查看: 5064|回复: 5
收起左侧

[病毒样本] 红伞报毒。ollydbg。exe(更新下载地址)

[复制链接]
mmc88888888
发表于 2009-10-30 16:14:09 | 显示全部楼层 |阅读模式
打算学习OllyDbg 1.10.3 聆风听雨汉化第三版啦。当ollyDbg 1.10.3 聆风听雨汉化第三版下载解压后直接被红伞杀掉。。。
各位帮我看下。这个真的是木马病毒。。还是误报
重新换了个地址嘻嘻
文件地址:
http://www.datafilehost.com/download-d4914119.html




附www.virustotal.com扫描日志

反病毒引擎版本最后更新扫描结果
a-squared4.5.0.242009.09.11Trojan-Dropper.Agent!IK
AhnLab-V35.0.0.22009.09.11-
AntiVir7.9.1.142009.09.11TR/Dldr.Agent.bvct.1
Antiy-AVL2.0.3.72009.09.11-
Authentium5.1.2.42009.09.11-
Avast4.8.1351.02009.09.10Win32:Trojan-gen {Other}
AVG8.5.0.4122009.09.11Downloader.Agent2.CUS
BitDefender7.22009.09.11Trojan.Generic.1934286
CAT-QuickHeal10.002009.09.11TrojanDownloader.Agent.bfyp
ClamAV0.94.12009.09.11-
Comodo22802009.09.11UnclassifiedMalware
DrWeb5.0.0.121822009.09.11-
eSafe7.0.17.02009.09.10Win32.Banker
eTrust-Vet31.6.67322009.09.11Win32/ASuspect.GHNPU
F-Prot4.5.1.852009.09.10-
F-Secure8.0.14470.02009.09.11-
Fortinet3.120.0.02009.09.11W32/Agent.BVCT!tr.dldr
GData192009.09.11Trojan.Generic.1934286
IkarusT3.1.1.72.02009.09.11Trojan-Dropper.Agent
Jiangmin11.0.8002009.09.11-
K7AntiVirus7.10.8412009.09.10Trojan-Downloader.Win32.Agent.bvct
Kaspersky7.0.0.1252009.09.11-
McAfee57372009.09.10Suspect-1B!AD9D94FB1722
McAfee+Artemis57372009.09.10Suspect-1B!AD9D94FB1722
McAfee-GW-Edition6.8.52009.09.11Trojan.Dldr.Agent.bvct.1
Microsoft1.50052009.09.11-
NOD3244162009.09.11probably a variant of Win32/TrojanDownloader.Agent
Norman6.01.092009.09.10W32/DLoader.TXZW
nProtect2009.1.8.02009.09.11Trojan-Downloader/W32.Agent.1185280
Panda10.0.2.22009.09.10Trj/CI.A
PCTools4.4.2.02009.09.10-
Prevx3.02009.09.11High Risk Cloaked Malware
Rising21.46.42.002009.09.11-
Sophos4.45.02009.09.11Mal/Generic-A
Sunbelt3.2.1858.22009.09.11Trojan.Win32.Generic!BT
Symantec1.4.4.122009.09.11Downloader
TheHacker6.3.4.4.4002009.09.10Trojan/Downloader.Agent.bvct
TrendMicro8.950.0.10942009.09.11-
VBA323.12.10.102009.09.11-
ViRobot2009.9.11.19302009.09.11-
VirusBuster4.6.5.02009.09.10Trojan.DL.Agent.HJCV
附加信息
File size: 1185280 bytes
MD5   : ad9d94fb172204481aa17bb827968953
SHA1  : 9df465a3377268ea3161cc143d1192ec0e724552
SHA256: 0bcb3d935b18abae97c24ae6ab6d701c0593c7d019127a23301809bfc0d3b3a2
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1000
timedatestamp.....: 0x40B10868 (Sun May 23 22:24:08 2004)
machinetype.......: 0x14C (Intel I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xAF000 0xAE800 6.54 2587fc2172b79db3a6aaf90f722b0938
.data 0xB0000 0x5B000 0x1D200 5.76 1c99f2e4609524c699d03965eddcc200
.tls 0x10B000 0x1000 0x200 0.00 bf619eac0cdf3f68d496ea9344137e8b
.rdata 0x10C000 0x1000 0x200 0.21 4d6408b735495136ef3537dfc3077884
.idata 0x10D000 0x2000 0x1E00 5.05 87adbffcf34aa24816c61475732631e9
.edata 0x10F000 0x2000 0x1400 5.52 34f11a68bfeee3260eb391c48187ca19
.rsrc 0x111000 0x4601C 0x4601C 7.53 dbd5613f3176b9a39401b5e0ced212b7
.reloc 0x158000 0xC000 0xBE00 6.82 1c968add2e216f88dccf3336d7d0c7ca

( 9 imports )

> advapi32.dll: RegCloseKey, RegCreateKeyA, RegDeleteKeyA, RegOpenKeyA, RegQueryValueExA, RegSetValueExA
> comctl32.dll: -
> comdlg32.dll: ChooseFontA, CommDlgExtendedError, GetOpenFileNameA, GetSaveFileNameA
> gdi32.dll: AddFontResourceA, BitBlt, CreateCompatibleBitmap, CreateCompatibleDC, CreateFontA, CreateFontIndirectA, CreatePen, CreateSolidBrush, DeleteDC, DeleteObject, EnumFontFamiliesA, ExcludeClipRect, ExtTextOutA, ExtTextOutW, GetClipBox, GetDCOrgEx, GetNearestColor, GetObjectA, GetObjectType, GetStockObject, GetTextMetricsA, IntersectClipRect, LineTo, MoveToEx, RemoveFontResourceA, SelectClipRgn, SelectObject, SetBkColor, SetBkMode, SetTextAlign, SetTextColor
> kernel32.dll: CloseHandle, ContinueDebugEvent, CreateDirectoryA, CreateFileA, CreateProcessA, DebugActiveProcess, DeleteFileA, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileA, FindNextFileA, FindResourceA, FlushInstructionCache, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStrings, GetFileAttributesA, GetFileSize, GetFileTime, GetFileType, GetLastError, GetLocalTime, GetLocaleInfoA, GetModuleFileNameA, GetModuleHandleA, GetOEMCP, GetPriorityClass, GetPrivateProfileIntA, GetPrivateProfileStringA, GetProcAddress, GetProcessHeap, GetStartupInfoA, GetStdHandle, GetStringTypeA, GetStringTypeW, GetSystemDefaultLangID, GetSystemDirectoryA, GetThreadContext, GetThreadPriority, GetThreadSelectorEntry, GetTickCount, GetUserDefaultLCID, GetVersion, GetVersionExA, GetWindowsDirectoryA, GlobalAlloc, GlobalFree, GlobalLock, GlobalMemoryStatus, GlobalReAlloc, GlobalSize, GlobalUnlock, HeapAlloc, HeapFree, IsValidLocale, LCMapStringA, LeaveCriticalSection, LoadLibraryA, LoadResource, LockResource, MoveFileA, MulDiv, MultiByteToWideChar, OpenProcess, RaiseException, ReadFile, ReadProcessMemory, ResumeThread, RtlUnwind, SearchPathA, SetConsoleCtrlHandler, SetEvent, SetFilePointer, SetHandleCount, SetLastError, SetPriorityClass, SetThreadContext, SetThreadLocale, SetThreadPriority, Sleep, SuspendThread, TerminateProcess, TerminateThread, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, VerLanguageNameA, VirtualAlloc, VirtualFree, VirtualProtect, WaitForDebugEvent, WideCharToMultiByte, WriteFile, WritePrivateProfileStringA, WriteProcessMemory, lstrcmpiW, lstrcpyA, lstrcpyW, lstrlenW
> ole32.dll: CoCreateInstance, CoInitialize, CoUninitialize
> shell32.dll: DragAcceptFiles, DragFinish, DragQueryFileA, ShellExecuteA
> user32.dll: AdjustWindowRect, AppendMenuA, BeginPaint, CallWindowProcA, CheckDlgButton, CheckMenuItem, CheckRadioButton, ClientToScreen, CloseClipboard, CreateCaret, CreateDialogParamA, CreateMDIWindowA, CreateMenu, CreatePopupMenu, CreateWindowExA, DefFrameProcA, DefMDIChildProcA, DefWindowProcA, DestroyCaret, DestroyMenu, DestroyWindow, DialogBoxParamA, DispatchMessageA, DrawMenuBar, EmptyClipboard, EnableMenuItem, EnableWindow, EndDialog, EndPaint, EnumChildWindows, EnumThreadWindows, EnumWindows, FillRect, FrameRect, GetCapture, GetClassInfoA, GetClassLongA, GetClassNameA, GetClientRect, GetClipboardData, GetCursorPos, GetDC, GetDesktopWindow, GetDialogBaseUnits, GetDlgCtrlID, GetDlgItem, GetDlgItemTextA, GetKeyState, GetMenu, GetMenuItemCount, GetMenuItemID, GetMenuStringA, GetParent, GetScrollPos, GetSubMenu, GetSysColor, GetSystemMetrics, GetWindow, GetWindowLongA, GetWindowPlacement, GetWindowRect, GetWindowTextA, GetWindowThreadProcessId, InsertMenuA, IntersectRect, InvalidateRect, IsDlgButtonChecked, IsIconic, IsWindow, IsZoomed, KillTimer, LoadBitmapA, LoadCursorA, LoadIconA, LoadImageA, MapDialogRect, MapVirtualKeyA, MessageBoxA, MoveWindow, OffsetRect, OpenClipboard, PeekMessageA, PostMessageA, PostQuitMessage, PostThreadMessageA, RedrawWindow, RegisterClassA, ReleaseCapture, ReleaseDC, RemoveMenu, ScreenToClient, SendDlgItemMessageA, SendMessageA, SetCapture, SetCaretPos, SetClipboardData, SetCursor, SetDlgItemTextA, SetFocus, SetForegroundWindow, SetScrollPos, SetScrollRange, SetTimer, SetWindowLongA, SetWindowPos, SetWindowTextA, ShowCaret, ShowScrollBar, ShowWindow, SystemParametersInfoA, TrackPopupMenu, TranslateMDISysAccel, TranslateMessage, UnregisterClassA, UpdateWindow, WinHelpA, WindowFromPoint, wsprintfA, wsprintfW
> version.dll: GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA

( 1 exports )

> _Addsorteddata, _Addtolist, _Analysecode, _Animate, _Assemble, _Attachtoactiveprocess, _Broadcast, _Browsefilename, _Calculatecrc, _Checkcondition, _Compress, _Createdumpwindow, _Createlistwindow, _Createpatchwindow, _Createprofilewindow, _Creatertracewindow, _Createsorteddata, _Createthreadwindow, _Createwatchwindow, _Createwinwindow, _Decodeaddress, _Decodeascii, _Decodecharacter, _Decodefullvarname, _Decodeknownargument, _Decodename, _Decoderange, _Decoderelativeoffset, _Decodethreadname, _Decodeunicode, _Decompress, _Defaultbar, _Deletebreakpoints, _Deletehardwarebreakbyaddr, _Deletehardwarebreakpoint, _Deletenamerange, _Deletenonconfirmedsorteddata, _Deleteruntrace, _Deletesorteddata, _Deletesorteddatarange, _Deletewatch, _Demanglename, _Destroysorteddata, _Disasm, _Disassembleback, _Disassembleforward, _Discardquicknames, _Dumpbackup, _Error, _Expression, _Findallcommands, _Findalldllcalls, _Findallsequences, _Finddecode, _Findfileoffset, _Findfixup, _Findhittrace, _Findimportbyname, _Findlabel, _Findlabelbyname, _Findmemory, _Findmodule, _Findname, _Findnextname, _Findnextproc, _Findnextruntraceip, _Findprevproc, _Findprevruntraceip, _Findprocbegin, _Findprocend, _Findreferences, _Findsorteddata, _Findsorteddataindex, _Findsorteddatarange, _Findstrings, _Findsymbolicname, _Findthread, _Findunknownfunction, _Flash, _Followcall, _Get3dnow, _Get3dnowxy, _Getaddressfromline, _Getasmfindmodel, _Getasmfindmodelxy, _Getbprelname, _Getbreakpointtype, _Getbreakpointtypecount, _Getcputhreadid, _Getdisassemblerrange, _Getfloat, _Getfloat10, _Getfloat10xy, _Getfloatxy, _Gethexstring, _Gethexstringxy, _Getline, _Getlinefromaddress, _Getlinexy, _Getlong, _Getlongxy, _Getmmx, _Getmmxxy, _Getnextbreakpoint, _Getoriginaldatasize, _Getproclimits, _Getregxy, _Getresourcestring, _Getruntraceprofile, _Getruntraceregisters, _Getsortedbyselection, _Getsourcefilelimits, _Getstatus, _Gettableselectionxy, _Gettext, _Gettextxy, _Getwatch, _Go, _Guardmemory, _Hardbreakpoints, _Havecopyofmemory, _Infoline, _Injectcode, _Insertname, _Insertwatch, _Isfilling, _Isprefix, _Isretaddr, _Issuspicious, _IstextA, _IstextW, _Listmemory, _Manualbreakpoint, _Mergequicknames, _Message, _Modifyhittrace, _Newtablewindow, _OpenEXEfile, _Painttable, _Plugingetvalue, _Pluginreadintfromini, _Pluginreadstringfromini, _Pluginsaverecord, _Pluginwriteinttoini, _Pluginwritestringtoini, _Print3dnow, _Printfloat10, _Printfloat4, _Printfloat8, _Printsse, _Progress, _Quickinsertname, _Quicktablewindow, _Readcommand, _Readmemory, _Redrawdisassembler, _Registerotclass, _Registerpluginclass, _Restoreallthreads, _Runsinglethread, _Runtracesize, _Scrollruntracewindow, _Selectandscroll, _Sendshortcut, _Setbreakpoint, _Setbreakpointext, _Setcpu, _Setdisasm, _Setdumptype, _Sethardwarebreakpoint, _Setmembreakpoint, _Settracecondition, _Settracecount, _Settracepauseoncommands, _Showsourcefromaddress, _Sortsorteddata, _Startruntrace, _Stringtotext, _Suspendprocess, _Tablefunction, _Tempbreakpoint, _Unregisterpluginclass, _Updatelist, _Walkreference, _Walkreferenceex, _Writememory, __GetExceptDLLinfo, ___CPPdebugHook
TrID  : File type identification
OllyDbg plugin (50.6%)
Win32 EXE PECompact compressed (generic) (27.4%)
DOS Executable Borland C++ (8.5%)
Win32 Executable Generic (5.6%)
Win32 Dynamic Link Library (generic) (5.0%)
ssdeep: 24576:1f5qaInraJ53lsDwpZrmYQdx7WhdmYnG0gv0EgOsU37w:KOT7mYG7WU8/Osk7
Prevx Info: http://info.prevx.com/aboutprogramtext.asp?PX5=6FD2D8F8006C008E16F81270098CBE004C1FBB1B
PEiD  : -
RDS   : NSRL Reference Data Set


[ 本帖最后由 mmc88888888 于 2009-10-30 16:55 编辑 ]
adad2008
头像被屏蔽
发表于 2009-10-30 16:20:37 | 显示全部楼层
最有可能是误报了 没有什么严重的
sam.to
发表于 2009-10-30 16:26:13 | 显示全部楼层
该文件下载人数过多,您暂不能下载该文件。请稍候再试。
sam.to
发表于 2009-10-30 17:32:05 | 显示全部楼层
to kl,ll
sam.to
发表于 2009-10-30 17:59:55 | 显示全部楼层
Hello,


Ollydbg.exe_, VistaDBG.exe_

No malicious code were found in these files.


to antivir as false alarm

25485251          VistaDBG.exe_          1.13 MB          UNDER ANALYSIS
25485252          Ollydbg.exe_          1.13 MB          UNDER ANALYSIS

[ 本帖最后由 sam.to 于 2009-10-30 18:01 编辑 ]
sam.to
发表于 2009-10-30 22:20:51 | 显示全部楼层
25485251          VistaDBG.exe_          1.13 MB          FALSE POSITIVE
25485252          Ollydbg.exe_          1.13 MB          FALSE POSITIVE
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2026-10-22 01:25 , Processed in 0.089291 second(s), 4 queries , Redis On.

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表