本人新出炉作品，加壳n层，改跳针，antivir依然报，汗

显示全部楼层 · 发表于 2007-2-6 09:16:41

挂的上报去吧，但是不知道运行之后会不会报，释放两个文件，用nod的有兴趣测试一下
只用vt测试了主程序，我把生成物也仍在包里面了
果然我没看错熊猫的tp，够bt
Complete scanning result of "gmsex.rar", received in VirusTotal at 02.06.2007, 02:05:57 (CET).
Antivirus Version Update Result
AntiVir 7.3.1.34 02.06.2007 HEUR/Malware
Authentium 4.93.8 02.06.2007 no virus found
Avast 4.7.936.0 02.05.2007 no virus found
AVG 386 02.05.2007 no virus found
BitDefender 7.2 02.05.2007 no virus found
CAT-QuickHeal 9.00 02.05.2007 (Suspicious) - DNAScan
ClamAV devel-20060426 02.05.2007 no virus found
DrWeb 4.33 02.05.2007 no virus found
eSafe 7.0.14.0 02.05.2007 Suspicious Trojan/Worm
eTrust-InoculateIT 30.4.3371 02.05.2007 no virus found
eTrust-Vet 30.4.3371 02.05.2007 no virus found
Ewido 4.0 02.05.2007 no virus found
Fortinet 2.85.0.0 02.06.2007 no virus found
F-Prot 4.2.1.29 02.05.2007 no virus found
Ikarus T3.1.0.31 02.06.2007 no virus found
Kaspersky 4.0.2.24 02.06.2007 no virus found
McAfee 4956 02.05.2007 no virus found
Microsoft 1.2101 02.06.2007 no virus found
NOD32v2 2039 02.06.2007 no virus found
Norman 5.80.02 02.05.2007 no virus found
Panda 9.0.0.4 02.06.2007 Suspicious file
Prevx1 V2 02.06.2007 no virus found
Sophos 4.13.0 02.05.2007 no virus found
Sunbelt 2.2.907.0 02.02.2007 VIPRE.Suspicious
Symantec 10 02.06.2007 no virus found
TheHacker 6.1.6.052 02.05.2007 no virus found
UNA 1.83 02.05.2007 no virus found
VBA32 3.11.2 02.05.2007 suspected of Malware.Delf.8
VirusBuster 4.3.19:9 02.05.2007 no virus found

Aditional Information
File size: 69701 bytes
MD5: 0307d2484208b92c0a0b97153e942abd
SHA1: 34e5b0412b5abc473495021119fb618c08cd7a91
packers: PECOMPACT, BINARYRES, PECOMPACT
packers: PecBundle, PECompact
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

显示全部楼层 · 发表于 2007-2-6 09:22:07

已上报卡巴

显示全部楼层 · 发表于 2007-2-6 09:29:37

不错的样本。过几天再送VirusTotal看看上报效率。。

显示全部楼层 · 发表于 2007-2-6 09:38:40

我运行了，释放两个文件，被微点拦截。

显示全部楼层 · 发表于 2007-2-6 09:56:40

咖啡无法运行这个病毒，禁止访问，555555555

显示全部楼层 · 发表于 2007-2-6 09:57:49

绿色杀手报……………………………………………………………………………………

显示全部楼层 · 发表于 2007-2-6 09:58:17

又改了一下
感觉vt查壳有问题。。
不过怀疑上面的那个能杀了这个也就能了，这次没怎么好好加，刚刚吃饭回来
一起扔上来吧
AntiVir 7.3.1.34 02.06.2007 HEUR/Malware
Authentium 4.93.8 02.06.2007 Possibly a new variant of W32/Threat-HLLAN-based!Maximus
Avast 4.7.936.0 02.05.2007 no virus found
AVG 386 02.05.2007 no virus found
BitDefender 7.2 02.05.2007 no virus found
CAT-QuickHeal 9.00 02.05.2007 no virus found
ClamAV devel-20060426 02.05.2007 no virus found
DrWeb 4.33 02.05.2007 no virus found
eSafe 7.0.14.0 02.05.2007 Suspicious Trojan/Worm
eTrust-InoculateIT 30.4.3371 02.05.2007 no virus found
eTrust-Vet 30.4.3371 02.05.2007 no virus found
Ewido 4.0 02.05.2007 no virus found
Fortinet 2.85.0.0 02.06.2007 suspicious
F-Prot 4.2.1.29 02.05.2007 W32/Threat-HLLAN-based!Maximus
Ikarus T3.1.0.31 02.06.2007 Virus.Win32.HLLW.MyBot
Kaspersky 4.0.2.24 02.06.2007 no virus found
McAfee 4956 02.05.2007 no virus found
Microsoft 1.2101 02.06.2007 no virus found
NOD32v2 2039 02.06.2007 no virus found
Norman 5.80.02 02.05.2007 no virus found
Panda 9.0.0.4 02.06.2007 Suspicious file
Prevx1 V2 02.06.2007 no virus found
Sophos 4.13.0 02.05.2007 no virus found
Sunbelt 2.2.907.0 02.02.2007 no virus found
Symantec 10 02.06.2007 no virus found
TheHacker 6.1.6.052 02.05.2007 no virus found
UNA 1.83 02.05.2007 no virus found
VBA32 3.11.2 02.05.2007 no virus found
VirusBuster 4.3.19:9 02.05.2007 no virus found

Aditional Information
File size: 76587 bytes
MD5: 769d0a41094491cce93e35114f083abc
SHA1: 3404bf40e362c895e7e671114226676be836ad84
packers: ASPACK

显示全部楼层 · 发表于 2007-2-6 09:59:00

M版，7楼的那个样本还是无法运行啊，咖啡的规则有些霸道啊

显示全部楼层 · 发表于 2007-2-6 10:01:04

给AVG Antispyware传一个看看。。

显示全部楼层 · 发表于 2007-2-6 10:06:29

费尔对俩压缩包静态扫面均没反应。

楼主高！

[病毒样本] 本人新出炉作品，加壳n层，改跳针，antivir依然报，汗

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块