VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.

Language
Server load
Server Load

File information
Safety rating:45
Behavior list
Basic Information
MD5:4a4b6affc03e5de30d14252aba25c727
file type:EXE
Production company:傅明浪(唯唯)
version:1.3.0.0---1.3.0.0
Shell or compiler information:COMPILER:Elan
Key behavior
Behavior description:隐藏指定窗口
details:[Window,Class] = [,_EL_Timer]
[Window,Class] = [,_EL_CommonDlg]
Behavior description:设置消息钩子
details:C:\WINDOWS\system32\dinput.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\1445157510.381422.exe
Behavior description:修改注册表_任务管理器关键属性
details:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
Behavior description:常规加载驱动
details:\??\C:\WINDOWS\system32\drivers\NAWNRWBE.sys
\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\28909. dll
Behavior description:写权限映射文件
details:CiceroSharedMemDefaultS-*
VIDEOMEMORY
AtlDebugAllocator_FileMappingNameStatic3_5c4
MSCTF.MarshalInterface.FileMap.ABK..KFIHH
MSCTF.MarshalInterface.FileMap.ABK.B.KFIHH
MSCTF.MarshalInterface.FileMap.ABK.C.KGIHH
MSCTF.MarshalInterface.FileMap.ABK.D.KGIHH
MSCTF.MarshalInterface.FileMap.ABK.E.KGIHH
MSCTF.MarshalInterface.FileMap.ABK.F.IKIHH
MSCTF.MarshalInterface.FileMap.AMK..KPKHH
MSCTF.MarshalInterface.FileMap.AMK.B.KPKHH
MSCTF.MarshalInterface.FileMap.AMK.C.KPKHH
MSCTF.MarshalInterface.FileMap.AMK.D.KPKHH
MSCTF.MarshalInterface.FileMap.AMK.E.KPKHH
MSCTF.MarshalInterface.FileMap.AMK.F.KPKHH
Behavior description:修改注册表_启动项
details:\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\%temp%\1445157510.711100.exe
Behavior description:修改注册表_禁用注册表编辑器项
details:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools
Behavior description:创建系统服务
details:[服务创建成功]: NAWNRWBE, C:\WINDOWS\system32\drivers\NAWNRWBE.sys
[服务创建成功]: hideprocess, C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\\28909. dll
Behavior description:查找文件方式探测虚拟机
details:FindFirstFileEx: FileName = C:\Program Files\VMware\VMware Tools\VMControlPanel.cpl
Process behavior
Behavior description:隐藏窗口创建进程
details:ImagePath = , CmdLine = reg delete hklm\system\currentcontrolset\control\safeboot\ /va /f
ImagePath = , CmdLine = rasphone -h
Behavior description:创建进程
details:ImagePath = C:\WINDOWS\system32\REG.exe, CmdLine = REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\ /va /f
ImagePath = C:\WINDOWS\system32\rasphone.exe, CmdLine = rasphone -h
Behavior description:枚举进程
details:N/A
File behavior
Behavior description:写权限映射文件
details:CiceroSharedMemDefaultS-*
VIDEOMEMORY
AtlDebugAllocator_FileMappingNameStatic3_5c4
MSCTF.MarshalInterface.FileMap.ABK..KFIHH
MSCTF.MarshalInterface.FileMap.ABK.B.KFIHH
MSCTF.MarshalInterface.FileMap.ABK.C.KGIHH
MSCTF.MarshalInterface.FileMap.ABK.D.KGIHH
MSCTF.MarshalInterface.FileMap.ABK.E.KGIHH
MSCTF.MarshalInterface.FileMap.ABK.F.IKIHH
MSCTF.MarshalInterface.FileMap.AMK..KPKHH
MSCTF.MarshalInterface.FileMap.AMK.B.KPKHH
MSCTF.MarshalInterface.FileMap.AMK.C.KPKHH
MSCTF.MarshalInterface.FileMap.AMK.D.KPKHH
MSCTF.MarshalInterface.FileMap.AMK.E.KPKHH
MSCTF.MarshalInterface.FileMap.AMK.F.KPKHH
Behavior description:创建可执行文件
details:C:\WINDOWS\system32\drivers\NAWNRWBE.sys
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\28909. dll
Behavior description:查找文件
details:FileName = C:\WINDOWS
FileName = C:\WINDOWS\system32
FileName = C:\WINDOWS\system32\REG.exe
FileName = C:\WINDOWS\system32\reg.exe
FileName = C:\WINDOWS\system32\*.CPL
FileName = Firewall.cpl
FileName = NetSetup.cpl
FileName = C:\Program Files\Common Files\Microsoft Shared\Speech\sapi.cpl
FileName = C:\WINDOWS\system32\bthprops.cpl
FileName = C:\WINDOWS\system32\firewall.cpl
FileName = C:\WINDOWS\system32\irprops.cpl
FileName = C:\WINDOWS\system32\netsetup.cpl
FileName = C:\WINDOWS\system32\nwc.cpl
FileName = C:\WINDOWS\system32\wuaucpl.cpl
FileName = C:\WINDOWS\system32\NETSHELL.dll
Registry behavior
Behavior description:修改注册表_服务项
details:\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\NAWNRWBE\ImagePath
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\NAWNRWBE\Start
Behavior description:修改注册表_任务管理器关键属性
details:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
Behavior description:删除注册表键值_安全模式启动项
details:\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\AlternateShell
Behavior description:修改注册表
details:\REGISTRY\MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name
\REGISTRY\MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\ID
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\NAWNRWBE\DisplayName
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\NAWNRWBE\ErrorControl
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\NAWNRWBE\Type
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\NAWNRWBE\Security\Security
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASPHONE\EnableFileTracing
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASPHONE\EnableConsoleTracing
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASPHONE\FileTracingMask
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASPHONE\ConsoleTracingMask
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASPHONE\MaxFileSize
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASPHONE\FileDirectory
Behavior description:修改注册表_禁用注册表编辑器项
details:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools
Behavior description:修改注册表_启动项
details:\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\%temp%\1445157510.711100.exe
Other behavior
Behavior description:创建互斥体
details:RasPbFile
CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
DDrawWindowListMutex
DDrawDriverObjectListMutex
__DDrawExclMode__
__DDrawCheckExclMode__
DirectSound DllMain mutex (0x000005C4)
AMResourceMutex2
VideoRenderer
SHIMLIB_LOG_MUTEX
Behavior description:隐藏指定窗口
details:[Window,Class] = [,_EL_Timer]
[Window,Class] = [,_EL_CommonDlg]
Behavior description:设置消息钩子
details:C:\WINDOWS\system32\dinput.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\1445157510.381422.exe
Behavior description:常规加载驱动
details:\??\C:\WINDOWS\system32\drivers\NAWNRWBE.sys
\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\28909. dll
Behavior description:查找指定窗口
details:NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
Behavior description:启动系统服务
details:[服务启动成功]: , NAWNRWBE, \??\C:\WINDOWS\system32\drivers\NAWNRWBE.sys
[服务启动成功]: , hideprocess, \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\28909. dll
Behavior description:获取系统权限
details:SE_DEBUG_PRIVILEGE
Behavior description:获取TickCount值
details:TickCount = 548250, SleepMilliseconds = 60000.
TickCount = 548265, SleepMilliseconds = 60000.
TickCount = 548281, SleepMilliseconds = 60000.
TickCount = 548296, SleepMilliseconds = 60000.
TickCount = 548328, SleepMilliseconds = 60000.
TickCount = 548500, SleepMilliseconds = 60000.
TickCount = 548515, SleepMilliseconds = 60000.
TickCount = 548546, SleepMilliseconds = 60000.
TickCount = 548562, SleepMilliseconds = 60000.
TickCount = 548593, SleepMilliseconds = 60000.
TickCount = 548609, SleepMilliseconds = 60000.
TickCount = 548625, SleepMilliseconds = 60000.
TickCount = 548640, SleepMilliseconds = 60000.
TickCount = 548703, SleepMilliseconds = 60000.
TickCount = 548718, SleepMilliseconds = 60000.
Behavior description:窗口信息
details:Pid = 2572, Hwnd=0x202c2, Text = 确定, ClassName = Button.
Pid = 2572, Hwnd=0x202c8, Text = rasphone [-f 文件] [[-e | -d | -h | -r] 项目] rasphone [-f 文件] -a [项目] rasphone [-f 文件] -lx 链接 rasphone -a 弹出新建, ClassName = Static.
Pid = 2572, Hwnd=0x202d6, Text = 拨号网络命令行, ClassName = #32770.
Pid = 2748, Hwnd=0x302c8, Text = 确定, ClassName = Button.
Pid = 2748, Hwnd=0x302c2, Text = rasphone [-f 文件] [[-e | -d | -h | -r] 项目] rasphone [-f 文件] -a [项目] rasphone [-f 文件] -lx 链接 rasphone -a 弹出新建, ClassName = Static.
Pid = 2748, Hwnd=0x302c6, Text = 拨号网络命令行, ClassName = #32770.
Behavior description:调用Sleep函数
details:[1]: MilliSeconds = 60000.
[2]: MilliSeconds = 60000.
[3]: MilliSeconds = 60000.
Behavior description:创建系统服务
details:[服务创建成功]: NAWNRWBE, C:\WINDOWS\system32\drivers\NAWNRWBE.sys
[服务创建成功]: hideprocess, C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\\28909. dll
Behavior description:查找文件方式探测虚拟机
details:FindFirstFileEx: FileName = C:\Program Files\VMware\VMware Tools\VMControlPanel.cpl
Run screenshot
VirSCAN

About VirSCAN | Privacy Policy | Contact us | Links | Help VirSCAN
Translated by Keith Miller, United States
Powered By CentOSpol

京ICP备11007605号-12

pol

京公网安备 11010802020746号