1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.
| Safety rating:78 |
| Behavior list |
| Basic Information | |
|---|---|
| MD5: | bbe4871ce882b1bc33f3615c9cbbbf73 |
| file type: | zip |
| Production company: | |
| version: | |
| Shell or compiler information: | |
| Subfile information: | styles.xml / d34d98a1dac504a80c8204ddc56b481e / Unknown |
| theme1.xml / a62501999b27c60853338a50a8fd0f95 / Unknown | |
| settings.xml / 0d38f294112b44599a07173d74fa0cb4 / Unknown | |
| [Content_Types].xml / ded1b06d92c5c6b15c0b12c176ff3355 / Unknown | |
| document.xml / bb80e6a208329e69f09d04c4cd05ee0b / Unknown | |
| fontTable.xml / e488063bdbc25e05c6e3bf8612117117 / Unknown | |
| document.xml.rels / 7caaa99de7c709024bcfb5ae9c38352f / Unknown | |
| core.xml / 8ce95c72d72ce94ad49462cdbe6b92be / Unknown | |
| app.xml / fe28fcad681010d8e0e136198d436148 / Unknown | |
| .rels / 77bf61733a633ea617a4db76ef769a4d / Unknown | |
| webSettings.xml / 15065d2de3eddbb09d84337a09fd7985 / Unknown | |
| Key behavior | |
|---|---|
| Behavior description: | 打开注册表_检测虚拟机相关 |
| details: | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Oracle VM VirtualBox Guest Additions |
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-* |
| Local\PrimaryWord12SharedMemoryArea_S-* | |
| MSCTF.GCompartListSFM.DefaultS-* | |
| DfSharedHeap3D4E2E | |
| DFMap0-4017721 | |
| \WINDOWS\system32\zh-cn\wshom.ocx.mui | |
| DFMap0-4021311 | |
| Local\MSO_Formal11206607_S-* | |
| Local\MSO_AdHoc11206607_S-* | |
| AtlDebugAllocator_FileMappingNameStatic3_740 | |
| MSCTF.MarshalInterface.FileMap.MGF..NBKIH | |
| MSCTF.MarshalInterface.FileMap.MGF.B.NBKIH | |
| MSCTF.MarshalInterface.FileMap.MGF.C.NBKIH | |
| MSCTF.MarshalInterface.FileMap.MGF.D.NBKIH | |
| MSCTF.MarshalInterface.FileMap.MGF.E.NBKIH | |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,ThunderRT6Main] |
| [Window,Class] = [,_WwB] | |
| Process behavior | |
|---|---|
| Behavior description: | 枚举进程 |
| details: | N/A |
| File behavior | |
|---|---|
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-* |
| Local\PrimaryWord12SharedMemoryArea_S-* | |
| MSCTF.GCompartListSFM.DefaultS-* | |
| DfSharedHeap3D4E2E | |
| DFMap0-4017721 | |
| \WINDOWS\system32\zh-cn\wshom.ocx.mui | |
| DFMap0-4021311 | |
| Local\MSO_Formal11206607_S-* | |
| Local\MSO_AdHoc11206607_S-* | |
| AtlDebugAllocator_FileMappingNameStatic3_740 | |
| MSCTF.MarshalInterface.FileMap.MGF..NBKIH | |
| MSCTF.MarshalInterface.FileMap.MGF.B.NBKIH | |
| MSCTF.MarshalInterface.FileMap.MGF.C.NBKIH | |
| MSCTF.MarshalInterface.FileMap.MGF.D.NBKIH | |
| MSCTF.MarshalInterface.FileMap.MGF.E.NBKIH | |
| Behavior description: | 修改文件内容 |
| details: | C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dotm---> Offset = 0 |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\~$996E.docx---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\UProof\ExcludeDictionaryEN0409.lex---> Offset = 0 | |
| Behavior description: | 查找文件 |
| details: | FileName = C:\Program Files |
| FileName = C:\Program Files\Microsoft Office 2007 | |
| FileName = C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll | |
| FileName = C:\WINDOWS\Microsoft.NET\Framework\\* | |
| FileName = C:\Program Files\Microsoft Office 2007\Office12\Normal.dotm | |
| FileName = C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dotm | |
| FileName = C:\Documents and Settings | |
| FileName = C:\Documents and Settings\Administrator | |
| FileName = C:\Documents and Settings\Administrator\桌面 | |
| FileName = C:\Documents and Settings\Administrator\Application Data | |
| FileName = C:\Documents and Settings\Administrator\Application Data\Microsoft | |
| FileName = C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates | |
| FileName = C:\Documents and Settings\Administrator\My Documents | |
| FileName = C:\Documents and Settings\All Users | |
| FileName = C:\Documents and Settings\All Users\Documents | |
| Registry behavior | |
|---|---|
| Behavior description: | 修改注册表 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\}f, |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\Usage\ProductFiles | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Common\LanguageResources\EnabledLanguages\2052 | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Common\LanguageResources\EnabledLanguages\1033 | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\Usage\WORDFiles | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\MTTT | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\{k, | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\mn, | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\:n, | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\zn, | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\wo, | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\vo, | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\%o, | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Common\ReviewCycle\ReviewToken | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\*v, | |
| Behavior description: | 删除注册表键 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems |
| \REGISTRY\USER\S-1-5-21-117609710-688789844-839522115-500\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems | |
| Behavior description: | 删除注册表键值 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\{k, |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\mn, | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\:n, | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\zn, | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\wo, | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems\vo, | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\File MRU\Max Display | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\File MRU\Item 1 | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\File MRU\Item 2 | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\File MRU\Item 3 | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\File MRU\Item 4 | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\File MRU\Item 5 | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\File MRU\Item 6 | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\File MRU\Item 7 | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\12.0\Word\File MRU\Item 8 | |
| Other behavior | |
|---|---|
| Behavior description: | 打开注册表_检测虚拟机相关 |
| details: | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Oracle VM VirtualBox Guest Additions |
| Behavior description: | 查找指定窗口 |
| details: | NtUserFindWindowEx: [Class,Window] = [mspim_wnd32,] |
| NtUserFindWindowEx: [Class,Window] = [MSOBALLOON,] | |
| NtUserFindWindowEx: [Class,Window] = [MsoHelp10,] | |
| NtUserFindWindowEx: [Class,Window] = [AgentAnim,] | |
| NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,] | |
| NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,] | |
| NtUserFindWindowEx: [Class,Window] = [MsoHelp11,] | |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,ThunderRT6Main] |
| [Window,Class] = [,_WwB] | |
| Behavior description: | 创建互斥体 |
| details: | CTF.LBES.MutexDefaultS-* |
| CTF.Compart.MutexDefaultS-* | |
| CTF.Asm.MutexDefaultS-* | |
| CTF.Layouts.MutexDefaultS-* | |
| CTF.TMD.MutexDefaultS-* | |
| CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-* | |
| MSCTF.GCompartListMUTEX.DefaultS-* | |
| Global\MTX_MSO_Formal1_S-* | |
| Global\MTX_MSO_AdHoc1_S-* | |
| MSCTF.Shared.MUTEX.ELH | |
| Local\ZonesCounterMutex | |
| Local\ZoneAttributeCacheCounterMutex | |
| Local\ZonesCacheCounterMutex | |
| Local\ZonesLockedCacheCounterMutex | |
| MSCTF.Shared.MUTEX.MGF | |
| Behavior description: | 获取系统权限 |
| details: | SE_LOAD_DRIVER_PRIVILEGE |
| Run screenshot |
|---|
 |
HOME
