VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.
4, If your browser cannot upload files, please download VirSCAN uploader to upload.

Language
Server load
Server Load

VirSCAN
VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.

File information

Scanner results
Scanner results:3%Antivirus software(1/32)found malware!
Behavior analysis report:         Habo file analysis
Time: 2016-05-03 15:56:01 (CST)
Scanner Engine Ver Sig Ver Sig Date Scan result Time
antiy AVL SDK 3.0 1970-01-01 Found nothing 5
asquared 9.0.0.4324 9.0.0.4324 2014-07-03 Found nothing 1
avast 150725-1 4.7.4 2015-07-25 Found nothing 49
avg 2109/8133 10.0.1405 2014-11-26 Found nothing 6
baidu 2.0.1.0 4.1.3.52192 2.0.1.0 Found nothing 4
baidusd 1.0 1.0 2014-04-02 Found nothing 1
bitdefender 7.58469 7.90123 2014-12-25 Found nothing 1
clamav 19861 0.97.5 2014-12-31 Found nothing 1
drweb 5.0.2.3300 5.0.1.1 2014-12-31 Found nothing 45
fortinet 23.345, 23.345 5.1.158 2014-12-08 Found nothing 1
fprot 4.6.2.117 6.5.1.5418 2014-12-31 Found nothing 4
fsecure 2014-04-02-01 9.13 2014-04-02 Found nothing 30
gdata 25.6438 25.6438 2016-05-02 Found nothing 8
ikarus 1.06.01 V1.32.31.0 2014-12-08 Found nothing 9
jiangmin 16.0.100 1.0.0.0 2015-07-25 Found nothing 36
kaspersky 5.5.33 5.5.33 2014-04-01 Found nothing 30
kingsoft 2.1 2.1 2013-09-22 Android.Troj.at_emial.bw.(kcloud) 4
mcafee 7638 5400.1158 2014-11-30 Found nothing 29
nod32 0920 3.0.21 2014-12-23 Found nothing 1
panda 9.05.01 9.05.01 2015-07-26 Found nothing 3
pcc 11.380.07 9.500-1005 2014-12-31 Found nothing 4
qh360 1.0.1 1.0.1 1.0.1 Found nothing 2
qqphone 1.0.0.0 1.0.0.0 2014-12-09 Found nothing 1
quickheal 14.00 14.00 2015-07-25 Found nothing 2
rising 25.76.04.01 25.76.04.01 2015-07-24 Found nothing 1
sophos 5.08 3.55.0 2014-12-01 Found nothing 11
symantec 20141230.001 1.3.0.24 2014-12-30 Found nothing 1
tachyon 9.9.9 9.9.9 2013-12-27 Found nothing 3
thehacker 6.8.0.5 6.8.0.5 2015-07-23 Found nothing 1
tws 17.47.17308 1.0.2.2108 2014-12-08 Found nothing 13
vba 3.12.26.3 3.12.26.3 2014-12-31 Found nothing 7
virusbuster 15.0.985.0 5.5.2.13 2014-12-05 Found nothing 4
权限列表
许可名称 信息
android.permission.RECEIVE_WAP_PUSH 接收wap push信息
android.permission.RECEIVE_BOOT_COMPLETED 接收开机启动广播
android.permission.MODIFY_AUDIO_SETTINGS 修改声音设置
android.permission.WRITE_EXTERNAL_STORAGE 写外部存储器(如:SD卡)
android.permission.RECEIVE_USER_PRESENT
android.permission.READ_CONTACTS 读取联系人信息
android.permission.INTERNET 连接网络(2G或3G)
android.permission.READ_PHONE_STATE 读取电话状态
android.permission.READ_SMS 读取短信
android.permission.WRITE_SETTINGS 读写系统设置项
android.permission.VIBRATE 允许设备震动
android.permission.RECEIVE_SMS 监控接收短信
android.permission.ACCESS_NETWORK_STATE 读取网络状态(2G或3G)
android.permission.GET_TASKS 获取有关当前或最近运行的任务信息
android.permission.WRITE_SMS 写短信
android.permission.SEND_SMS 发送短信
android.permission.ACCESS_WIFI_STATE 读取wifi网络状态
文件信息
VirSCANVirSCAN
安全评分 :
基本信息
VirSCANVirSCAN
MD5:5e454f0b1974d5a9fde56476537da24b
文件大小:5.58MB
上传时间: 2014-09-22 10:36:30 (CST)
包名:com.qihshish.trlaopoa
最低运行环境:Android 2.2.x
版权:Yougais
关键行为
VirSCANVirSCAN
行为描述: 检测自身是否被调试
详情信息: N/A
行为描述: 获取窗口截图信息
详情信息: Foreground window Info: HWND = 0x00000000, DC = 0x410104a4.
行为描述: 获取TickCount值
详情信息: TickCount = 512753, SleepMilliseconds = 50.
进程行为
VirSCANVirSCAN
行为描述: 检测自身是否被调试
详情信息: N/A
行为描述: 获取窗口截图信息
详情信息: Foreground window Info: HWND = 0x00000000, DC = 0x410104a4.
行为描述: 获取TickCount值
详情信息: TickCount = 512753, SleepMilliseconds = 50.
文件行为
VirSCANVirSCAN
行为描述: 覆盖已有文件
详情信息: C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
行为描述: 修改文件内容
详情信息: C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT ---> Offset = 4096
行为描述: 查找文件
详情信息: FileName = C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
FileName = C:\WINDOWS\Microsoft.NET\Framework\\*
FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.INI
FileName = C:\Documents and Settings\Administrator\Local Settings\Temp
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\1461229213.346503.exe
FileName = C:\Documents and Settings
FileName = C:\Documents and Settings\Administrator
FileName = C:\Documents and Settings\Administrator\Local Settings
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\996E.INI
FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.INI
FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.INI
FileName = C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
其他行为
VirSCANVirSCAN
行为描述: 检测自身是否被调试
详情信息: N/A
行为描述: 创建互斥体
详情信息: CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
MSCTF.Shared.MUTEX.ELH
MSCTF.Shared.MUTEX.IEB
行为描述: 隐藏指定窗口
详情信息: [Window,Class] = [Microsoft .NET Framework,WindowsForms10.Window.8.app.0.2bf8098_r19_ad1]
行为描述: 查找指定窗口
详情信息: NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
行为描述: 获取TickCount值
详情信息: TickCount = 512753, SleepMilliseconds = 50.
行为描述: 窗口信息
详情信息: Pid = 1868, Hwnd=0x202d8, Text = Unhandled exception has occurred in a component in your application. If you click Continue, the application will ignore this erro, ClassName = WindowsForms10.STATIC.app.0.2bf8098_r19_ad1.
Pid = 1868, Hwnd=0x202c8, Text = &Details, ClassName = WindowsForms10.BUTTON.app.0.2bf8098_r19_ad1.
Pid = 1868, Hwnd=0x202ca, Text = &Continue, ClassName = WindowsForms10.BUTTON.app.0.2bf8098_r19_ad1.
Pid = 1868, Hwnd=0x202c6, Text = See the end of this message for details on invoking just-in-time (JIT) debugging instead of this dialog box. ************** , ClassName = WindowsForms10.EDIT.app.0.2bf8098_r19_ad1.
Pid = 1868, Hwnd=0x202c2, Text = Microsoft .NET Framework, ClassName = WindowsForms10.Window.8.app.0.2bf8098_r19_ad1.
行为描述: 获取窗口截图信息
详情信息: Foreground window Info: HWND = 0x00000000, DC = 0x410104a4.
行为描述: 创建事件对象
详情信息: EventName = Global\CPFATE_1868_v4.0.30319
EventName = MSCTF.SendReceive.Event.IEB.IC
EventName = MSCTF.SendReceiveConection.Event.IEB.IC
Activities
VirSCANVirSCAN
活动名 类型
com.phone2.stop.activity.MainActivity android.intent.action.MAIN
com.phone2.stop.activity.MainActivity android.intent.category.LAUNCHER
com.phone2.stop.activity.DeleteActivity android.intent.action.DELETE
com.phone2.stop.activity.DeleteActivity android.intent.category.DEFAULT
危险函数
VirSCANVirSCAN
函数名称 信息
TelephonyManager;->getDeviceId 搜集用户手机IMEI码、电话号码、系统版本号等信息
java/net/URL;->openConnection 连接URL
ActivityManager;->killBackgroundProcesses 中断进程,可用于关闭杀软
启动方式
VirSCANVirSCAN
名称 信息
com.phone.stop.receiver.BootReceiver 开机启动服务
com.phone.stop.receiver.SMSReceiver 监控短信(收到短信)启动服务
com.phone.stop.receiver.MyDeviceAdminReceiver
权限列表
VirSCANVirSCAN
许可名称 信息
android.permission.RECEIVE_WAP_PUSH 接收wap push信息
android.permission.RECEIVE_BOOT_COMPLETED 接收开机启动广播
android.permission.MODIFY_AUDIO_SETTINGS 修改声音设置
android.permission.WRITE_EXTERNAL_STORAGE 写外部存储器(如:SD卡)
android.permission.RECEIVE_USER_PRESENT
android.permission.READ_CONTACTS 读取联系人信息
android.permission.INTERNET 连接网络(2G或3G)
android.permission.READ_PHONE_STATE 读取电话状态
android.permission.READ_SMS 读取短信
android.permission.WRITE_SETTINGS 读写系统设置项
android.permission.VIBRATE 允许设备震动
android.permission.RECEIVE_SMS 监控接收短信
android.permission.ACCESS_NETWORK_STATE 读取网络状态(2G或3G)
android.permission.GET_TASKS 获取有关当前或最近运行的任务信息
android.permission.WRITE_SMS 写短信
android.permission.SEND_SMS 发送短信
android.permission.ACCESS_WIFI_STATE 读取wifi网络状态
服务列表
VirSCANVirSCAN
名称
com.phone.stop6.service.SecondService
com.phone.stop6.service.BootService
com.phone.stop6.service.SmsService
文件列表
VirSCANVirSCAN
文件名 校验码
META-INF/MANIFEST.MF 0x3da0b8c3
META-INF/OKCHI.SF 0xb631f5f1
META-INF/OKCHI.RSA 0xe00290c6
META-INF/ 0x0
AndroidManifest.xml 0x1ca04cc9
assets/ 0x0
assets/clazz.jar 0x4073f3ac
assets/data.db 0xe8757586
assets/libnesec.so 0x829d1e5e
assets/libsecert.so 0x8f38ff66
classes.dex 0x29a7bb17
com/ 0x0
com/sun/ 0x0
com/sun/mail/ 0x0
com/sun/mail/dsn/ 0x0
com/sun/mail/dsn/mailcap 0x7605dc17
dsn.mf 0x1e4e9355
javamail.charset.map 0xad0dfcee
javamail.default.address.map 0xf20496b
javamail.default.providers 0x45ea1b21
javamail.imap.provider 0x8934555a
javamail.pop3.provider 0xa23c9bc
javamail.smtp.address.map 0xf20496b
javamail.smtp.provider 0x990c469d
lib/ 0x0
lib/armeabi/ 0x0
lib/armeabi/libbugrpt.so 0x32b53003
lib/armeabi/libnesec.so 0x112a8506
mailcap 0xd7759e43
mailcap.default 0x6f616b6
mimetypes.default 0x97dd5cdb
org/ 0x0
org/apache/ 0x0
org/apache/harmony/ 0x0
org/apache/harmony/awt/ 0x0
org/apache/harmony/awt/internal/ 0x0
org/apache/harmony/awt/internal/nls/ 0x0
org/apache/harmony/awt/internal/nls/messages.properties 0x5f88eb12
res/ 0x0
res/drawable-hdpi/ 0x0
res/drawable-hdpi/app_logo.png 0xf067acc5
res/drawable-hdpi/icon.png 0xac8b5a00
res/layout/ 0x0
res/layout/activity_aa.xml 0x60332653
res/layout/activity_main.xml 0x19203b2e
res/xml/ 0x0
res/xml/devicepolicymanager_permission.xml 0xeab2c16b
resources.arsc 0xc100ba12
运行截图
VirSCANVirSCAN
VirSCAN