1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
Safety rating:72 |
Behavior list |
Basic Information | |
---|---|
MD5: | 98d95fe6d0b70e846c145cb0bdd478a7 |
file type: | EXE |
Production company: | CF冰心 |
version: | 1.0.4.11---1.0.4.11 |
Shell or compiler information: | |
Subfile information: | upx30_1d6ef770dumpFile / 9d3957d72e96774d7b9924392d8cc931 / EXE |
Key behavior | |
---|---|
Behavior description: | 写权限映射文件 |
details: | CiceroSharedMemDefaultS-* |
\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT | |
MSCTF.MarshalInterface.FileMap.EBE..INPGH | |
MSCTF.MarshalInterface.FileMap.EBE.B.GPPGH | |
MSCTF.MarshalInterface.FileMap.EBE.C.GPPGH | |
MSCTF.MarshalInterface.FileMap.EBE.D.GPPGH | |
MSCTF.MarshalInterface.FileMap.EBE.E.EAAHH | |
MSCTF.MarshalInterface.FileMap.EBE.F.DBAHH | |
MSCTF.MarshalInterface.FileMap.EBE.G.CCAHH | |
MSCTF.Shared.SFM.EBE | |
MSCTF.MarshalInterface.FileMap.EBE.H.GICLH | |
MSCTF.MarshalInterface.FileMap.EBE.I.GICLH | |
MSCTF.MarshalInterface.FileMap.EBE.J.GICLH | |
MSCTF.MarshalInterface.FileMap.EBE.K.GICLH | |
MSCTF.MarshalInterface.FileMap.EBE.L.GICLH | |
Behavior description: | 隐藏指定窗口 |
details: | [Window,Class] = [,_EL_ClientSock] |
[Window,Class] = [,_EL_Timer] |
Process behavior | |
---|---|
Behavior description: | 枚举进程 |
details: | N/A |
File behavior | |
---|---|
Behavior description: | 写权限映射文件 |
details: | CiceroSharedMemDefaultS-* |
\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT | |
MSCTF.MarshalInterface.FileMap.EBE..INPGH | |
MSCTF.MarshalInterface.FileMap.EBE.B.GPPGH | |
MSCTF.MarshalInterface.FileMap.EBE.C.GPPGH | |
MSCTF.MarshalInterface.FileMap.EBE.D.GPPGH | |
MSCTF.MarshalInterface.FileMap.EBE.E.EAAHH | |
MSCTF.MarshalInterface.FileMap.EBE.F.DBAHH | |
MSCTF.MarshalInterface.FileMap.EBE.G.CCAHH | |
MSCTF.Shared.SFM.EBE | |
MSCTF.MarshalInterface.FileMap.EBE.H.GICLH | |
MSCTF.MarshalInterface.FileMap.EBE.I.GICLH | |
MSCTF.MarshalInterface.FileMap.EBE.J.GICLH | |
MSCTF.MarshalInterface.FileMap.EBE.K.GICLH | |
MSCTF.MarshalInterface.FileMap.EBE.L.GICLH | |
Behavior description: | 修改文件内容 |
details: | C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT---> Offset = 0 |
Network behavior | |
---|---|
Behavior description: | 建立到一个指定的套接字连接 |
details: | 117.21.225.209:2360 |
Other behavior | |
---|---|
Behavior description: | 查找指定窗口 |
details: | NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,] |
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,] | |
Behavior description: | 窗口信息 |
details: | Pid = 1048, Hwnd=0x202b4, Text = CF冰心官服收费辅助, ClassName = DELE_exui_Client. |
Behavior description: | 隐藏指定窗口 |
details: | [Window,Class] = [,_EL_ClientSock] |
[Window,Class] = [,_EL_Timer] | |
Behavior description: | 创建互斥体 |
details: | CTF.LBES.MutexDefaultS-* |
CTF.Compart.MutexDefaultS-* | |
CTF.Asm.MutexDefaultS-* | |
CTF.Layouts.MutexDefaultS-* | |
CTF.TMD.MutexDefaultS-* | |
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-* | |
MSCTF.Shared.MUTEX.ELH | |
MSCTF.Shared.MUTEX.EBE | |
Behavior description: | 获取TickCount值 |
details: | TickCount = 487384, SleepMilliseconds = 9. |
TickCount = 487414, SleepMilliseconds = 8. | |
TickCount = 487428, SleepMilliseconds = 7. | |
TickCount = 487443, SleepMilliseconds = 6. | |
TickCount = 487458, SleepMilliseconds = 5. | |
TickCount = 496969, SleepMilliseconds = 1. | |
TickCount = 496985, SleepMilliseconds = 1. | |
TickCount = 498110, SleepMilliseconds = 1. | |
TickCount = 498126, SleepMilliseconds = 1. | |
TickCount = 504454, SleepMilliseconds = 1. | |
TickCount = 504469, SleepMilliseconds = 1. | |
TickCount = 504547, SleepMilliseconds = 1. | |
TickCount = 504563, SleepMilliseconds = 1. |
Run screenshot |
---|
![]() |