VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.

Language
Server load
Server Load



File information
File Name :Ai-学籍V22.apk (File not down)
File Size :2957023 byte
File Type :application/zip
MD5:ee7a7a36201ece3614e804128529b27d
SHA1:d6ff12295211321c6eafb975b1a49f556a03c4c4
  • 扫描结果
  • 权限
  • 文件行为分析
  • Scanner results
    Scanner results:3%Scanner(s) (1/32)found malware!
    Behavior analysis report:         Habo file analysis
    Time: 2017-08-29 18:49:17 (CST)
    VirSCANVirSCAN
    Scanner Engine Ver Sig Ver Sig Date Scan result Time
    antiy AVL SDK 2.0 1970-01-01 Found nothing 6
    asquared 9.0.0.4799 9.0.0.4799 2015-03-08 Found nothing 3
    avast 170303-1 4.7.4 2017-03-03 Found nothing 60
    avg 2109/14366 10.0.1405 2017-08-23 Found nothing 60
    baidu 2.0.1.0 4.1.3.52192 2.0.1.0 Found nothing 8
    baidusd 1.0 1.0 2017-03-22 Found nothing 1
    bitdefender 7.58879 7.90123 2015-01-16 Found nothing 60
    clamav 23723 0.97.5 2017-08-28 Found nothing 60
    drweb 5.0.2.3300 5.0.1.1 2017-06-18 Found nothing 60
    fortinet 1.000, 51.241, 51.106, 51.128 5.4.247 2017-08-29 Found nothing 60
    fprot 4.6.2.117 6.5.1.5418 2016-02-05 Found nothing 60
    fsecure 2015-08-01-02 9.13 2015-08-01 Found nothing 60
    gdata 25.14007 25.14007 2017-08-28 Found nothing 14
    ikarus 1.06.01 V1.32.31.0 2017-08-27 Found nothing 60
    jiangmin 16.0.100 1.0.0.0 2017-08-28 Found nothing 2
    kaspersky 5.5.33 5.5.33 2014-04-01 Found nothing 60
    kingsoft 2.1 2.1 2017-08-28 Found nothing 5
    mcafee 8620 5400.1158 2017-08-12 Found nothing 60
    nod32 5984 3.0.21 2017-08-27 Found nothing 60
    panda 9.05.01 9.05.01 2017-08-28 Found nothing 4
    pcc 13.302.06 9.500-1005 2017-03-27 Found nothing 60
    qh360 1.0.1 1.0.1 1.0.1 Found nothing 4
    qqphone 1.0.0.0 1.0.0.0 2015-12-30 Found nothing 60
    quickheal 14.00 14.00 2017-08-28 Android.SmForw.GEN6222 3
    rising 26.28.00.01 26.28.00.01 2016-07-18 Found nothing 2
    sophos 5.32 3.65.2 2016-10-10 Found nothing 60
    symantec 20151230.005 1.3.0.24 2015-12-30 Found nothing 60
    tachyon 9.9.9 9.9.9 2013-12-27 Found nothing 5
    thehacker 6.8.0.5 6.8.0.5 2017-08-25 Found nothing 2
    tws 17.47.17308 1.0.2.2108 2017-08-28 Found nothing 15
    vba 3.12.29.5 beta 3.12.29.5 beta 2017-08-25 Found nothing 60
    virusbuster 15.0.985.0 5.5.2.13 2014-12-05 Found nothing 60
    Heuristic/Suspicious Exact
    NOTICE: Results are not 100% accurate and can be reported as a false positive by some scannerswhen and if malware is found. Please judge these results for yourself.
    Copy to clipboard
  • 权限列表
    许可名称信息
    android.permission.SET_WALLPAPER设置桌面壁纸
    android.permission.GET_TASKS获取有关当前或最近运行的任务信息
    android.permission.PROCESS_OUTGOING_CALLS监视、修改有关拨出电话
    android.permission.WRITE_EXTERNAL_STORAGE写外部存储器(如:SD卡)
    android.permission.ACCESS_WIFI_STATE读取wifi网络状态
    android.permission.ACCESS_COARSE_LOCATION获取粗略的位置(通过wifi、基站)
    android.permission.CALL_PHONE拨打电话
    android.permission.READ_PHONE_STATE读取电话状态
    android.permission.MOUNT_UNMOUNT_FILESYSTEMS挂载、反挂载外部文件系统
    android.permission.CAMERA访问照相机设备
    android.permission.ACCESS_FINE_LOCATION获取精确的位置(通过GPS)
    android.permission.WAKE_LOCK手机屏幕关闭后后台进程仍运行
    android.permission.ACCESS_NETWORK_STATE读取网络状态(2G或3G)
    android.permission.RECORD_AUDIO录音(使用AudioRecord)
    android.permission.FLASHLIGHT访问闪光灯
    com.android.launcher.permission.INSTALL_SHORTCUT创建快捷方式
    android.permission.MODIFY_AUDIO_SETTINGS修改声音设置
    android.permission.DISABLE_KEYGUARD禁用键盘锁
    android.hardware.camera
    android.permission.SYSTEM_ALERT_WINDOW显示系统窗口
    android.permission.MODIFY_PHONE_STATE修改电话状态
    android.permission.INTERNET连接网络(2G或3G)
    android.permission.WRITE_SETTINGS读写系统设置项
    android.permission.CHANGE_WIFI_STATE改变WIFI连接状态
    android.permission.VIBRATE允许设备震动
    com.android.launcher.permission.READ_SETTINGS读取快捷方式信息
    android.permission.READ_CALL_LOG读取通话记录
    android.permission.CHANGE_NETWORK_STATE变更网络状态
    android.permission.CHANGE_CONFIGURATION修改当前设置(如:本地化)
  • 文件信息
    安全评分 :
    基本信息
    MD5:ee7a7a36201ece3614e804128529b27d
    包名:com.AiXJ
    最低运行环境:Android 2.2.x
    版权:zyy
    关键行为
    行为描述:跨进程写入数据
    详情信息:TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00010000, Size = 0x000007c2 TargetPID = 0x00000a88
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00020000, Size = 0x00000708 TargetPID = 0x00000a88
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x7ffde010, Size = 0x00000004 TargetPID = 0x00000a88
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00030000, Size = 0x00000184 TargetPID = 0x00000a88
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x7ffde1e8, Size = 0x00000004 TargetPID = 0x00000a88
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00010000, Size = 0x000007c2 TargetPID = 0x00000a78
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00020000, Size = 0x000006ec TargetPID = 0x00000a78
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x7ffdf010, Size = 0x00000004 TargetPID = 0x00000a78
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00030000, Size = 0x00000184 TargetPID = 0x00000a78
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x7ffdf1e8, Size = 0x00000004 TargetPID = 0x00000a78
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00010000, Size = 0x000007c2 TargetPID = 0x00000ab8
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00020000, Size = 0x000006ec TargetPID = 0x00000ab8
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x7ffd5010, Size = 0x00000004 TargetPID = 0x00000ab8
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00030000, Size = 0x00000184 TargetPID = 0x00000ab8
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x7ffd51e8, Size = 0x00000004 TargetPID = 0x00000ab8
    行为描述:修改注册表_任务管理器关键属性
    详情信息:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
    行为描述:对比可疑进程名
    详情信息:lstrcmpiW: 360se.exe <------> * Des: 360浏览器
    行为描述:修改注册表_禁用修改IE首页属性
    详情信息:\REGISTRY\USER\S-*\Software\Policies\Microsoft\Internet Explorer\Control Panel\HomePage
    行为描述:杀掉进程
    详情信息:TASKKILL = taskkill /f /im kavsvc.exe
    TASKKILL = taskkill /f /im KVXP.kxp
    TASKKILL = taskkill /f /im Rav.exe
    TASKKILL = taskkill /f /im Ravmon.exe
    TASKKILL = taskkill /f /im Mcshield.exe
    TASKKILL = taskkill /f /im VsTskMgr.exe
    TASKKILL = taskkill /f /im 360se.exe
    TASKKILL = taskkill /f /im QQPCRTP.exe
    TASKKILL = taskkill /f /im QQPCTray.exe
    TASKKILL = taskkill /f /im QQPCMgr.exe
    TASKKILL = taskkill /f /im KMService.exe
    TASKKILL = taskkill /f /im AVKproxy.exe
    TASKKILL = taskkill /f /im CSS-AVS.exe
    C:\WINDOWS\system32\RavMon.exe
    TASKKILL = taskkill /f /im nod32kui.exe
    行为描述:直接获取CPU时钟
    详情信息:EAX = 0x1fc10969, EDX = 0x000000b4
    EAX = 0x1fc109b5, EDX = 0x000000b4
    EAX = 0x1fc10a01, EDX = 0x000000b4
    EAX = 0x1fc10a4d, EDX = 0x000000b4
    EAX = 0x2248d9d6, EDX = 0x000000b4
    EAX = 0x2248da22, EDX = 0x000000b4
    EAX = 0x2248da6e, EDX = 0x000000b4
    EAX = 0x2248daba, EDX = 0x000000b4
    EAX = 0x24fbda36, EDX = 0x000000b4
    EAX = 0x24fbda82, EDX = 0x000000b4
    行为描述:设置特殊文件属性
    详情信息:C:\Documents and Settings\Administrator\Local Settings\%temp%\SkinH_EL.dll
    行为描述:修改注册表_禁用CMD 相关属性
    详情信息:\REGISTRY\USER\S-*\Software\Policies\Microsoft\Windows\System\DisableCMD
    行为描述:关机或重启
    详情信息:N/A
    行为描述:修改注册表_禁用注册表编辑器项
    详情信息:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools
    进程行为
    行为描述:隐藏窗口创建进程
    详情信息:ImagePath = , CmdLine = taskkill /f /im kavsvc.exe
    ImagePath = , CmdLine = taskkill /f /im KVXP.kxp
    ImagePath = , CmdLine = taskkill /f /im Rav.exe
    ImagePath = , CmdLine = taskkill /f /im Ravmon.exe
    ImagePath = , CmdLine = taskkill /f /im Mcshield.exe
    ImagePath = , CmdLine = taskkill /f /im VsTskMgr.exe
    ImagePath = , CmdLine = taskkill /f /im 360se.exe
    ImagePath = , CmdLine = taskkill /f /im QQPCRTP.exe
    ImagePath = , CmdLine = taskkill /f /im QQPCTray.exe
    ImagePath = , CmdLine = taskkill /f /im QQPCMgr.exe
    ImagePath = , CmdLine = taskkill /f /im KMService.exe
    ImagePath = , CmdLine = taskkill /f /im kxescore.exe
    ImagePath = , CmdLine = taskkill /f /im kxetray.exe
    ImagePath = , CmdLine = taskkill /f /im AVKproxy.exe
    ImagePath = , CmdLine = taskkill /f /im CSS-AVS.exe
    行为描述:创建进程
    详情信息:[0x00000b28]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im kavsvc.exe
    [0x00000b30]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im KVXP.kxp
    [0x00000b38]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im Rav.exe
    [0x00000b40]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im Ravmon.exe
    [0x00000b48]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im Mcshield.exe
    [0x00000b50]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im VsTskMgr.exe
    [0x00000b64]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im 360se.exe
    [0x00000b70]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im QQPCRTP.exe
    [0x00000b78]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im QQPCTray.exe
    [0x00000b80]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im QQPCMgr.exe
    [0x00000bb4]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im KMService.exe
    [0x00000cb4]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im AVKproxy.exe
    [0x00000cbc]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im CSS-AVS.exe
    [0x00000cc8]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im nod32kui.exe
    [0x00000d0c]ImagePath = C:\WINDOWS\system32\taskkill.exe, CmdLine = taskkill /f /im GData AntiVirusKit.exe
    行为描述:杀掉进程
    详情信息:TASKKILL = taskkill /f /im kavsvc.exe
    TASKKILL = taskkill /f /im KVXP.kxp
    TASKKILL = taskkill /f /im Rav.exe
    TASKKILL = taskkill /f /im Ravmon.exe
    TASKKILL = taskkill /f /im Mcshield.exe
    TASKKILL = taskkill /f /im VsTskMgr.exe
    TASKKILL = taskkill /f /im 360se.exe
    TASKKILL = taskkill /f /im QQPCRTP.exe
    TASKKILL = taskkill /f /im QQPCTray.exe
    TASKKILL = taskkill /f /im QQPCMgr.exe
    TASKKILL = taskkill /f /im KMService.exe
    TASKKILL = taskkill /f /im AVKproxy.exe
    TASKKILL = taskkill /f /im CSS-AVS.exe
    C:\WINDOWS\system32\RavMon.exe
    TASKKILL = taskkill /f /im nod32kui.exe
    行为描述:创建本地线程
    详情信息:TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2856, ThreadID = 2904, StartAddress = 77E56C7D, Parameter = 000EAC30
    TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2856, ThreadID = 2908, StartAddress = 769AE43B, Parameter = 000ED5D0
    TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2856, ThreadID = 2912, StartAddress = 77E56C7D, Parameter = 000EDD58
    TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2872, ThreadID = 2952, StartAddress = 77E56C7D, Parameter = 000EAC28
    TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2872, ThreadID = 2956, StartAddress = 769AE43B, Parameter = 000ED4A8
    TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2872, ThreadID = 2960, StartAddress = 77E56C7D, Parameter = 000EDC40
    TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2864, ThreadID = 2964, StartAddress = 77E56C7D, Parameter = 000EAC30
    TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2864, ThreadID = 2968, StartAddress = 769AE43B, Parameter = 000ED5D0
    TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2864, ThreadID = 2972, StartAddress = 77E56C7D, Parameter = 000EDD58
    TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2888, ThreadID = 2984, StartAddress = 77E56C7D, Parameter = 000EAC30
    TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2888, ThreadID = 2988, StartAddress = 769AE43B, Parameter = 000ED5D0
    TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2888, ThreadID = 2992, StartAddress = 77E56C7D, Parameter = 000EDD58
    TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2880, ThreadID = 3004, StartAddress = 77E56C7D, Parameter = 000EAC30
    TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2880, ThreadID = 3008, StartAddress = 769AE43B, Parameter = 000ED5D0
    TargetProcess: taskkill.exe, InheritedFromPID = 2628, ProcessID = 2880, ThreadID = 3012, StartAddress = 77E56C7D, Parameter = 000EDC68
    行为描述:跨进程写入数据
    详情信息:TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00010000, Size = 0x000007c2 TargetPID = 0x00000a88
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00020000, Size = 0x00000708 TargetPID = 0x00000a88
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x7ffde010, Size = 0x00000004 TargetPID = 0x00000a88
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00030000, Size = 0x00000184 TargetPID = 0x00000a88
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x7ffde1e8, Size = 0x00000004 TargetPID = 0x00000a88
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00010000, Size = 0x000007c2 TargetPID = 0x00000a78
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00020000, Size = 0x000006ec TargetPID = 0x00000a78
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x7ffdf010, Size = 0x00000004 TargetPID = 0x00000a78
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00030000, Size = 0x00000184 TargetPID = 0x00000a78
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x7ffdf1e8, Size = 0x00000004 TargetPID = 0x00000a78
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00010000, Size = 0x000007c2 TargetPID = 0x00000ab8
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00020000, Size = 0x000006ec TargetPID = 0x00000ab8
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x7ffd5010, Size = 0x00000004 TargetPID = 0x00000ab8
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x00030000, Size = 0x00000184 TargetPID = 0x00000ab8
    TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x7ffd51e8, Size = 0x00000004 TargetPID = 0x00000ab8
    文件行为
    行为描述:创建文件
    详情信息:C:\Documents and Settings\Administrator\Local Settings\%temp%\SkinH_EL.dll
    行为描述:设置特殊文件属性
    详情信息:C:\Documents and Settings\Administrator\Local Settings\%temp%\SkinH_EL.dll
    行为描述:创建可执行文件
    详情信息:C:\Documents and Settings\Administrator\Local Settings\%temp%\SkinH_EL.dll
    行为描述:修改文件内容
    详情信息:C:\Documents and Settings\Administrator\Local Settings\%temp%\SkinH_EL.dll ---> Offset = 0
    行为描述:查找文件
    详情信息:FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\SkinH_EL.dll
    FileName = C:\WINDOWS
    FileName = C:\WINDOWS\system32
    FileName = C:\WINDOWS\system32\taskkill.exe
    注册表行为
    行为描述:修改注册表_组策略
    详情信息:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose
    \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind
    \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
    \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive
    \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop
    \REGISTRY\USER\S-*\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoFavorites
    \REGISTRY\USER\S-*\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoPrinting
    \REGISTRY\USER\S-*\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoBrowserOptions
    \REGISTRY\USER\S-*\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoViewSource
    \REGISTRY\USER\S-*\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoBrowserContextMenu
    行为描述:修改注册表_任务管理器关键属性
    详情信息:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
    行为描述:删除注册表键_安全模式启动项
    详情信息:\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{36FC9E60-C465-11CF-8056-444553540000}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}\
    行为描述:修改注册表_禁用修改IE首页属性
    详情信息:\REGISTRY\USER\S-*\Software\Policies\Microsoft\Internet Explorer\Control Panel\HomePage
    行为描述:修改注册表
    详情信息:\REGISTRY\USER\S-*\Software\Microsoft\Multimedia\DrawDib\vga.drv 1920x973x32(BGR 0)
    \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun
    \REGISTRY\USER\S-*\SoftWare \Microsoft \Windows \CurrentVersion \Policies\WinOldApp\Disabled
    \REGISTRY\MACHINE\SOFTWARE\360Safe\safemon\ExecAccess
    \REGISTRY\MACHINE\SOFTWARE\360Safe\safemon\MonAccess
    \REGISTRY\MACHINE\SOFTWARE\360Safe\safemon\SiteAccess
    \REGISTRY\MACHINE\SOFTWARE\360Safe\safemon\UDiskAccess
    \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
    \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu
    \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Interner Settings\Zones\3\1803
    \REGISTRY\MACHINE\SOFTWARE\Classes\.txt\
    \REGISTRY\MACHINE\SOFTWARE\Classes\.inf\
    \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\
    \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\
    行为描述:修改注册表_禁用CMD 相关属性
    详情信息:\REGISTRY\USER\S-*\Software\Policies\Microsoft\Windows\System\DisableCMD
    行为描述:删除注册表键值
    详情信息:\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{36FC9E60-C465-11CF-8056-444553540000}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}\
    \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}\
    行为描述:修改注册表_禁用注册表编辑器项
    详情信息:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools
    其他行为
    行为描述:创建互斥体
    详情信息:CTF.LBES.MutexDefaultS-*
    CTF.Compart.MutexDefaultS-*
    CTF.Asm.MutexDefaultS-*
    CTF.Layouts.MutexDefaultS-*
    CTF.TMD.MutexDefaultS-*
    CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
    MSCTF.Shared.MUTEX.IOH
    行为描述:创建事件对象
    详情信息:EventName = DINPUTWINMM
    行为描述:打开互斥体
    详情信息:ShimCacheMutex
    行为描述:打开事件
    详情信息:HookSwitchHookEnabledEvent
    CTF.ThreadMIConnectionEvent.000007E8.00000000.0000000F
    CTF.ThreadMarshalInterfaceEvent.000007E8.00000000.0000000F
    MSCTF.SendReceiveConection.Event.IOH.IC
    MSCTF.SendReceive.Event.IOH.IC
    MSFT.VSA.COM.DISABLE.2856
    MSFT.VSA.IEC.STATUS.6c736db0
    MSFT.VSA.COM.DISABLE.2872
    MSFT.VSA.COM.DISABLE.2864
    MSFT.VSA.COM.DISABLE.2888
    MSFT.VSA.COM.DISABLE.2880
    MSFT.VSA.COM.DISABLE.2916
    MSFT.VSA.COM.DISABLE.2896
    MSFT.VSA.COM.DISABLE.2936
    MSFT.VSA.COM.DISABLE.2944
    行为描述:对比可疑进程名
    详情信息:lstrcmpiW: 360se.exe <------> * Des: 360浏览器
    行为描述:查找指定窗口
    详情信息:NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
    NtUserFindWindowEx: [Class,Window] = [,]
    行为描述:枚举窗口
    详情信息:N/A
    行为描述:调整进程token权限
    详情信息:SE_DEBUG_PRIVILEGE
    SE_SYSTEMTIME_PRIVILEGE
    SE_SHUTDOWN_PRIVILEGE
    行为描述:窗口信息
    详情信息:Pid = 2628, Hwnd=0x10344, Text = 按钮, ClassName = Button.
    行为描述:可执行文件签名信息
    详情信息:C:\Documents and Settings\Administrator\Local Settings\%temp%\SkinH_EL.dll(签名验证: 未通过)
    行为描述:关机或重启
    详情信息:N/A
    行为描述:可执行文件MD5
    详情信息:C:\Documents and Settings\Administrator\Local Settings\%temp%\SkinH_EL.dll ---> 147127382e001f495d1842ee7a9e7912
    行为描述:直接获取CPU时钟
    详情信息:EAX = 0x1fc10969, EDX = 0x000000b4
    EAX = 0x1fc109b5, EDX = 0x000000b4
    EAX = 0x1fc10a01, EDX = 0x000000b4
    EAX = 0x1fc10a4d, EDX = 0x000000b4
    EAX = 0x2248d9d6, EDX = 0x000000b4
    EAX = 0x2248da22, EDX = 0x000000b4
    EAX = 0x2248da6e, EDX = 0x000000b4
    EAX = 0x2248daba, EDX = 0x000000b4
    EAX = 0x24fbda36, EDX = 0x000000b4
    EAX = 0x24fbda82, EDX = 0x000000b4
    行为描述:加载新释放的文件
    详情信息:Image: C:\Documents and Settings\Administrator\Local Settings\%temp%\SkinH_EL.dll.
    Activities
    活动名类型
    com.e4a.runtime.android.StartActivityandroid.intent.action.MAIN
    com.e4a.runtime.android.StartActivityandroid.intent.category.DEFAULT
    com.e4a.runtime.android.StartActivityandroid.intent.category.LAUNCHER
    com.e4a.runtime.android.mainActivityandroid.intent.action.MAIN
    com.e4a.runtime.android.mainActivityandroid.intent.category.DEFAULT
    危险函数
    函数名称信息
    android/app/NotificationManager;->notify信息通知栏
    ContentResolver;->query读取联系人、短信等数据库
    权限列表
    许可名称信息
    android.permission.SET_WALLPAPER设置桌面壁纸
    android.permission.GET_TASKS获取有关当前或最近运行的任务信息
    android.permission.PROCESS_OUTGOING_CALLS监视、修改有关拨出电话
    android.permission.WRITE_EXTERNAL_STORAGE写外部存储器(如:SD卡)
    android.permission.ACCESS_WIFI_STATE读取wifi网络状态
    android.permission.ACCESS_COARSE_LOCATION获取粗略的位置(通过wifi、基站)
    android.permission.CALL_PHONE拨打电话
    android.permission.READ_PHONE_STATE读取电话状态
    android.permission.MOUNT_UNMOUNT_FILESYSTEMS挂载、反挂载外部文件系统
    android.permission.CAMERA访问照相机设备
    android.permission.ACCESS_FINE_LOCATION获取精确的位置(通过GPS)
    android.permission.WAKE_LOCK手机屏幕关闭后后台进程仍运行
    android.permission.ACCESS_NETWORK_STATE读取网络状态(2G或3G)
    android.permission.RECORD_AUDIO录音(使用AudioRecord)
    android.permission.FLASHLIGHT访问闪光灯
    com.android.launcher.permission.INSTALL_SHORTCUT创建快捷方式
    android.permission.MODIFY_AUDIO_SETTINGS修改声音设置
    android.permission.DISABLE_KEYGUARD禁用键盘锁
    android.hardware.camera
    android.permission.SYSTEM_ALERT_WINDOW显示系统窗口
    android.permission.MODIFY_PHONE_STATE修改电话状态
    android.permission.INTERNET连接网络(2G或3G)
    android.permission.WRITE_SETTINGS读写系统设置项
    android.permission.CHANGE_WIFI_STATE改变WIFI连接状态
    android.permission.VIBRATE允许设备震动
    com.android.launcher.permission.READ_SETTINGS读取快捷方式信息
    android.permission.READ_CALL_LOG读取通话记录
    android.permission.CHANGE_NETWORK_STATE变更网络状态
    android.permission.CHANGE_CONFIGURATION修改当前设置(如:本地化)
    服务列表
    名称
    com.AiXJ.后台服务操作
    文件列表
    文件名 校验码
    META-INF/MANIFEST.MF 0xb7b45ebd
    META-INF/MYKEY.SF 0xa10df1cf
    META-INF/MYKEY.RSA 0xa6cab2f4
    assets/FileDialog/1.png 0x78686c7a
    assets/FileDialog/2.png 0x7e93bac3
    assets/FileDialog/3.png 0x4608dc7e
    assets/FileDialog/4.png 0xae74269b
    assets/FileDialog/5.png 0x67adec41
    assets/FileDialog/6.png 0xcd055e6c
    assets/FileDialog/7.png 0x446d8c59
    assets/FileDialog/8.png 0x46c0be08
    assets/FileDialog/9.png 0xbdadc5b1
    assets/iflytek/recognize.xml 0x821224ee
    assets/iflytek/voice_bg.9.png 0xcadae20
    assets/iflytek/voice_empty.png 0xd1d92ae2
    assets/iflytek/voice_full.png 0xac0c6930
    assets/iflytek/waiting.png 0xaf422d7f
    assets/iflytek/warning.png 0x3ab21395
    assets/0.gif 0x28b0a5ac
    assets/1.png 0xf664d162
    assets/1116.wav 0x69ebca58
    assets/2.png 0x34fbd0d3
    assets/20.png 0xe54c1607
    assets/37781410922730.png 0xac090f5c
    assets/4.jpg 0x6cd3abc0
    assets/61.png 0xa4a62a48
    assets/62.png 0x24a86c11
    assets/63.png 0x645277f
    assets/72.png 0xfc00d1be
    assets/8.png 0xe2b0bd56
    assets/b1.png 0x593fba4f
    assets/bj.jpg 0x7aec99ad
    assets/bj1.png 0xd420632
    assets/bj2.png 0x40c0a1fb
    assets/bty.png 0xaf68945e
    assets/button.png 0x90d3037
    assets/bz.png 0x8ae1ba78
    assets/cx.png 0xd6b078c4
    assets/dd.png 0xb3f41f08
    assets/f3.png 0x9acd3723
    assets/f32.png 0xcde5a9f6
    assets/fh.png 0x2aee5233
    assets/fh2.png 0xba51909a
    assets/fx.png 0x3062d82d
    assets/fz.png 0x78f7c855
    assets/gl.png 0xb951a482
    assets/gly.png 0xd7063255
    assets/gy.png 0x7e00c46a
    assets/help.png 0xcc580144
    assets/jg.png 0xecee9ecf
    assets/jk.png 0xb47b38a2
    assets/jt.png 0xc3022120
    assets/ka.png 0x988b2538
    assets/ka1.png 0x94a8591f
    assets/left.png 0x3c4cfa83
    assets/pz.png 0x1782cf68
    assets/pz.wav 0xbe49ead3
    assets/right.png 0x93290f8d
    assets/sa.png 0x63c61f8b
    assets/sc.png 0x2c8b2607
    assets/shang.wav 0x34a26c6d
    assets/sxk.png 0x4d9e0942
    assets/sxk1.png 0xd06026a1
    assets/syr.png 0x1d22972d
    assets/tc.png 0x98bc5467
    assets/test.htm 0xe240851f
    assets/ty.png 0xdbabb456
    assets/wlj.png 0xd06caea3
    assets/wu.png 0xda886d0d
    assets/wxzf.jpg 0xb250c5ed
    assets/xia.png 0x6d3f13f3
    assets/xia.wav 0x9035c5d3
    assets/xt2.png 0x6dd0fb5d
    assets/xz.png 0x9650ec9
    assets/ylj.png 0x8dce92cf
    assets/you.png 0xe1a6c1dc
    assets/ys.png 0xb85b6a2e
    assets/ys1.png 0x615734bd
    assets/ysh.png 0xea48e42e
    assets/yz.png 0xb8af6f2
    assets/zfbzf.jpg 0xa0f3c124
    assets/zt.png 0x59781877
    assets/zuo.png 0xfedc0cd8
    res/drawable/b2.png 0x5aec0ca8
    res/drawable/ce.png 0x46b408ec
    res/drawable/cy.png 0x11c80c84
    res/drawable/e4alistview_new_message.png 0x1cdc5409
    res/drawable/g4.png 0x7372dd0b
    res/drawable/icon.png 0x32c049ba
    res/drawable/x3.png 0xe8b792a4
    res/drawable/y1.png 0xb7e83f86
    AndroidManifest.xml 0xe6b40ed8
    resources.arsc 0x2b053f7
    res/drawable-hdpi/qzone_pictureviewer_operation_bg.9.png 0x71e1e03a
    classes.dex 0x56e0bb11
    font_metrics.properties 0x3950ba1a
    org/apache/poi/ss/formula/function/functionMetadata-asGenerated.txt 0x66bf06ef
    org/apache/poi/ss/formula/function/functionMetadata.txt 0x3be068de
    运行截图
    VirSCAN

About VirSCAN | Privacy Policy | Contact us | Links | Help VirSCAN
Translated by Keith Miller, United States
Powered By CentOSpol

京ICP备11007605号-12

pol

京公网安备 11010802020746号