1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
Language
Server load
1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
| Safety rating:45 |
| Behavior list |
| Basic Information | |
|---|---|
| MD5: | 4a4b6affc03e5de30d14252aba25c727 |
| file type: | EXE |
| Production company: | 傅明浪(唯唯) |
| version: | 1.3.0.0---1.3.0.0 |
| Shell or compiler information: | COMPILER:Elan |
| Key behavior | |
|---|---|
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,_EL_Timer] |
| [Window,Class] = [,_EL_CommonDlg] | |
| Behavior description: | 设置消息钩子 |
| details: | C:\WINDOWS\system32\dinput.dll |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\1445157510.381422.exe | |
| Behavior description: | 修改注册表_任务管理器关键属性 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr |
| Behavior description: | 常规加载驱动 |
| details: | \??\C:\WINDOWS\system32\drivers\NAWNRWBE.sys |
| \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\28909. dll | |
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-* |
| VIDEOMEMORY | |
| AtlDebugAllocator_FileMappingNameStatic3_5c4 | |
| MSCTF.MarshalInterface.FileMap.ABK..KFIHH | |
| MSCTF.MarshalInterface.FileMap.ABK.B.KFIHH | |
| MSCTF.MarshalInterface.FileMap.ABK.C.KGIHH | |
| MSCTF.MarshalInterface.FileMap.ABK.D.KGIHH | |
| MSCTF.MarshalInterface.FileMap.ABK.E.KGIHH | |
| MSCTF.MarshalInterface.FileMap.ABK.F.IKIHH | |
| MSCTF.MarshalInterface.FileMap.AMK..KPKHH | |
| MSCTF.MarshalInterface.FileMap.AMK.B.KPKHH | |
| MSCTF.MarshalInterface.FileMap.AMK.C.KPKHH | |
| MSCTF.MarshalInterface.FileMap.AMK.D.KPKHH | |
| MSCTF.MarshalInterface.FileMap.AMK.E.KPKHH | |
| MSCTF.MarshalInterface.FileMap.AMK.F.KPKHH | |
| Behavior description: | 修改注册表_启动项 |
| details: | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\%temp%\1445157510.711100.exe |
| Behavior description: | 修改注册表_禁用注册表编辑器项 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools |
| Behavior description: | 创建系统服务 |
| details: | [服务创建成功]: NAWNRWBE, C:\WINDOWS\system32\drivers\NAWNRWBE.sys |
| [服务创建成功]: hideprocess, C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\\28909. dll | |
| Behavior description: | 查找文件方式探测虚拟机 |
| details: | FindFirstFileEx: FileName = C:\Program Files\VMware\VMware Tools\VMControlPanel.cpl |
| Process behavior | |
|---|---|
| Behavior description: | 隐藏窗口创建进程 |
| details: | ImagePath = , CmdLine = reg delete hklm\system\currentcontrolset\control\safeboot\ /va /f |
| ImagePath = , CmdLine = rasphone -h | |
| Behavior description: | 创建进程 |
| details: | ImagePath = C:\WINDOWS\system32\REG.exe, CmdLine = REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\ /va /f |
| ImagePath = C:\WINDOWS\system32\rasphone.exe, CmdLine = rasphone -h | |
| Behavior description: | 枚举进程 |
| details: | N/A |
| File behavior | |
|---|---|
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-* |
| VIDEOMEMORY | |
| AtlDebugAllocator_FileMappingNameStatic3_5c4 | |
| MSCTF.MarshalInterface.FileMap.ABK..KFIHH | |
| MSCTF.MarshalInterface.FileMap.ABK.B.KFIHH | |
| MSCTF.MarshalInterface.FileMap.ABK.C.KGIHH | |
| MSCTF.MarshalInterface.FileMap.ABK.D.KGIHH | |
| MSCTF.MarshalInterface.FileMap.ABK.E.KGIHH | |
| MSCTF.MarshalInterface.FileMap.ABK.F.IKIHH | |
| MSCTF.MarshalInterface.FileMap.AMK..KPKHH | |
| MSCTF.MarshalInterface.FileMap.AMK.B.KPKHH | |
| MSCTF.MarshalInterface.FileMap.AMK.C.KPKHH | |
| MSCTF.MarshalInterface.FileMap.AMK.D.KPKHH | |
| MSCTF.MarshalInterface.FileMap.AMK.E.KPKHH | |
| MSCTF.MarshalInterface.FileMap.AMK.F.KPKHH | |
| Behavior description: | 创建可执行文件 |
| details: | C:\WINDOWS\system32\drivers\NAWNRWBE.sys |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\28909. dll | |
| Behavior description: | 查找文件 |
| details: | FileName = C:\WINDOWS |
| FileName = C:\WINDOWS\system32 | |
| FileName = C:\WINDOWS\system32\REG.exe | |
| FileName = C:\WINDOWS\system32\reg.exe | |
| FileName = C:\WINDOWS\system32\*.CPL | |
| FileName = Firewall.cpl | |
| FileName = NetSetup.cpl | |
| FileName = C:\Program Files\Common Files\Microsoft Shared\Speech\sapi.cpl | |
| FileName = C:\WINDOWS\system32\bthprops.cpl | |
| FileName = C:\WINDOWS\system32\firewall.cpl | |
| FileName = C:\WINDOWS\system32\irprops.cpl | |
| FileName = C:\WINDOWS\system32\netsetup.cpl | |
| FileName = C:\WINDOWS\system32\nwc.cpl | |
| FileName = C:\WINDOWS\system32\wuaucpl.cpl | |
| FileName = C:\WINDOWS\system32\NETSHELL.dll | |
| Registry behavior | |
|---|---|
| Behavior description: | 修改注册表_服务项 |
| details: | \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\NAWNRWBE\ImagePath |
| \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\NAWNRWBE\Start | |
| Behavior description: | 修改注册表_任务管理器关键属性 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr |
| Behavior description: | 删除注册表键值_安全模式启动项 |
| details: | \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\AlternateShell |
| Behavior description: | 修改注册表 |
| details: | \REGISTRY\MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\ID | |
| \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\NAWNRWBE\DisplayName | |
| \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\NAWNRWBE\ErrorControl | |
| \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\NAWNRWBE\Type | |
| \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\NAWNRWBE\Security\Security | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASPHONE\EnableFileTracing | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASPHONE\EnableConsoleTracing | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASPHONE\FileTracingMask | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASPHONE\ConsoleTracingMask | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASPHONE\MaxFileSize | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASPHONE\FileDirectory | |
| Behavior description: | 修改注册表_禁用注册表编辑器项 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools |
| Behavior description: | 修改注册表_启动项 |
| details: | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\%temp%\1445157510.711100.exe |
| Other behavior | |
|---|---|
| Behavior description: | 创建互斥体 |
| details: | RasPbFile |
| CTF.LBES.MutexDefaultS-* | |
| CTF.Compart.MutexDefaultS-* | |
| CTF.Asm.MutexDefaultS-* | |
| CTF.Layouts.MutexDefaultS-* | |
| CTF.TMD.MutexDefaultS-* | |
| CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-* | |
| DDrawWindowListMutex | |
| DDrawDriverObjectListMutex | |
| __DDrawExclMode__ | |
| __DDrawCheckExclMode__ | |
| DirectSound DllMain mutex (0x000005C4) | |
| AMResourceMutex2 | |
| VideoRenderer | |
| SHIMLIB_LOG_MUTEX | |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,_EL_Timer] |
| [Window,Class] = [,_EL_CommonDlg] | |
| Behavior description: | 设置消息钩子 |
| details: | C:\WINDOWS\system32\dinput.dll |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\1445157510.381422.exe | |
| Behavior description: | 常规加载驱动 |
| details: | \??\C:\WINDOWS\system32\drivers\NAWNRWBE.sys |
| \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\28909. dll | |
| Behavior description: | 查找指定窗口 |
| details: | NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,] |
| Behavior description: | 启动系统服务 |
| details: | [服务启动成功]: , NAWNRWBE, \??\C:\WINDOWS\system32\drivers\NAWNRWBE.sys |
| [服务启动成功]: , hideprocess, \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\28909. dll | |
| Behavior description: | 获取系统权限 |
| details: | SE_DEBUG_PRIVILEGE |
| Behavior description: | 获取TickCount值 |
| details: | TickCount = 548250, SleepMilliseconds = 60000. |
| TickCount = 548265, SleepMilliseconds = 60000. | |
| TickCount = 548281, SleepMilliseconds = 60000. | |
| TickCount = 548296, SleepMilliseconds = 60000. | |
| TickCount = 548328, SleepMilliseconds = 60000. | |
| TickCount = 548500, SleepMilliseconds = 60000. | |
| TickCount = 548515, SleepMilliseconds = 60000. | |
| TickCount = 548546, SleepMilliseconds = 60000. | |
| TickCount = 548562, SleepMilliseconds = 60000. | |
| TickCount = 548593, SleepMilliseconds = 60000. | |
| TickCount = 548609, SleepMilliseconds = 60000. | |
| TickCount = 548625, SleepMilliseconds = 60000. | |
| TickCount = 548640, SleepMilliseconds = 60000. | |
| TickCount = 548703, SleepMilliseconds = 60000. | |
| TickCount = 548718, SleepMilliseconds = 60000. | |
| Behavior description: | 窗口信息 |
| details: | Pid = 2572, Hwnd=0x202c2, Text = 确定, ClassName = Button. |
| Pid = 2572, Hwnd=0x202c8, Text = rasphone [-f 文件] [[-e | -d | -h | -r] 项目] rasphone [-f 文件] -a [项目] rasphone [-f 文件] -lx 链接 rasphone -a 弹出新建, ClassName = Static. | |
| Pid = 2572, Hwnd=0x202d6, Text = 拨号网络命令行, ClassName = #32770. | |
| Pid = 2748, Hwnd=0x302c8, Text = 确定, ClassName = Button. | |
| Pid = 2748, Hwnd=0x302c2, Text = rasphone [-f 文件] [[-e | -d | -h | -r] 项目] rasphone [-f 文件] -a [项目] rasphone [-f 文件] -lx 链接 rasphone -a 弹出新建, ClassName = Static. | |
| Pid = 2748, Hwnd=0x302c6, Text = 拨号网络命令行, ClassName = #32770. | |
| Behavior description: | 调用Sleep函数 |
| details: | [1]: MilliSeconds = 60000. |
| [2]: MilliSeconds = 60000. | |
| [3]: MilliSeconds = 60000. | |
| Behavior description: | 创建系统服务 |
| details: | [服务创建成功]: NAWNRWBE, C:\WINDOWS\system32\drivers\NAWNRWBE.sys |
| [服务创建成功]: hideprocess, C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\\28909. dll | |
| Behavior description: | 查找文件方式探测虚拟机 |
| details: | FindFirstFileEx: FileName = C:\Program Files\VMware\VMware Tools\VMControlPanel.cpl |
| Run screenshot |
|---|
 |
HOME
