1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.
| Safety rating:76 |
| Behavior list |
| Basic Information | |
|---|---|
| MD5: | 37d01053d108ec1f9962f78f0ad5248a |
| file type: | EXE |
| Production company: | |
| version: | |
| Shell or compiler information: | PACKER:UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo [Overlay] |
| Subfile information: | upx_c_3d2445bddumpFile / d76765eeefcbef0431c8c8df72da147b / EXE |
| Key behavior | |
|---|---|
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500 |
| Local\UrlZonesSM_Administrator | |
| \WINDOWS\system32\zh-cn\ieframe.dll.mui | |
| Behavior description: | 按名称获取主机地址 |
| details: | ip.cn |
| Process behavior | |
|---|---|
| Behavior description: | 隐藏窗口创建进程 |
| details: | ImagePath = c:\windows\system32\rundll32.exe, CmdLine = "c:\windows\system32\rundll32.exe" "c:\program files\shuazuan\350328.dll",mainthread |
| Behavior description: | 创建进程 |
| details: | ImagePath = C:\WINDOWS\system32\rundll32.exe, CmdLine = "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\shuazuan\350328.dll",MainThread |
| Behavior description: | 创建新文件进程 |
| details: | ImagePath = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temp\监控进程结束软件.exe, CmdLine = "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temp\监控进程结束软件.exe" |
| ImagePath = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temp\waiwang.exe, CmdLine = "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temp\waiwang.exe" | |
| Behavior description: | 枚举进程 |
| details: | N/A |
| File behavior | |
|---|---|
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500 |
| Local\UrlZonesSM_Administrator | |
| \WINDOWS\system32\zh-cn\ieframe.dll.mui | |
| Behavior description: | 重命名文件 |
| details: | C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temp\waiwang.exe ---> C:\WINDOWS\system32\350390.bak |
| Behavior description: | 创建可执行文件 |
| details: | C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temp\监控进程结束软件.exe |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temp\waiwang.exe | |
| C:\Program Files\shuazuan\350328.dll | |
| Network behavior | |
|---|---|
| Behavior description: | 发送一个已连接的套接字数据 |
| details: | SOCKET = 0x00000138, TotalSize = 259, Offset = 0, ReadSize = 259. |
| Behavior description: | 建立到一个指定的套接字连接 |
| details: | 219.133.40.1:80 |
| Behavior description: | 按名称获取主机地址 |
| details: | ip.cn |
| Registry behavior | |
|---|---|
| Behavior description: | 修改注册表 |
| details: | \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temp\监控进程结束软件.exe |
| \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temp\waiwang.exe | |
| \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session Manager\PendingFileRenameOperations | |
| \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\system32\rundll32.exe | |
| Other behavior | |
|---|---|
| Behavior description: | 查找指定窗口 |
| details: | NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,] |
| NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,] | |
| Behavior description: | 窗口信息 |
| details: | Pid = 2740, Hwnd=0x10358, Text = 结束进程, ClassName = ThunderRT6CommandButton. |
| Pid = 2740, Hwnd=0x10356, Text = zxy开发, ClassName = ThunderRT6FormDC. | |
| Behavior description: | 创建互斥体 |
| details: | CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500 |
| CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500 | |
| CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500 | |
| CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500 | |
| CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500 | |
| CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500 | |
| Local\ZonesCounterMutex | |
| Local\ZoneAttributeCacheCounterMutex | |
| Local\ZonesCacheCounterMutex | |
| Local\ZonesLockedCacheCounterMutex | |
| MSCTF.Shared.MUTEX.AEH | |
| zouxianyu.eicp.net:2015:shuazuan | |
| SHIMLIB_LOG_MUTEX | |
| MSCTF.Shared.MUTEX.ILK | |
| Behavior description: | 获取系统权限 |
| details: | SE_LOAD_DRIVER_PRIVILEGE |
| Run screenshot |
|---|
 |
HOME
