VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.

Language
Server load
Server Load

  Main Menu
VirSCAN  HOME VirSCAN  go Virscan.org VirSCAN  Report VirSCAN  Virus report VirSCAN  Behavior report VirSCAN  Help VirSCAN VirSCAN  Submit Bugs VirSCAN  Contact us VirSCAN  URL detection VirSCAN  API VirSCAN  uploader for windows(test)
  Powered By
a-squared
a-squared
a-squared
 
File information
Safety rating:75
Behavior list
Basic Information
MD5:3e7580bc2233684d6af443afa1148dba
file type:EXE
Production company:
version:1.0.0.0
Shell or compiler information:COMPILER:Microsoft Visual Studio .NET 2005 -- 2008 -> Microsoft Corporation *
Key behavior
Behavior description:设置消息钩子
details:C:\WINDOWS\system32\DINPUT8.dll
Behavior description:获取TickCount值
details:TickCount = 1077240, SleepMilliseconds = 100.
TickCount = 1137437, SleepMilliseconds = 60000.
TickCount = 1137468, SleepMilliseconds = 60000.
TickCount = 1137609, SleepMilliseconds = 60000.
TickCount = 1137703, SleepMilliseconds = 60000.
TickCount = 1137734, SleepMilliseconds = 60000.
TickCount = 1137796, SleepMilliseconds = 60000.
TickCount = 1138093, SleepMilliseconds = 60000.
TickCount = 1138218, SleepMilliseconds = 60000.
TickCount = 1138234, SleepMilliseconds = 60000.
TickCount = 1138265, SleepMilliseconds = 60000.
TickCount = 1138281, SleepMilliseconds = 60000.
TickCount = 1138296, SleepMilliseconds = 60000.
TickCount = 1138406, SleepMilliseconds = 60000.
TickCount = 1138484, SleepMilliseconds = 60000.
File behavior
Behavior description:创建文件
details:C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\1074171.temp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\BOSS之家.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\BOSS之家1.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\BOSS向上图标.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\BOSS向下图标.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\vip挑战.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\VIP特权关闭.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\VIP特权关闭1.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\乌鸡国师.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\低耗图.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\关闭XX.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\关闭XX1.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\关闭熔炼.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\关闭熔炼1.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\关闭熔炼2.bmp
Behavior description:删除文件
details:C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\1074171.temp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\main.twin
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\intermediate.tis
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\aiyeyou.txt
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\BOSS之家.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\BOSS之家1.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\BOSS向上图标.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\BOSS向下图标.bmp
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\Dama2.dll
Behavior description:创建可执行文件
details:C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\Dama2.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\dm.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\DmReg.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\kssPluginCom.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\TApi.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\TLib.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\t_baibaoyun_win32.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\WebOperation.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\xiyou.dll
Behavior description:修改文件内容
details:C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\1074171.temp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\BOSS之家.bmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\BOSS之家1.bmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\BOSS向上图标.bmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\BOSS向下图标.bmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\vip挑战.bmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\VIP特权关闭.bmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\VIP特权关闭1.bmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\乌鸡国师.bmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\低耗图.bmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\关闭XX.bmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\关闭XX1.bmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\关闭熔炼.bmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\关闭熔炼1.bmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\关闭熔炼2.bmp ---> Offset = 0
Behavior description:查找文件
details:FileName = C:\*.*
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\23841063fb
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\23841063fb\*.*
Other behavior
Behavior description:创建互斥体
details:oleacc-msaa-loaded
CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
RasPbFile
Behavior description:创建事件对象
details:EventName = DINPUTWINMM
EventName = ShellCopyEngineRunning
EventName = Global\crypt32LogoffEvent
EventName = Global\userenv: User Profile setup event
EventName = ShellCopyEngineFinished
Behavior description:查找指定窗口
details:NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
Behavior description:获取TickCount值
details:TickCount = 1077240, SleepMilliseconds = 100.
TickCount = 1137437, SleepMilliseconds = 60000.
TickCount = 1137468, SleepMilliseconds = 60000.
TickCount = 1137609, SleepMilliseconds = 60000.
TickCount = 1137703, SleepMilliseconds = 60000.
TickCount = 1137734, SleepMilliseconds = 60000.
TickCount = 1137796, SleepMilliseconds = 60000.
TickCount = 1138093, SleepMilliseconds = 60000.
TickCount = 1138218, SleepMilliseconds = 60000.
TickCount = 1138234, SleepMilliseconds = 60000.
TickCount = 1138265, SleepMilliseconds = 60000.
TickCount = 1138281, SleepMilliseconds = 60000.
TickCount = 1138296, SleepMilliseconds = 60000.
TickCount = 1138406, SleepMilliseconds = 60000.
TickCount = 1138484, SleepMilliseconds = 60000.
Behavior description:调整进程token权限
details:SE_LOAD_DRIVER_PRIVILEGE
Behavior description:可执行文件签名信息
details:C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\Dama2.dll(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\dm.dll(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\DmReg.dll(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\kssPluginCom.dll(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\TApi.dll(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\TLib.dll(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\t_baibaoyun_win32.dll(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\WebOperation.dll(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\xiyou.dll(签名验证: 未通过)
Behavior description:调用Sleep函数
details:[1]: MilliSeconds = 100.
[2]: MilliSeconds = 60000.
Behavior description:隐藏指定窗口
details:[Window,Class] = [,ComboLBox]
[Window,Class] = [,#32770]
Behavior description:可执行文件MD5
details:C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\Dama2.dll ---> c4e69e37485fabfa4926e1ead7680b6b
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\dm.dll ---> c578b6820bda5689940560147c6e5ffc
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\DmReg.dll ---> bab4d119880ede651e1edb7d5d891599
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\kssPluginCom.dll ---> 143962e2d2feadf11329d27e60374489
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\TApi.dll ---> 601ec5ed8587474824f9bfeec2dd95b3
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\TLib.dll ---> 84d18da644ec2559aa8a9f5cdc3948c0
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\t_baibaoyun_win32.dll ---> 430b269ba6ae3ae72b7c76848fc3dd8c
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\WebOperation.dll ---> 0eb164739231276b6b90a7171bded144
C:\Documents and Settings\Administrator\Local Settings\Temp\23841063fb\xiyou.dll ---> e525427bf2a164f62ca958aa29d2e6b9
Behavior description:样本控制台输出内容
details:N/A
Behavior description:加载新释放的文件
details:Image: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\23841063fb\TLib.dll.
Image: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\23841063fb\TApi.dll.
Image: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\23841063fb\t_baibaoyun_win32.dll.
Run screenshot
VirSCAN

About VirSCAN | Privacy Policy | Contact us | Links | Help VirSCAN
中国反网络病毒联盟
Powered By CentOSpol

京ICP备11007605号-12

 pol

京公网安备 11010802020746号