1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
Language
Server load
1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
| Safety rating:70 |
| Behavior list |
| Basic Information | |
|---|---|
| MD5: | 266493b8b5f615be53975e6749e9973d |
| file type: | Rar |
| Production company: | |
| version: | |
| Shell or compiler information: | PACKER:UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo |
| Subfile information: | 最新报价表.com / big file / EXE |
| upx_c_f4b26934dumpFile / big file / zip | |
| Key behavior | |
|---|---|
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-* |
| \WINDOWS\system32\zh-cn\ieframe.dll.mui | |
| MSCTF.MarshalInterface.FileMap.IOK..FNFJH | |
| MSCTF.MarshalInterface.FileMap.IOK.B.FNFJH | |
| MSCTF.MarshalInterface.FileMap.IOK.C.FNFJH | |
| MSCTF.MarshalInterface.FileMap.IOK.D.FNFJH | |
| MSCTF.MarshalInterface.FileMap.IOK.E.FOFJH | |
| MSCTF.MarshalInterface.FileMap.IOK.F.FOFJH | |
| MSCTF.MarshalInterface.FileMap.IOK.G.FOFJH | |
| MSCTF.Shared.SFM.IOK | |
| MSCTF.MarshalInterface.FileMap.IOK.H.KHJLH | |
| MSCTF.MarshalInterface.FileMap.IOK.I.KHJLH | |
| MSCTF.MarshalInterface.FileMap.IOK.J.KHJLH | |
| MSCTF.MarshalInterface.FileMap.IOK.K.KIJLH | |
| MSCTF.MarshalInterface.FileMap.IOK.L.KIJLH | |
| Behavior description: | 创建远程线程 |
| details: | C:\Program Files\Tencent\QQ\Bin\QQ.exe |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,ComboLBox] |
| [Window,Class] = [,ListBox] | |
| [Window,Class] = [,Afx:400000:8:10011:1900015:0] | |
| [Window,Class] = [,Shell Embedding] | |
| [Window,Class] = [错误报告,WTWindow] | |
| Behavior description: | 跨进程写入数据 |
| details: | C:\Program Files\Tencent\QQ\Bin\QQ.exe |
| Process behavior | |
|---|---|
| Behavior description: | 跨进程写入数据 |
| details: | C:\Program Files\Tencent\QQ\Bin\QQ.exe |
| Behavior description: | 创建新文件进程 |
| details: | ImagePath = C:\Program Files\ico.exe, CmdLine = "C:\Program Files\ico.exe" |
| Behavior description: | 创建远程线程 |
| details: | C:\Program Files\Tencent\QQ\Bin\QQ.exe |
| Behavior description: | 枚举进程 |
| details: | N/A |
| File behavior | |
|---|---|
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-* |
| \WINDOWS\system32\zh-cn\ieframe.dll.mui | |
| MSCTF.MarshalInterface.FileMap.IOK..FNFJH | |
| MSCTF.MarshalInterface.FileMap.IOK.B.FNFJH | |
| MSCTF.MarshalInterface.FileMap.IOK.C.FNFJH | |
| MSCTF.MarshalInterface.FileMap.IOK.D.FNFJH | |
| MSCTF.MarshalInterface.FileMap.IOK.E.FOFJH | |
| MSCTF.MarshalInterface.FileMap.IOK.F.FOFJH | |
| MSCTF.MarshalInterface.FileMap.IOK.G.FOFJH | |
| MSCTF.Shared.SFM.IOK | |
| MSCTF.MarshalInterface.FileMap.IOK.H.KHJLH | |
| MSCTF.MarshalInterface.FileMap.IOK.I.KHJLH | |
| MSCTF.MarshalInterface.FileMap.IOK.J.KHJLH | |
| MSCTF.MarshalInterface.FileMap.IOK.K.KIJLH | |
| MSCTF.MarshalInterface.FileMap.IOK.L.KIJLH | |
| Behavior description: | 创建可执行文件 |
| details: | C:\Program Files\ico.exe |
| Behavior description: | 修改文件内容 |
| details: | C:\Program Files\Tencent\QQ\I18N\2052\StringBundle.xml---> Offset = 0 |
| Behavior description: | 查找文件 |
| details: | FileName = C:\Program Files\ico.exe |
| Other behavior | |
|---|---|
| Behavior description: | 创建互斥体 |
| details: | CTF.LBES.MutexDefaultS-* |
| CTF.Compart.MutexDefaultS-* | |
| CTF.Asm.MutexDefaultS-* | |
| CTF.Layouts.MutexDefaultS-* | |
| CTF.TMD.MutexDefaultS-* | |
| CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-* | |
| MSCTF.Shared.MUTEX.ELH | |
| MSCTF.Shared.MUTEX.IOK | |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,ComboLBox] |
| [Window,Class] = [,ListBox] | |
| [Window,Class] = [,Afx:400000:8:10011:1900015:0] | |
| [Window,Class] = [,Shell Embedding] | |
| [Window,Class] = [错误报告,WTWindow] | |
| Behavior description: | 查找指定窗口 |
| details: | NtUserFindWindowEx: [Class,Window] = [,.exe] |
| NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,] | |
| NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,] | |
| Behavior description: | 窗口信息 |
| details: | Pid = 2788, Hwnd=0x10336, Text = 标签, ClassName = Afx:400000:b:10011:1900015:0. |
| Pid = 2788, Hwnd=0x10334, Text = 标签, ClassName = Afx:400000:b:10011:1900015:0. | |
| Pid = 2788, Hwnd=0x1031c, Text = 确定(O), ClassName = Button. | |
| Pid = 2788, Hwnd=0x10318, Text = 发送错误报告(S), ClassName = Button(CheckBox). | |
| Pid = 2788, Hwnd=0x10316, Text = 这个问题是如何出现的？, ClassName = Edit. | |
| Pid = 2788, Hwnd=0x10314, Text = 停封, ClassName = Button(GroupBox). | |
| Pid = 2788, Hwnd=0x10310, Text = 我要自己设置, ClassName = ComboBox. | |
| Pid = 2788, Hwnd=0x1030e, Text = QQ存在风险,请<TITLE="修改密码", URL="https://aq.qq.com/cn2/login?url=https%3A%2F%2Faq.qq.com%2Fcn2%2Fchange_psw%2Fchange_psw_in, ClassName = Edit. | |
| Pid = 2788, Hwnd=0x1030c, Text = C:\Program Files\Tencent\QQ, ClassName = Edit. | |
| Pid = 2788, Hwnd=0x102f6, Text = 更换, ClassName = Button. | |
| Pid = 2788, Hwnd=0x602f4, Text = 错误报告, ClassName = WTWindow. | |
| Run screenshot |
|---|
 |
HOME
