VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.

Language
Server load
Server Load
文件信息
安全评分 :35
基本信息
MD5:b0c164ba114f0ab857f6173e561d4020
文件类型:EXE
出品公司:
版本:
壳或编译器信息:PACKER:FSG 2.0 -> bart/xt
子文件信息:fsg2.0_616684a6dumpFile / 4879d8000512090074512f5a0d44dadf / EXE
关键行为
行为描述:对比可疑进程名
详情信息:stricmp: [System Process] <------> avp.exe Des: 卡巴斯基
lstrcmpiA: System <------> avp.exe Des: 卡巴斯基
lstrcmpiA: smss.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: csrss.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: winlogon.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: services.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: lsass.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: YWyxService.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: enkcthlp.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: svchost.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: spoolsv.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: jqs.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: YHYpgradeHelper.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: alg.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: explorer.exe <------> avp.exe Des: 卡巴斯基
行为描述:搜索可疑进程名
详情信息:strstr: avp.exe <------> Des: 卡巴斯基
行为描述:获取TickCount值
详情信息:TickCount = 219175, SleepMilliseconds = 50.
TickCount = 219190, SleepMilliseconds = 50.
TickCount = 219206, SleepMilliseconds = 50.
TickCount = 219284, SleepMilliseconds = 50.
TickCount = 219315, SleepMilliseconds = 50.
TickCount = 219362, SleepMilliseconds = 50.
TickCount = 219409, SleepMilliseconds = 50.
TickCount = 219440, SleepMilliseconds = 50.
TickCount = 219471, SleepMilliseconds = 50.
TickCount = 219487, SleepMilliseconds = 50.
TickCount = 219565, SleepMilliseconds = 50.
TickCount = 219596, SleepMilliseconds = 50.
TickCount = 219643, SleepMilliseconds = 50.
TickCount = 219675, SleepMilliseconds = 50.
TickCount = 219737, SleepMilliseconds = 50.
进程行为
行为描述:创建本地线程
详情信息:TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2760, ThreadID = 2844, StartAddress = 77DC845A, Parameter = 00000000
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2760, ThreadID = 2860, StartAddress = 77C0A341, Parameter = 003F4160
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2760, ThreadID = 2876, StartAddress = 77C0A341, Parameter = 003F41F0
行为描述:枚举进程
详情信息:N/A
网络行为
行为描述:建立到一个指定的套接字连接
详情信息:IP: **.240.250.**:81, SOCKET = 0x00000110
注册表行为
行为描述:修改注册表
详情信息:\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\FSnyic xixbkcgi\MarkTime
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\Version
其他行为
行为描述:创建互斥体
详情信息:CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-*
行为描述:创建事件对象
详情信息:EventName = DINPUTWINMM
EventName = Wqamo
EventName = Global\crypt32LogoffEvent
行为描述:对比可疑进程名
详情信息:stricmp: [System Process] <------> avp.exe Des: 卡巴斯基
lstrcmpiA: System <------> avp.exe Des: 卡巴斯基
lstrcmpiA: smss.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: csrss.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: winlogon.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: services.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: lsass.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: YWyxService.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: enkcthlp.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: svchost.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: spoolsv.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: jqs.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: YHYpgradeHelper.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: alg.exe <------> avp.exe Des: 卡巴斯基
lstrcmpiA: explorer.exe <------> avp.exe Des: 卡巴斯基
行为描述:搜索可疑进程名
详情信息:strstr: avp.exe <------> Des: 卡巴斯基
行为描述:获取TickCount值
详情信息:TickCount = 219175, SleepMilliseconds = 50.
TickCount = 219190, SleepMilliseconds = 50.
TickCount = 219206, SleepMilliseconds = 50.
TickCount = 219284, SleepMilliseconds = 50.
TickCount = 219315, SleepMilliseconds = 50.
TickCount = 219362, SleepMilliseconds = 50.
TickCount = 219409, SleepMilliseconds = 50.
TickCount = 219440, SleepMilliseconds = 50.
TickCount = 219471, SleepMilliseconds = 50.
TickCount = 219487, SleepMilliseconds = 50.
TickCount = 219565, SleepMilliseconds = 50.
TickCount = 219596, SleepMilliseconds = 50.
TickCount = 219643, SleepMilliseconds = 50.
TickCount = 219675, SleepMilliseconds = 50.
TickCount = 219737, SleepMilliseconds = 50.
行为描述:调整进程token权限
详情信息:SE_LOAD_DRIVER_PRIVILEGE
行为描述:打开事件
详情信息:HookSwitchHookEnabledEvent
Global\crypt32LogoffEvent
Global\SvcctrlStartEvent_A3752DX
N/A
行为描述:调用Sleep函数
详情信息:[1]: MilliSeconds = 50.
[2]: MilliSeconds = 500.
[3]: MilliSeconds = 500.
[4]: MilliSeconds = 500.
[5]: MilliSeconds = 500.
[6]: MilliSeconds = 500.
[7]: MilliSeconds = 500.
[8]: MilliSeconds = 500.
[9]: MilliSeconds = 500.
[10]: MilliSeconds = 500.
运行截图
VirSCAN

About VirSCAN | Privacy Policy | Contact us | link | Help VirSCAN
Translated by Keith Miller, United States
Powered By CentOSpol

京ICP备11007605号-12

pol

京公网安备 11010802020746号