1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
Safety rating:60 |
Behavior list |
Basic Information | |
---|---|
MD5: | 0175e9861c20066d1c6d569a555ea4e1 |
file type: | EXE |
Production company: | |
version: | |
Shell or compiler information: |
Key behavior | |
---|---|
Behavior description: | 跨进程写入数据 |
details: | TargetProcess = %temp%\1445968704.325450.exe, WriteAddress = 0x7ffde008, Size = 4 |
TargetProcess = %temp%\1445968704.332352.exe, WriteAddress = 0x00400000, Size = 24576 | |
C:\WINDOWS\explorer.exe | |
Behavior description: | 创建远程线程 |
details: | C:\WINDOWS\explorer.exe |
Behavior description: | 设置线程上下文 |
details: | C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\1445968704.366708.exe |
Behavior description: | 设置启动项 |
details: | C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\ho9qv46wl.exe |
Behavior description: | 设置特殊文件属性 |
details: | C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\ho9qv46wl.exe |
Behavior description: | 写权限映射文件 |
details: | CiceroSharedMemDefaultS-* |
Behavior description: | 查找反病毒常用工具窗口 |
details: | NtUserFindWindowEx: [Class,Window] = [,Process Monitor - Sysinternals: www.sysinternals.com] |
NtUserFindWindowEx: [Class,Window] = [,File Monitor - Sysinternals: www.sysinternals.com] | |
NtUserFindWindowEx: [Class,Window] = [,Registry Monitor - Sysinternals: www.sysinternals.com] |
Process behavior | |
---|---|
Behavior description: | 跨进程写入数据 |
details: | TargetProcess = %temp%\1445968704.325450.exe, WriteAddress = 0x7ffde008, Size = 4 |
TargetProcess = %temp%\1445968704.332352.exe, WriteAddress = 0x00400000, Size = 24576 | |
C:\WINDOWS\explorer.exe | |
Behavior description: | 创建新文件进程 |
details: | ImagePath = C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\1445968704.321932.exe, CmdLine = "C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\1445968704.321932.exe" |
Behavior description: | 创建远程线程 |
details: | C:\WINDOWS\explorer.exe |
Behavior description: | 设置线程上下文 |
details: | C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\1445968704.366708.exe |
Behavior description: | 枚举进程 |
details: | N/A |
File behavior | |
---|---|
Behavior description: | 写权限映射文件 |
details: | CiceroSharedMemDefaultS-* |
Behavior description: | 设置特殊文件属性 |
details: | C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\ho9qv46wl.exe |
Behavior description: | 创建可执行文件 |
details: | C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\ho9qv46wl.exe |
Behavior description: | 查找文件 |
details: | FileName = C:\DOCUME~1 |
FileName = C:\DOCUME~1\ADMINI~1 | |
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1 | |
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp | |
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp% | |
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\1445968704.554438.exe | |
FileName = C:\Documents and Settings\Administrator\「开始」菜单\*.* | |
FileName = C:\Documents and Settings\Administrator\「开始」菜单\程序\*.* | |
FileName = C:\Documents and Settings\Administrator\「开始」菜单\程序\Microsoft Office\*.* | |
FileName = C:\Documents and Settings\Administrator\「开始」菜单\程序\Oracle VM VirtualBox Guest Additions\*.* | |
FileName = C:\Documents and Settings\Administrator\「开始」菜单\程序\WinRAR\*.* | |
FileName = C:\Documents and Settings\Administrator\「开始」菜单\程序\附件\*.* | |
FileName = C:\Documents and Settings\Administrator\「开始」菜单\程序\附件\辅助工具\*.* | |
FileName = C:\Documents and Settings\Administrator\「开始」菜单\程序\附件\系统工具\*.* | |
FileName = C:\Documents and Settings\Administrator\「开始」菜单\程序\附件\娱乐\*.* | |
Behavior description: | 设置启动项 |
details: | C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\ho9qv46wl.exe |
Registry behavior | |
---|---|
Behavior description: | 修改注册表 |
details: | \REGISTRY\USER\S-*\SessionInformation\ProgramCount |
Other behavior | |
---|---|
Behavior description: | 创建互斥体 |
details: | CTF.LBES.MutexDefaultS-* |
CTF.Compart.MutexDefaultS-* | |
CTF.Asm.MutexDefaultS-* | |
CTF.Layouts.MutexDefaultS-* | |
CTF.TMD.MutexDefaultS-* | |
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-* | |
eudhgdkchwsc | |
Behavior description: | 查找指定窗口 |
details: | NtUserFindWindowEx: [Class,Window] = [,The Wireshark Network Analyzer] |
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,] | |
NtUserFindWindowEx: [Class,Window] = [OleMainThreadWndClass,] | |
Behavior description: | 获取TickCount值 |
details: | TickCount = 486797, SleepMilliseconds = 938. |
TickCount = 486259, SleepMilliseconds = 197. | |
TickCount = 486393, SleepMilliseconds = 159. | |
TickCount = 486630, SleepMilliseconds = 193. | |
TickCount = 486805, SleepMilliseconds = 180. | |
TickCount = 486839, SleepMilliseconds = 105. | |
TickCount = 487126, SleepMilliseconds = 189. | |
TickCount = 487204, SleepMilliseconds = 126. | |
TickCount = 487388, SleepMilliseconds = 154. | |
TickCount = 487625, SleepMilliseconds = 188. | |
TickCount = 487800, SleepMilliseconds = 175. | |
TickCount = 487834, SleepMilliseconds = 100. | |
TickCount = 488105, SleepMilliseconds = 184. | |
TickCount = 488136, SleepMilliseconds = 105. | |
TickCount = 488404, SleepMilliseconds = 186. | |
Behavior description: | 枚举窗口 |
details: | N/A |
Behavior description: | 调用Sleep函数 |
details: | [1]: MilliSeconds = 938. |
Behavior description: | 查找反病毒常用工具窗口 |
details: | NtUserFindWindowEx: [Class,Window] = [,Process Monitor - Sysinternals: www.sysinternals.com] |
NtUserFindWindowEx: [Class,Window] = [,File Monitor - Sysinternals: www.sysinternals.com] | |
NtUserFindWindowEx: [Class,Window] = [,Registry Monitor - Sysinternals: www.sysinternals.com] |
Abnormal crash | |
---|---|
Behavior description: | 创建互斥体 |
details: | CTF.LBES.MutexDefaultS-* |
CTF.Compart.MutexDefaultS-* | |
CTF.Asm.MutexDefaultS-* | |
CTF.Layouts.MutexDefaultS-* | |
CTF.TMD.MutexDefaultS-* | |
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-* | |
eudhgdkchwsc | |
Behavior description: | 查找指定窗口 |
details: | NtUserFindWindowEx: [Class,Window] = [,The Wireshark Network Analyzer] |
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,] | |
NtUserFindWindowEx: [Class,Window] = [OleMainThreadWndClass,] | |
Behavior description: | 获取TickCount值 |
details: | TickCount = 486797, SleepMilliseconds = 938. |
TickCount = 486259, SleepMilliseconds = 197. | |
TickCount = 486393, SleepMilliseconds = 159. | |
TickCount = 486630, SleepMilliseconds = 193. | |
TickCount = 486805, SleepMilliseconds = 180. | |
TickCount = 486839, SleepMilliseconds = 105. | |
TickCount = 487126, SleepMilliseconds = 189. | |
TickCount = 487204, SleepMilliseconds = 126. | |
TickCount = 487388, SleepMilliseconds = 154. | |
TickCount = 487625, SleepMilliseconds = 188. | |
TickCount = 487800, SleepMilliseconds = 175. | |
TickCount = 487834, SleepMilliseconds = 100. | |
TickCount = 488105, SleepMilliseconds = 184. | |
TickCount = 488136, SleepMilliseconds = 105. | |
TickCount = 488404, SleepMilliseconds = 186. | |
Behavior description: | 枚举窗口 |
details: | N/A |
Behavior description: | 调用Sleep函数 |
details: | [1]: MilliSeconds = 938. |
Behavior description: | 查找反病毒常用工具窗口 |
details: | NtUserFindWindowEx: [Class,Window] = [,Process Monitor - Sysinternals: www.sysinternals.com] |
NtUserFindWindowEx: [Class,Window] = [,File Monitor - Sysinternals: www.sysinternals.com] | |
NtUserFindWindowEx: [Class,Window] = [,Registry Monitor - Sysinternals: www.sysinternals.com] |
Run screenshot |
---|
![]() |