全部的杀毒软件报告没有发现我是马？？？

显示全部楼层 · 发表于 2009-3-23 13:55:31

全部的杀毒软件报告没有发现我是马？？？

质量很高，请上报你的杀毒软件，to 江民KV2009、费尔

下载：h ttp://www.tl41.com/魅力专用下载器.exe

样本所在服务器更新时间：Fri, 20 Mar 2009 10:39:01 GMT

Norman SandBox Reporter

&#23567 : Not detected by Sandbox (Signature: NO_VIRUS)

[ DetectionInfo ]
* Filename: C:\analyzer\scan\&#23567.
* Sandbox name: NO_MALWARE
* Signature name: NO_VIRUS.
* Compressed: NO.
* TLS hooks: NO.
* Executable type: Application.
* Executable file structure: OK.
* Filetype: PE_I386.

[ General information ]

* File length:       7680 bytes.
* MD5 hash: 1ba373716e70f46ce18207703313ec29.

[ Changes to filesystem ]
* Deletes file c:\xxa.exe.
* Deletes file c:\xxb.exe.
* Deletes file c:\xxc.exe.
* Deletes file c:\xxd.exe.
* Deletes file c:\xxe.exe.

VirSCAN.org Scanned Report :
Scanned time : 2009/03/23 13:16:57 (CST)
Scanner results: 全部的杀毒软件报告没有发现病毒!
File Name    : 1316.rar
File Size    : 4940 byte
File Type    : RAR archive data, v1d, os
MD5          : 782054b4a8e5f44f4906bdcaa4716db5
SHA1          : 7794f332da2215988e03a7c6a20123f9d1252050
Online report  : ht tp://virscan.org/report/87803afdc71494f70bfe55de1b81e743.html

Scanner       Engine Ver    Sig Ver          Sig Date Time Scan result
a-squared    4.0.0.32       20090318163345 2009-03-18  2.64 -
安博士V3    2009.03.22.00 2009.03.22       2009-03-22  1.08 -
AntiVir       7.9.0.120    7.1.2.200       2009-03-22  1.90 -
安天          2.0.18       20090322.2224138  2009-03-22  0.12 -
Authentium    5.1.1          200903230127    2009-03-23  1.10 -
AVAST!       3.0.1          090322-0       2009-03-22  0.88 -
AVG          7.5.52.442    270.11.15/2004 2009-03-16  1.98 -
BitDefender 7.81008.2814780 7.24362          2009-03-23  2.64 -
CA (VET)    9.0.0.143    31.6.6409       2009-03-21  3.90 -
ClamAV       0.94.2       9150             2009-03-23  0.01 -
Comodo       3.8          1080             2009-03-22  0.53 -
CP Secure    1.1.0.715    2009.03.23       2009-03-23  7.69 -
Dr.Web       4.44.0.9170    2009.03.23       2009-03-23  4.25 -
F-Prot       4.4.4.56       20090323       2009-03-23  1.10 -
F-Secure    5.51.6100    2009.03.23.01    2009-03-23  0.08 -
飞塔          2.81-3.117    10.192          2009-03-22  0.14 -
GData       19.4164/19.270  20090323       2009-03-23  3.42 -
ViRobot       20090320       2009.03.20       2009-03-20  0.41 -
Ikarus       T3.1.01.48    2009.03.23.72462  2009-03-23  3.30 -
江民杀毒    11.0.706       2009.03.22       2009-03-22  1.60 -
卡巴斯基    5.5.10       2009.03.23       2009-03-23  0.07 -
金山毒霸    2009.2.5.15    2009.3.23.7    2009-03-23  0.57 -
迈克菲       5.3.00       5561             2009-03-22  2.69 -
Microsoft    1.4502       2009.03.23       2009-03-23  5.78 -
mks_vir       2.01          2009.03.23       2009-03-23  2.73 -
Norman       6.00.06       6.00.00          2009-03-20  8.01 -
熊猫卫士    9.05.01       2009.03.22       2009-03-22  1.52 -
趋势科技    8.700-1004    5.912.02       2009-03-22  0.03 -
Quick Heal    10.00          2009.03.23       2009-03-23  0.96 -
瑞星          20.0          21.22.00.00    2009-03-23  0.24 -
Sophos       2.84.1       4.39             2009-03-23  2.18 -
Sunbelt       5054          5054             2009-03-22  0.56 -
赛门铁克    1.3.0.24       20090322.005    2009-03-22  0.19 -
nProtect    20090322.01    3373380          2009-03-22  4.03 -
The Hacker    6.3.3.3       v00287          2009-03-22  0.50 -
VBA32       3.12.10.1    20090322.1902    2009-03-22  1.75 -
VirusBuster 4.5.11.10    10.102.18/987301  2009-03-22  1.23 -

文件 1316.rar 接收于 2009.03.23 06:17:17 (CET)
结果: 2/39 (5.13%)
h ttp://www.virustotal.com/zh-cn/analisis/4456298ad8426945b5a6bb1e05821978

显示全部楼层 · 发表于 2009-3-23 13:59:58

Ultra String Reference
Address Disassembly                            Text String
0040126B push 004010F4                         msxml2.xmlhttp
004012B7 push 004010F0                         getmsxml2.xmlhttp
00401448 push 00401134                         c:\xxa.exe
0040144F push 00401128                         c:\xxb.exe
00401456 push 0040111C                         c:\xxc.exe
0040145D push 00401110                         c:\xxd.exe
00401464 mov    ebx, 00401104                   c:\xxe.exe
00401970 mov    esi, 00401134                   c:\xxa.exe
00401988 push 00401128                         c:\xxb.exe
00401999 push 0040111C                         c:\xxc.exe
004019A4 mov    edi, 00401110                   c:\xxd.exe
004019D3 push 00401128                         c:\xxb.exe
004019DC push 0040111C                         c:\xxc.exe
004019FC push 00401134                         c:\xxa.exe
00401A04 push 00401128                         c:\xxb.exe
00401A0C push 0040111C                         c:\xxc.exe
004020AC push ebp                            (initial cpu selection)

显示全部楼层 · 发表于 2009-3-23 14:06:00

AVG的Identify Protection能杀~！

这个东西有个联网的动作~！

显示全部楼层 · 发表于 2009-3-23 14:07:07

我是进来看结果的...我没有测试的装备,就不测试了...

显示全部楼层 · 发表于 2009-3-23 14:10:55

过咖啡8.7和pctools

显示全部楼层 · 发表于 2009-3-23 14:11:40

AVERT Labs - Beaverton
Current Scan Engine Version:5300.2777
Current DAT Version:5561.0000
Thank you for your submission.

Analysis ID: 5211977

File Name          Findings                      Detection                   Type       Extra
--------------------|------------------------------|----------------------------|------------|-----
xxxxxxxxxxxxxx.exe  |inconclusive                |                         |          |no

显示全部楼层 · 发表于 2009-3-23 14:17:30

晕，我没设置密码是因为卡巴不报，哎，回信说：Please resend the file in archive with password "infected" (without quotas). ：（

沙盘日志运行结果：ht tp://www.threatexpert.com/report.aspx?md5=1ba373716e70f46ce18207703313ec29

显示全部楼层 · 发表于 2009-3-23 14:19:04

Hello,

L+ж+иL+TL+.exe - Trojan-Downloader.Win32.Small.jli

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

显示全部楼层 · 发表于 2009-3-23 14:24:42

mcafee 报毒

显示全部楼层 · 发表于 2009-3-23 14:32:14

to VB

[病毒样本] 全部的杀毒软件报告没有发现我是马？？？

本帖子中包含更多资源

评分

咖啡回复

卡巴回复

评分