VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.
4, If your browser cannot upload files, please download VirSCAN uploader to upload.

Language
Server load
Server Load

VirSCAN
VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.

File information

Scanner results
Scanner results:0%Antivirus software(0/32)found malware!
Behavior analysis report:         Habo file analysis
Time: 2015-10-12 19:40:37 (CST)
Scanner Engine Ver Sig Ver Sig Date Scan result Time
antiy AVL SDK 3.0 1970-01-01 Found nothing 5
asquared 9.0.0.4324 9.0.0.4324 2014-07-03 Found nothing 1
avast 150725-1 4.7.4 2015-07-25 Found nothing 0
avg 2109/8133 10.0.1405 2014-11-26 Found nothing 0
baidu 2.0.1.0 4.1.3.52192 2.0.1.0 Found nothing 5
baidusd 1.0 1.0 2014-04-02 Found nothing 1
bitdefender 7.58469 7.90123 2014-12-25 Found nothing 0
clamav 19861 0.97.5 2014-12-31 Found nothing 0
drweb 5.0.2.3300 5.0.1.1 2014-12-31 Found nothing 0
fortinet 23.345, 23.345 5.1.158 2014-12-08 Found nothing 0
fprot 4.6.2.117 6.5.1.5418 2014-12-31 Found nothing 0
fsecure 2014-04-02-01 9.13 2014-04-02 Found nothing 0
gdata 25.3828 25.3828 2015-10-12 Found nothing 9
ikarus 1.06.01 V1.32.31.0 2014-12-08 Found nothing 0
jiangmin 16.0.100 1.0.0.0 2015-07-25 Found nothing 39
kaspersky 5.5.33 5.5.33 2014-04-01 Found nothing 0
kingsoft 2.1 2.1 2013-09-22 Found nothing 7
mcafee 7638 5400.1158 2014-11-30 Found nothing 0
nod32 0920 3.0.21 2014-12-23 Found nothing 0
panda 9.05.01 9.05.01 2015-07-26 Found nothing 4
pcc 11.380.07 9.500-1005 2014-12-31 Found nothing 0
qh360 1.0.1 1.0.1 1.0.1 Found nothing 2
qqphone 1.0.0.0 1.0.0.0 2014-12-09 Found nothing 0
quickheal 14.00 14.00 2015-07-25 Found nothing 2
rising 25.76.04.01 25.76.04.01 2015-07-24 Found nothing 1
sophos 5.08 3.55.0 2014-12-01 Found nothing 0
symantec 20141230.001 1.3.0.24 2014-12-30 Found nothing 0
tachyon 9.9.9 9.9.9 2013-12-27 Found nothing 3
thehacker 6.8.0.5 6.8.0.5 2015-07-23 Found nothing 2
tws 17.47.17308 1.0.2.2108 2014-12-08 Found nothing 12
vba 3.12.26.3 3.12.26.3 2014-12-31 Found nothing 0
virusbuster 15.0.985.0 5.5.2.13 2014-12-05 Found nothing 0
权限列表
许可名称 信息
android.permission.CHANGE_COMPONENT_ENABLED_STATE 变更组件状态
android.permission.WRITE_EXTERNAL_STORAGE 写外部存储器(如:SD卡)
android.permission.WRITE_SETTINGS 读写系统设置项
文件信息
VirSCANVirSCAN
安全评分 :
基本信息
VirSCANVirSCAN
MD5:d0b64f9cf3a969f34d8951d878c9f986
文件大小:5.58MB
上传时间: 2014-09-22 10:36:30 (CST)
包名:com.kingsense.bootmanager
最低运行环境:Android 4.0.3, 4.0.4
版权:Android
关键行为
VirSCANVirSCAN
行为描述: 写权限映射文件
详情信息: CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.MarshalInterface.FileMap.IPJ..KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.B.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.C.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.D.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.E.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.F.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.G.KDGIG
MSCTF.Shared.SFM.IPJ
MSCTF.MarshalInterface.FileMap.IPJ.H.FLKMG
MSCTF.MarshalInterface.FileMap.IPJ.I.FLKMG
MSCTF.MarshalInterface.FileMap.IPJ.J.FLKMG
MSCTF.MarshalInterface.FileMap.IPJ.K.FLKMG
MSCTF.MarshalInterface.FileMap.IPJ.L.FMKMG
MSCTF.MarshalInterface.FileMap.IPJ.M.FMKMG
行为描述: 对比可疑进程名
详情信息: stricmp: [System Process] <------> avp.exe 卡巴斯基
lstrcmpiA: System <------> avp.exe 卡巴斯基
lstrcmpiA: smss.exe <------> avp.exe 卡巴斯基
lstrcmpiA: csrss.exe <------> avp.exe 卡巴斯基
lstrcmpiA: winlogon.exe <------> avp.exe 卡巴斯基
lstrcmpiA: services.exe <------> avp.exe 卡巴斯基
lstrcmpiA: lsass.exe <------> avp.exe 卡巴斯基
lstrcmpiA: VBoxService.exe <------> avp.exe 卡巴斯基
lstrcmpiA: 33acthlp.exe <------> avp.exe 卡巴斯基
lstrcmpiA: svchost.exe <------> avp.exe 卡巴斯基
lstrcmpiA: spoolsv.exe <------> avp.exe 卡巴斯基
lstrcmpiA: 33UpgradeHelper.exe <------> avp.exe 卡巴斯基
lstrcmpiA: explorer.exe <------> avp.exe 卡巴斯基
lstrcmpiA: alg.exe <------> avp.exe 卡巴斯基
lstrcmpiA: VBoxTray.exe <------> avp.exe 卡巴斯基
行为描述: 隐藏指定窗口
详情信息: [Window,Class] = [,Afx:400000:8:10011:1900015:0]
行为描述: 创建系统服务
详情信息: [服务创建成功]: DirectX jrq, C:\WINDOWS\system32\ccoecm.exe
行为描述: 按名称获取主机地址
详情信息: 00544.wicp.net
进程行为
VirSCANVirSCAN
行为描述: 写权限映射文件
详情信息: CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.MarshalInterface.FileMap.IPJ..KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.B.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.C.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.D.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.E.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.F.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.G.KDGIG
MSCTF.Shared.SFM.IPJ
MSCTF.MarshalInterface.FileMap.IPJ.H.FLKMG
MSCTF.MarshalInterface.FileMap.IPJ.I.FLKMG
MSCTF.MarshalInterface.FileMap.IPJ.J.FLKMG
MSCTF.MarshalInterface.FileMap.IPJ.K.FLKMG
MSCTF.MarshalInterface.FileMap.IPJ.L.FMKMG
MSCTF.MarshalInterface.FileMap.IPJ.M.FMKMG
行为描述: 对比可疑进程名
详情信息: stricmp: [System Process] <------> avp.exe 卡巴斯基
lstrcmpiA: System <------> avp.exe 卡巴斯基
lstrcmpiA: smss.exe <------> avp.exe 卡巴斯基
lstrcmpiA: csrss.exe <------> avp.exe 卡巴斯基
lstrcmpiA: winlogon.exe <------> avp.exe 卡巴斯基
lstrcmpiA: services.exe <------> avp.exe 卡巴斯基
lstrcmpiA: lsass.exe <------> avp.exe 卡巴斯基
lstrcmpiA: VBoxService.exe <------> avp.exe 卡巴斯基
lstrcmpiA: 33acthlp.exe <------> avp.exe 卡巴斯基
lstrcmpiA: svchost.exe <------> avp.exe 卡巴斯基
lstrcmpiA: spoolsv.exe <------> avp.exe 卡巴斯基
lstrcmpiA: 33UpgradeHelper.exe <------> avp.exe 卡巴斯基
lstrcmpiA: explorer.exe <------> avp.exe 卡巴斯基
lstrcmpiA: alg.exe <------> avp.exe 卡巴斯基
lstrcmpiA: VBoxTray.exe <------> avp.exe 卡巴斯基
行为描述: 隐藏指定窗口
详情信息: [Window,Class] = [,Afx:400000:8:10011:1900015:0]
行为描述: 创建系统服务
详情信息: [服务创建成功]: DirectX jrq, C:\WINDOWS\system32\ccoecm.exe
行为描述: 按名称获取主机地址
详情信息: 00544.wicp.net
文件行为
VirSCANVirSCAN
行为描述: 写权限映射文件
详情信息: CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.MarshalInterface.FileMap.IPJ..KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.B.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.C.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.D.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.E.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.F.KDGIG
MSCTF.MarshalInterface.FileMap.IPJ.G.KDGIG
MSCTF.Shared.SFM.IPJ
MSCTF.MarshalInterface.FileMap.IPJ.H.FLKMG
MSCTF.MarshalInterface.FileMap.IPJ.I.FLKMG
MSCTF.MarshalInterface.FileMap.IPJ.J.FLKMG
MSCTF.MarshalInterface.FileMap.IPJ.K.FLKMG
MSCTF.MarshalInterface.FileMap.IPJ.L.FMKMG
MSCTF.MarshalInterface.FileMap.IPJ.M.FMKMG
行为描述: 创建可执行文件
详情信息: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_4\krnln.fnr
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_4\shell.fne
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Aaron指定IP端口扫描.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\office.exe
C:\WINDOWS\system32\ccoecm.exe
网络行为
VirSCANVirSCAN
行为描述: 发送一个已连接的套接字数据
详情信息: SOCKET = 0x0000013c, TotalSize = 356, Offset = 0, ReadSize = 356.
SOCKET = 0x0000013c, TotalSize = 448, Offset = 0, ReadSize = 448.
SOCKET = 0x0000013c, TotalSize = 451, Offset = 0, ReadSize = 451.
SOCKET = 0x0000013c, TotalSize = 456, Offset = 0, ReadSize = 456.
行为描述: 建立到一个指定的套接字连接
详情信息: 219.133.40.1:11594
行为描述: 按名称获取主机地址
详情信息: 00544.wicp.net
注册表行为
VirSCANVirSCAN
行为描述: 修改注册表
详情信息: \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Multimedia\DrawDib\vga.drv 1920x973x16(565 0)
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\DirectX jrq\Description
其他行为
VirSCANVirSCAN
行为描述: 创建互斥体
详情信息: CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
SHIMLIB_LOG_MUTEX
MSCTF.Shared.MUTEX.AEH
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\office.exe
C:\WINDOWS\system32\ccoecm.exe
00544.wicp.net
MSCTF.Shared.MUTEX.IPJ
行为描述: 隐藏指定窗口
详情信息: [Window,Class] = [,Afx:400000:8:10011:1900015:0]
行为描述: 对比可疑进程名
详情信息: stricmp: [System Process] <------> avp.exe 卡巴斯基
lstrcmpiA: System <------> avp.exe 卡巴斯基
lstrcmpiA: smss.exe <------> avp.exe 卡巴斯基
lstrcmpiA: csrss.exe <------> avp.exe 卡巴斯基
lstrcmpiA: winlogon.exe <------> avp.exe 卡巴斯基
lstrcmpiA: services.exe <------> avp.exe 卡巴斯基
lstrcmpiA: lsass.exe <------> avp.exe 卡巴斯基
lstrcmpiA: VBoxService.exe <------> avp.exe 卡巴斯基
lstrcmpiA: 33acthlp.exe <------> avp.exe 卡巴斯基
lstrcmpiA: svchost.exe <------> avp.exe 卡巴斯基
lstrcmpiA: spoolsv.exe <------> avp.exe 卡巴斯基
lstrcmpiA: 33UpgradeHelper.exe <------> avp.exe 卡巴斯基
lstrcmpiA: explorer.exe <------> avp.exe 卡巴斯基
lstrcmpiA: alg.exe <------> avp.exe 卡巴斯基
lstrcmpiA: VBoxTray.exe <------> avp.exe 卡巴斯基
行为描述: 查找指定窗口
详情信息: NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
行为描述: 启动系统服务
详情信息: [服务启动成功]: LocalSystem, DirectX Remover yta for Windows(R)., C:\WINDOWS\system32\ccoecm.exe
行为描述: 窗口信息
详情信息: Pid = 2548, Hwnd=0x301fc, Text = 更换皮肤, ClassName = Button.
Pid = 2548, Hwnd=0x50258, Text = 梦想网络千人交流群:111850691, ClassName = Afx:400000:b:10011:1900015:0.
Pid = 2548, Hwnd=0x301ca, Text = 线程数:, ClassName = Afx:400000:b:10011:1900015:0.
Pid = 2548, Hwnd=0x30228, Text = Stop, ClassName = Button.
Pid = 2548, Hwnd=0x501ae, Text = 标签, ClassName = Afx:400000:b:10011:1900015:0.
Pid = 2548, Hwnd=0x301d0, Text = Start, ClassName = Button.
Pid = 2548, Hwnd=0x301c6, Text = 65536, ClassName = Edit.
Pid = 2548, Hwnd=0x301c0, Text = Stop port:, ClassName = Afx:400000:b:10011:1900015:0.
Pid = 2548, Hwnd=0x301be, Text = 1, ClassName = Edit.
Pid = 2548, Hwnd=0x40252, Text = Star port:, ClassName = Afx:400000:b:10011:1900015:0.
Pid = 2548, Hwnd=0x40248, Text = 127.0.0.1, ClassName = Edit.
Pid = 2548, Hwnd=0x60240, Text = IP/Domain:, ClassName = Afx:400000:b:10011:1900015:0.
Pid = 2548, Hwnd=0x4020e, Text = Aaron port Test ver 1.0, ClassName = WTWindow.
行为描述: 内联HOOK
详情信息: C:\WINDOWS\system32\GDI32.dll--->ExtTextOutA Offset = 0x0
C:\WINDOWS\system32\GDI32.dll--->ExtTextOutW Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetWindowLongA Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->SetWindowLongA Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->SetWindowLongW Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetWindowLongW Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->BeginPaint Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->EndPaint Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetDC Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetWindowDC Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->ReleaseDC Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->WindowFromDC Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetScrollInfo Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetScrollPos Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetScrollRange Offset = 0x0
行为描述: 创建系统服务
详情信息: [服务创建成功]: DirectX jrq, C:\WINDOWS\system32\ccoecm.exe
动态列表行为
VirSCANVirSCAN
行为描述: 安装失败
详情信息: INSTALL_FAILED_SHARED_USER_INCOMPATIBLE
Activities
VirSCANVirSCAN
活动名 类型
.advance.BootManager android.intent.action.MAIN
.advance.BootManager android.intent.category.LAUNCHER
.advance.BootManager android.intent.category.DEFAULT
.utils.ListAdapter android.intent.action.MAIN
.utils.AppsManagerHelper android.intent.action.MAIN
.activity.HducActivity android.intent.action.MAIN
危险函数
VirSCANVirSCAN
函数名称 信息
ContentResolver;->query 读取联系人、短信等数据库
android/app/NotificationManager;->notify 信息通知栏
启动方式
VirSCANVirSCAN
名称 信息
com.kingsense.bootmanager.advance.BootNotifyReceiver 应用安装时启动服务
权限列表
VirSCANVirSCAN
许可名称 信息
android.permission.CHANGE_COMPONENT_ENABLED_STATE 变更组件状态
android.permission.WRITE_EXTERNAL_STORAGE 写外部存储器(如:SD卡)
android.permission.WRITE_SETTINGS 读写系统设置项
文件列表
VirSCANVirSCAN
文件名 校验码
META-INF/MANIFEST.MF 0x5eed348f
META-INF/CERT.SF 0xc1c39662
META-INF/CERT.RSA 0x7102c42d
res/drawable-xxhdpi/ic_action_notify.png 0xcade7300
res/drawable-xxhdpi/common_div.9.png 0x259558be
res/drawable-xxhdpi/ic_action_apply.png 0xa1444e80
res/layout/listview.xml 0x9ad87c71
res/drawable/common_list_item_background_activated.xml 0xdd85682
resources.arsc 0x29dabbb0
res/drawable-xxhdpi/ic_menu_all.png 0xb0e180f3
classes.dex 0xda3ba454
res/drawable-xxhdpi/list_selector_background_pressed.9.png 0x97e110bb
res/drawable-xxhdpi/ic_menu_debug.png 0x9d17ddd5
res/drawable-xxhdpi/common_notification_on.png 0x7d261615
res/drawable-xxhdpi/ic_launcher.png 0xb0f501ce
res/drawable-xxhdpi/delete.png 0xae68ec5
res/layout/spinner_textview.xml 0xb5a96f1c
AndroidManifest.xml 0xae67b22f
res/layout/bytesdialog.xml 0x886feb4
res/xml/datausagesettings.xml 0xffc7ccec
res/drawable-xxhdpi/ic_menu_info.png 0xf4bf9968
res/drawable-xxhdpi/common_bg_div.9.png 0xdeb799e1
res/layout/list_item_view.xml 0xa51da08
res/drawable/common_list_item_background.xml 0xbe9eeee7
res/drawable-xxhdpi/add.png 0x8f31c6f9
运行截图
VirSCANVirSCAN
VirSCAN