Loaded• Drivers Unloaded• Processes Created• Processes Terminated• Threads Created

PId	Process Name	TId	Start	Start Mem	Win32 Start	Win32 Start Mem
0x348	svchost.exe	0xf8	0x7c810856	MEM_IMAGE	0x7c910760	MEM_IMAGE
0x3f4	svchost.exe	0x67c	0x7c810856	MEM_IMAGE	0x77e76bf0	MEM_IMAGE

• Modules Loaded• Windows Api Calls• DNS Queries• HTTP Queries• Verdict

Auto Analysis Verdict

Not Rated as Suspicious

• Mutexes Created or Opened

PId	Image Name	Address	Mutex Name
0x684	C:\TEST\sample.exe	0x7c81a838	ShimCacheMutex

• Events Created or Opened

PId	Image Name	Address	Event Name
0x684	C:\TEST\sample.exe	0x77a89422	Global\crypt32LogoffEvent

[ 本帖最后由 molicn 于 2009-2-22 23:25 编辑 ]

Palkia

to rs

尤金卡巴斯基

To KL

ledled

VirusBuster found nothing

molicn

应 毒组要求撤销样本 禁止任何传播！
此样本有绝对危险性！不在论坛上报

[ 本帖最后由 molicn 于 2009-2-22 22:21 编辑 ]

lixiang1977

原帖由 molicn 于 2009-2-22 22:19 发表
应 毒组要求撤销样本 禁止任何传播！
此样本有绝对危险性！不在论坛上报

这么好的样本不用HIPS测试一下实在是太可惜了！

saga3721

开放的军火库里还在乎多放少放一把枪吗？何况这把枪的作者并没有宣布罢手。

wolf64

浪费啊，来晚了。

leonfg

哎 来晚啦

The EQs

有多危险？