VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.

Language
Server load
Server Load

File information
Safety rating:35
behaviorlist
Basic Information
MD5:b0c164ba114f0ab857f6173e561d4020
file type:EXE
Production company:
version:
Shell or compiler information:PACKER:FSG 2.0 -> bart/xt
Subfile information:fsg2.0_616684a6dumpFile / 4879d8000512090074512f5a0d44dadf / EXE
Key behavior
Behavior description:对比可疑进程名
details:stricmp: [System Process] <------> avp.exe Des: 卡巴斯基
lstrcmpiA: System <------> avp.exe Des: 卡巴斯基
lstrcmpiA: smss.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: csrss.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: winlogon.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: services.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: lsass.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: YWyxService.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: enkcthlp.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: svchost.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: spoolsv.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: jqs.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: YHYpgradeHelper.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: alg.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: explorer.exe <------> avp.exe Des: 卡巴斯基
Behavior description:搜索可疑进程名
details:strstr: avp.exe <------> Des: 卡巴斯基
Behavior description:获取TickCount值
details:TickCount = 219175, SleepMilliseconds = 50.
TickCount = 219190, SleepMilliseconds = 50.
TickCount = 219206, SleepMilliseconds = 50.
TickCount = 219284, SleepMilliseconds = 50.
TickCount = 219315, SleepMilliseconds = 50.
TickCount = 219362, SleepMilliseconds = 50.
TickCount = 219409, SleepMilliseconds = 50.
TickCount = 219440, SleepMilliseconds = 50.
TickCount = 219471, SleepMilliseconds = 50.
TickCount = 219487, SleepMilliseconds = 50.
TickCount = 219565, SleepMilliseconds = 50.
TickCount = 219596, SleepMilliseconds = 50.
TickCount = 219643, SleepMilliseconds = 50.
TickCount = 219675, SleepMilliseconds = 50.
TickCount = 219737, SleepMilliseconds = 50.
Process behavior
Behavior description:创建本地线程
details:TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2760, ThreadID = 2844, StartAddress = 77DC845A, Parameter = 00000000
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2760, ThreadID = 2860, StartAddress = 77C0A341, Parameter = 003F4160
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2760, ThreadID = 2876, StartAddress = 77C0A341, Parameter = 003F41F0
Behavior description:枚举进程
details:N/A
Network behavior
Behavior description:建立到一个指定的套接字连接
details:IP: **.240.250.**:81, SOCKET = 0x00000110
Registry behavior
Behavior description:修改注册表
details:\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\FSnyic xixbkcgi\MarkTime
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\Version
Other behavior
Behavior description:创建互斥体
details:CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-*
Behavior description:创建事件对象
details:EventName = DINPUTWINMM
EventName = Wqamo
EventName = Global\crypt32LogoffEvent
Behavior description:对比可疑进程名
details:stricmp: [System Process] <------> avp.exe Des: 卡巴斯基
lstrcmpiA: System <------> avp.exe Des: 卡巴斯基
lstrcmpiA: smss.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: csrss.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: winlogon.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: services.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: lsass.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: YWyxService.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: enkcthlp.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: svchost.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: spoolsv.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: jqs.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: YHYpgradeHelper.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: alg.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: explorer.exe <------> avp.exe Des: 卡巴斯基
Behavior description:搜索可疑进程名
details:strstr: avp.exe <------> Des: 卡巴斯基
Behavior description:获取TickCount值
details:TickCount = 219175, SleepMilliseconds = 50.
TickCount = 219190, SleepMilliseconds = 50.
TickCount = 219206, SleepMilliseconds = 50.
TickCount = 219284, SleepMilliseconds = 50.
TickCount = 219315, SleepMilliseconds = 50.
TickCount = 219362, SleepMilliseconds = 50.
TickCount = 219409, SleepMilliseconds = 50.
TickCount = 219440, SleepMilliseconds = 50.
TickCount = 219471, SleepMilliseconds = 50.
TickCount = 219487, SleepMilliseconds = 50.
TickCount = 219565, SleepMilliseconds = 50.
TickCount = 219596, SleepMilliseconds = 50.
TickCount = 219643, SleepMilliseconds = 50.
TickCount = 219675, SleepMilliseconds = 50.
TickCount = 219737, SleepMilliseconds = 50.
Behavior description:调整进程token权限
details:SE_LOAD_DRIVER_PRIVILEGE
Behavior description:打开事件
details:HookSwitchHookEnabledEvent
Global\crypt32LogoffEvent
Global\SvcctrlStartEvent_A3752DX
N/A
Behavior description:调用Sleep函数
details:[1]: MilliSeconds = 50.
[2]: MilliSeconds = 500.
[3]: MilliSeconds = 500.
[4]: MilliSeconds = 500.
[5]: MilliSeconds = 500.
[6]: MilliSeconds = 500.
[7]: MilliSeconds = 500.
[8]: MilliSeconds = 500.
[9]: MilliSeconds = 500.
[10]: MilliSeconds = 500.
Run screenshot
VirSCAN

About VirSCAN | Privacy Policy | Contact us | link | Help VirSCAN
Translated by Keith Miller, United States
Powered By CentOSpol

京ICP备11007605号-12

pol

京公网安备 11010802020746号