VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.

Language
Server load
Server Load

File information
Safety rating:85
Behavior list
Basic Information
MD5:f49a3779d99cfb3f83847f23d57d4273
file type:Nsis
Production company:青岛软媒网络科技有限公司
version:5.0.0.78
Shell or compiler information:
Subfile information:pcmaster.exe / 514d01fd978fdbb70b4144d2411975f8 / EXE
radar.exe / b4c0198f7dfabaca2a046855305b3e84 / EXE
upx_c_c0b3a4bedumpFile / 4fb15e47e5135275f47b75a11dd7050f / EXE
upx_c_cb484159dumpFile / bd43549a9df8d539c011484e21df69af / EXE
upx_c_461c7220dumpFile / ba816f21084d76c0f71e87ac048f654c / EXE
upx_c_7c210aacdumpFile / 3f1a08ff10235d23d61aac3be8759352 / EXE
upx_c_cd4fb77ddumpFile / ab83f6718744df2dea2d99dddf453533 / EXE
pcmastertray.exe / 3ff91eca21f22eb1b09a5eb167881dcf / EXE
upx_c_c812bb2ddumpFile / fda666cca71acc2d33951ee6376cf9e8 / EXE
upx_c_65de11e0dumpFile / 8727d92f6681394eb9ac28b6e15b9b36 / EXE
usbbooter.exe / 8ea4c36136b3faeca273d063a1cb88ae / EXE
upx_c_0e0a0120dumpFile / afae422a197eacae601ae3104a4aa98f / EXE
upx_c_d00497f4dumpFile / 7b7df840cfb0e1d697464a27c8743a5c / EXE
upx_c_09fbd5b4dumpFile / 1b15e1ddc3077ac47e93d70b0e768d3c / EXE
upx_c_59ed286bdumpFile / 83b2a8303f611da4ebc0739e6c30f81f / EXE
upx_c_525f8beedumpFile / 1df17d035cd6781c21b61fb2455b5cb7 / EXE
magiczip.exe / d5e2be56c3ca26497d6b61a8cf48343b / EXE
upx_c_ac15505fdumpFile / 04e7d74ae4393a76fc29ee3376d4f84c / EXE
upx_c_13624421dumpFile / 499aad1ee7953be1ce607210089407bc / EXE
Key behavior
Behavior description:写权限映射文件
details:CiceroSharedMemDefaultS-*
MSCTF.MarshalInterface.FileMap.ILJ..FCCMH
MSCTF.MarshalInterface.FileMap.ILJ.B.FCCMH
MSCTF.MarshalInterface.FileMap.ILJ.C.FCCMH
MSCTF.MarshalInterface.FileMap.ILJ.D.FCCMH
MSCTF.MarshalInterface.FileMap.ILJ.E.FCCMH
MSCTF.MarshalInterface.FileMap.ILJ.F.EDCMH
MSCTF.MarshalInterface.FileMap.ILJ.G.EDCMH
MSCTF.Shared.SFM.ILJ
Behavior description:屏蔽窗口关闭消息
details:hWnd = 0x0002029e, Text = 魔方电脑大师 安装向导, ClassName = #32770.
Behavior description:隐藏指定窗口
details:[Window,Class] = [,Static]
[Window,Class] = [ ,Static]
[Window,Class] = [ ,Static]
[Window,Class] = [,Button]
[Window,Class] = [C:\Program Files\Ruanmei\PCMaster,Edit]
Process behavior
Behavior description:枚举进程
details:N/A
File behavior
Behavior description:写权限映射文件
details:CiceroSharedMemDefaultS-*
MSCTF.MarshalInterface.FileMap.ILJ..FCCMH
MSCTF.MarshalInterface.FileMap.ILJ.B.FCCMH
MSCTF.MarshalInterface.FileMap.ILJ.C.FCCMH
MSCTF.MarshalInterface.FileMap.ILJ.D.FCCMH
MSCTF.MarshalInterface.FileMap.ILJ.E.FCCMH
MSCTF.MarshalInterface.FileMap.ILJ.F.EDCMH
MSCTF.MarshalInterface.FileMap.ILJ.G.EDCMH
MSCTF.Shared.SFM.ILJ
Behavior description:创建可执行文件
details:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\MPlugin_NSIS.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\nsDialogs.dll
Behavior description:修改文件内容
details:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\blue-bg.png---> Offset = 16384
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\browse_button_down.png---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\browse_button_normal.png---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\browse_button_over.png---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\chkbox_normal.png---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\chkbox_normal_checked.png---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\chkbox_over.png---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\chkbox_over_checked.png---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\close_button_down.png---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\close_button_normal.png---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\close_button_over.png---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\finish_button_down.png---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\finish_button_normal.png---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\finish_button_over.png---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\inst_button_down.png---> Offset = 0
Behavior description:查找文件
details:FileName = C:\DOCUME~1
FileName = C:\Documents and Settings\ADMINI~1
FileName = C:\Documents and Settings\Administrator\LOCALS~1
FileName = C:\Documents and Settings\Administrator\Local Settings\Temp
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\*.*
FileName = \SaaYaa.exe
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1
FileName = C:\DOCUME~1\ADMINI~1
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\*.*
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\img\finish_button_over.png.AmBackup10000
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsq6.tmp\MPlugin_NSIS.dll.AmBackup1
Registry behavior
Behavior description:修改注册表_延迟重命名项
details:\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session Manager\PendingFileRenameOperations
Other behavior
Behavior description:创建互斥体
details:CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
MSCTF.Shared.MUTEX.ELH
MSCTF.Shared.MUTEX.ILJ
Behavior description:隐藏指定窗口
details:[Window,Class] = [,Static]
[Window,Class] = [ ,Static]
[Window,Class] = [ ,Static]
[Window,Class] = [,Button]
[Window,Class] = [C:\Program Files\Ruanmei\PCMaster,Edit]
Behavior description:查找指定窗口
details:NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
Behavior description:获取系统权限
details:SE_LOAD_DRIVER_PRIVILEGE
Behavior description:屏蔽窗口关闭消息
details:hWnd = 0x0002029e, Text = 魔方电脑大师 安装向导, ClassName = #32770.
Behavior description:窗口信息
details:Pid = 2500, Hwnd=0x202b4, Text = , ClassName = Static.
Pid = 2500, Hwnd=0x202b2, Text = , ClassName = Static.
Pid = 2500, Hwnd=0x202d8, Text = 下一步(&N) >, ClassName = Button.
Pid = 2500, Hwnd=0x202c2, Text = 取消(&C), ClassName = Button.
Pid = 2500, Hwnd=0x302da, Text = C:\Program Files\Ruanmei\PCMaster, ClassName = Edit.
Pid = 2500, Hwnd=0x2029e, Text = 魔方电脑大师 安装向导, ClassName = #32770.
Pid = 2500, Hwnd=0x10344, Text = 是(&Y), ClassName = Button.
Pid = 2500, Hwnd=0x10346, Text = 否(&N), ClassName = Button.
Pid = 2500, Hwnd=0x10348, Text = 魔方电脑大师安装尚未完成,您确认要退出安装?, ClassName = Static.
Pid = 2500, Hwnd=0x20342, Text = 魔方电脑大师 安装, ClassName = #32770.
Run screenshot
VirSCAN

About VirSCAN | Privacy Policy | Contact us | Links | Help VirSCAN
Translated by Keith Miller, United States
Powered By CentOSpol

京ICP备11007605号-12

pol

京公网安备 11010802020746号