VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.
4, If your browser cannot upload files, please download VirSCAN uploader to upload.

Language
Server load
Server Load

VirSCAN
VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.

File information

Scanner results
Scanner results:6%Antivirus software(2/32)found malware!
Behavior analysis report:         Habo file analysis
Time: 2016-05-31 01:26:53 (CST)
Scanner Engine Ver Sig Ver Sig Date Scan result Time
antiy AVL SDK 3.0 1970-01-01 Found nothing 5
asquared 9.0.0.4324 9.0.0.4324 2014-07-03 Found nothing 2
avast 150725-1 4.7.4 2015-07-25 Found nothing 60
avg 2109/8133 10.0.1405 2014-11-26 Found nothing 60
baidu 2.0.1.0 4.1.3.52192 2.0.1.0 Found nothing 4
baidusd 1.0 1.0 2014-04-02 Found nothing 1
bitdefender 7.58469 7.90123 2014-12-25 Found nothing 60
clamav 19861 0.97.5 2014-12-31 Found nothing 60
drweb 5.0.2.3300 5.0.1.1 2014-12-31 Found nothing 60
fortinet 23.345, 23.345 5.1.158 2014-12-08 Found nothing 60
fprot 4.6.2.117 6.5.1.5418 2014-12-31 Found nothing 60
fsecure 2014-04-02-01 9.13 2014-04-02 Found nothing 60
gdata 25.6761 25.6761 2016-05-30 Android.Trojan.Agent.FK 9
ikarus 1.06.01 V1.32.31.0 2014-12-08 Found nothing 60
jiangmin 16.0.100 1.0.0.0 2015-07-25 Found nothing 42
kaspersky 5.5.33 5.5.33 2014-04-01 Found nothing 60
kingsoft 2.1 2.1 2013-09-22 Android.Troj.at_PornClk.a.(kcloud) 5
mcafee 7638 5400.1158 2014-11-30 Found nothing 60
nod32 0920 3.0.21 2014-12-23 Found nothing 60
panda 9.05.01 9.05.01 2015-07-26 Found nothing 4
pcc 11.380.07 9.500-1005 2014-12-31 Found nothing 60
qh360 1.0.1 1.0.1 1.0.1 Found nothing 2
qqphone 1.0.0.0 1.0.0.0 2014-12-09 Found nothing 60
quickheal 14.00 14.00 2015-07-25 Found nothing 2
rising 25.76.04.01 25.76.04.01 2015-07-24 Found nothing 1
sophos 5.08 3.55.0 2014-12-01 Found nothing 60
symantec 20141230.001 1.3.0.24 2014-12-30 Found nothing 60
tachyon 9.9.9 9.9.9 2013-12-27 Found nothing 5
thehacker 6.8.0.5 6.8.0.5 2015-07-23 Found nothing 2
tws 17.47.17308 1.0.2.2108 2014-12-08 Found nothing 14
vba 3.12.26.3 3.12.26.3 2014-12-31 Found nothing 60
virusbuster 15.0.985.0 5.5.2.13 2014-12-05 Found nothing 60
权限列表
许可名称 信息
android.permission.CAMERA 访问照相机设备
android.permission.FLASHLIGHT 访问闪光灯
android.permission.DISABLE_KEYGUARD 禁用键盘锁
android.permission.ACCESS_WIFI_STATE 读取wifi网络状态
android.permission.SYSTEM_ALERT_WINDOW 显示系统窗口
android.permission.READ_PHONE_STATE 读取电话状态
android.permission.ACCESS_NETWORK_STATE 读取网络状态(2G或3G)
android.permission.WRITE_EXTERNAL_STORAGE 写外部存储器(如:SD卡)
android.permission.INTERNET 连接网络(2G或3G)
android.permission.GET_TASKS 获取有关当前或最近运行的任务信息
android.permission.SEND_SMS 发送短信
android.permission.READ_SMS 读取短信
android.permission.RECEIVE_MMS 接收彩信
android.permission.RECEIVE_SMS 监控接收短信
android.permission.CHANGE_WIFI_STATE 改变WIFI连接状态
android.permission.CHANGE_NETWORK_STATE 变更网络状态
android.permission.WRITE_APN_SETTINGS 改写APN设置(如:cmwap)
android.permission.RESTART_PACKAGES 重启其他程序
android.permission.BROADCAST_STICKY 发送持久广播
android.permission.GET_ACCOUNTS 访问账户列表
android.permission.WRITE_SETTINGS 读写系统设置项
android.permission.READ_LOGS 读取系统日志
android.permission.WRITE_SMS 写短信
android.permission.MOUNT_UNMOUNT_FILESYSTEMS 挂载、反挂载外部文件系统
文件信息
VirSCANVirSCAN
安全评分 :
基本信息
VirSCANVirSCAN
MD5:a97e9b6fd83227e8c6b492ffbcba4df5
文件大小:5.58MB
上传时间: 2014-09-22 10:36:30 (CST)
包名:com.android.oil0526
最低运行环境:Android 2.2.x
版权:beijing
关键行为
VirSCANVirSCAN
行为描述: 跨进程写入数据
详情信息: TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x00400000, Size = 0x00001000
TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x005df000, Size = 0x0019e800
TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x0077e000, Size = 0x00006a00
TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x7ffde008, Size = 0x00000004
行为描述: 获取TickCount值
详情信息: TickCount = 1085072, SleepMilliseconds = 5041.
TickCount = 1085103, SleepMilliseconds = 5041.
TickCount = 1085916, SleepMilliseconds = 5041.
TickCount = 1087900, SleepMilliseconds = 5041.
进程行为
VirSCANVirSCAN
行为描述: 跨进程写入数据
详情信息: TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x00400000, Size = 0x00001000
TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x005df000, Size = 0x0019e800
TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x0077e000, Size = 0x00006a00
TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x7ffde008, Size = 0x00000004
行为描述: 获取TickCount值
详情信息: TickCount = 1085072, SleepMilliseconds = 5041.
TickCount = 1085103, SleepMilliseconds = 5041.
TickCount = 1085916, SleepMilliseconds = 5041.
TickCount = 1087900, SleepMilliseconds = 5041.
文件行为
VirSCANVirSCAN
行为描述: 创建文件
详情信息: C:\WINDOWS\system32\SysimtmS.db
C:\WINDOWS\system32\配置.db
C:\WINDOWS\system32\Skin.jpg
行为描述: 覆盖已有文件
详情信息: C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
行为描述: 删除文件
详情信息: C:\WINDOWS\system32\Skin.jpg
行为描述: 修改文件内容
详情信息: C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT ---> Offset = 0
C:\WINDOWS\system32\SysimtmS.db ---> Offset = 0
C:\WINDOWS\system32\配置.db ---> Offset = 0
C:\WINDOWS\system32\Skin.jpg ---> Offset = 0
C:\WINDOWS\system32\配置.db ---> Offset = 1294
C:\WINDOWS\system32\配置.db ---> Offset = 40
C:\WINDOWS\system32\配置.db ---> Offset = 57
C:\WINDOWS\system32\配置.db ---> Offset = 26
C:\WINDOWS\system32\配置.db ---> Offset = 37
C:\WINDOWS\system32\配置.db ---> Offset = 68
C:\WINDOWS\system32\配置.db ---> Offset = 85
C:\WINDOWS\system32\配置.db ---> Offset = 96
C:\WINDOWS\system32\配置.db ---> Offset = 113
C:\WINDOWS\system32\配置.db ---> Offset = 124
C:\WINDOWS\system32\配置.db ---> Offset = 141
行为描述: 查找文件
详情信息: FileName = C:\WINDOWS
FileName = C:\WINDOWS\system32
FileName = C:\WINDOWS\system32\cmd.exe
FileName = C:\WINDOWS\system32\配置.db
FileName = C:\WINDOWS\system32\NOTEPAD.exe
FileName = C:\WINDOWS\system32\notepad.exe
FileName = C:\WINDOWS\system32\使用教程与更新说明.txt
FileName = \ggwar3.dll
注册表行为
VirSCANVirSCAN
行为描述: 修改注册表
详情信息: \REGISTRY\USER\S-*\Software\Microsoft\Direct3D\MostRecentApplication\Name
其他行为
VirSCANVirSCAN
行为描述: 创建互斥体
详情信息: CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
DDrawWindowListMutex
__DDrawExclMode__
__DDrawCheckExclMode__
MSCTF.Shared.MUTEX.ELH
行为描述: 创建事件对象
详情信息: EventName = DINPUTWINMM
EventName = CQQAASASDASDhina ..AAASSSQQQQSDDDDDDQQ WWWWWWWWWWWWWWW
行为描述: 查找指定窗口
详情信息: NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [,Tre Hack 最终版本.exe]
行为描述: 枚举窗口
详情信息: N/A
行为描述: 获取TickCount值
详情信息: TickCount = 1085072, SleepMilliseconds = 5041.
TickCount = 1085103, SleepMilliseconds = 5041.
TickCount = 1085916, SleepMilliseconds = 5041.
TickCount = 1087900, SleepMilliseconds = 5041.
行为描述: 调整进程token权限
详情信息: SE_DEBUG_PRIVILEGE
SE_INC_BASE_PRIORITY_PRIVILEGE
行为描述: 窗口信息
详情信息: Pid = 124, Hwnd=0x70338, Text = 是(&Y), ClassName = Button.
Pid = 124, Hwnd=0xa0300, Text = 否(&N), ClassName = Button.
Pid = 124, Hwnd=0x29031a, Text = 是否使用注入系统模式运行本程序?(网吧和Windows7用户推荐使用) 如果你能正常使用外挂,就不需要点是了, ClassName = Static.
Pid = 124, Hwnd=0x80326, Text = 信息:, ClassName = #32770.
行为描述: 调用Sleep函数
详情信息: [1]: MilliSeconds = 5041.
[2]: MilliSeconds = 5041.
[3]: MilliSeconds = 5041.
[4]: MilliSeconds = 5041.
[5]: MilliSeconds = 5041.
行为描述: 隐藏指定窗口
详情信息: [Window,Class] = [,Afx:400000:b:10011:1900015:0]
[Window,Class] = [,Afx:400000:b:10011:0:0]
[Window,Class] = [&数&字&显&移&数,Button]
[Window,Class] = [标签,Afx:400000:b:10011:1900015:0]
[Window,Class] = [&数&字&显&攻速,Button]
[Window,Class] = [,Afx:400000:8:10011:1900015:0]
[Window,Class] = [执&行&易&语&言BUG,Button]
[Window,Class] = [,WTWindow]
[Window,Class] = [,浩方电竞平台]
[Window,Class] = [宽,Afx:400000:b:10011:1900015:0]
[Window,Class] = [高,Afx:400000:b:10011:1900015:0]
[Window,Class] = [,ComboLBox]
[Window,Class] = [,VS]
Activities
VirSCANVirSCAN
活动名 类型
com.android.oil0526.MainActivity android.intent.action.MAIN
com.android.oil0526.MainActivity android.intent.category.LAUNCHER
危险函数
VirSCANVirSCAN
函数名称 信息
TelephonyManager;->getDeviceId 搜集用户手机IMEI码、电话号码、系统版本号等信息
java/net/URL;->openConnection 连接URL
HttpClient;->execute 请求远程服务器
DefaultHttpClient;->execute 发送HTTP请求
SmsManager;->sendMultipartTextMessage 发送彩信
SmsManager;->sendTextMessage 发送普通短信
ContentResolver;->query 读取联系人、短信等数据库
ContentResolver;->delete 删除短信、联系人
TelephonyManager;->getSimSerialNumber 获取SIM序列号
Camera;->open 开启相机
SmsManager;->sendDataMessage 发送二进制消息
java/net/HttpURLConnection;->connect 连接URL
WifiManager;->setWifiEnabled 变更WIFI状态
TelephonyManager;->getLine1Number 获取手机号
启动方式
VirSCANVirSCAN
名称 信息
com.sdky.pay.service.SmsPushReceiver 监控短信(收到短信)启动服务
com.sdky.pay.service.SmsPushReceiver
com.sdky.pay.service.ConnectivityReceiver 网络连接改变时启动服务
com.android.rev.MRecevier 监控短信(收到短信)启动服务
com.android.rev.MRecevier
com.android.rev.SendLogReceiver
com.android.rev.ConnectionChangeReceiver 网络连接改变时启动服务
com.android.rev.ConnectionChangeReceiver 屏幕解锁启动服务
com.android.rev.ConnectionChangeReceiver
com.android.rev.ConnectionChangeReceiver
com.an.gb.RecevierW 监控短信(收到短信)启动服务
com.an.gb.RecevierW
com.an.gb.LogRecew
com.an.gb.ConReceiverw 网络连接改变时启动服务
com.an.gb.ConReceiverw 屏幕解锁启动服务
权限列表
VirSCANVirSCAN
许可名称 信息
android.permission.CAMERA 访问照相机设备
android.permission.FLASHLIGHT 访问闪光灯
android.permission.DISABLE_KEYGUARD 禁用键盘锁
android.permission.ACCESS_WIFI_STATE 读取wifi网络状态
android.permission.SYSTEM_ALERT_WINDOW 显示系统窗口
android.permission.READ_PHONE_STATE 读取电话状态
android.permission.ACCESS_NETWORK_STATE 读取网络状态(2G或3G)
android.permission.WRITE_EXTERNAL_STORAGE 写外部存储器(如:SD卡)
android.permission.INTERNET 连接网络(2G或3G)
android.permission.GET_TASKS 获取有关当前或最近运行的任务信息
android.permission.SEND_SMS 发送短信
android.permission.READ_SMS 读取短信
android.permission.RECEIVE_MMS 接收彩信
android.permission.RECEIVE_SMS 监控接收短信
android.permission.CHANGE_WIFI_STATE 改变WIFI连接状态
android.permission.CHANGE_NETWORK_STATE 变更网络状态
android.permission.WRITE_APN_SETTINGS 改写APN设置(如:cmwap)
android.permission.RESTART_PACKAGES 重启其他程序
android.permission.BROADCAST_STICKY 发送持久广播
android.permission.GET_ACCOUNTS 访问账户列表
android.permission.WRITE_SETTINGS 读写系统设置项
android.permission.READ_LOGS 读取系统日志
android.permission.WRITE_SMS 写短信
android.permission.MOUNT_UNMOUNT_FILESYSTEMS 挂载、反挂载外部文件系统
服务列表
VirSCANVirSCAN
名称
ibz.gryf.vqcqn
mebsz.eraq.rbt
com.dhs.zlia.e
com.android.tools.ss.SHMainService
com.an.se.ServiceW
文件列表
VirSCANVirSCAN
文件名 校验码
assets/Z.dat 0xefa92a18
res/anim/tween_ani.xml 0x262036ff
res/layout/activity_main.xml 0x95784fa1
res/layout/notification.xml 0x420db1d4
res/menu/main.xml 0x8b0c8001
res/raw/click.ogg 0x850fe573
res/raw/turnon.mp3 0xb995d2d1
AndroidManifest.xml 0xe09d2426
resources.arsc 0x7ef99125
res/drawable-hdpi/ic_launcher.png 0xf248df62
res/drawable-hdpi/icon.png 0xccbf4386
res/drawable-hdpi/off.png 0x563290f1
res/drawable-hdpi/on.png 0x61913557
res/drawable-mdpi/ic_launcher.png 0x6a84dfd9
res/drawable-xhdpi/ic_launcher.png 0xa227fc8a
res/drawable-xxhdpi/ic_launcher.png 0x2a4a99d1
classes.dex 0xc17e3b2a
assets/kq 0xefc2bd7
com/sdky/pay/jsoup/nodes/entities-base.properties 0xa436299f
com/sdky/pay/jsoup/nodes/entities-full.properties 0x98e43a72
com/unicom/wounipaysms/dialog/images/cancel.png 0x7776da75
com/unicom/wounipaysms/dialog/images/cancel_on.png 0xf1a57848
com/unicom/wounipaysms/dialog/images/confirm_bt.9.png 0x7bc4247c
com/unicom/wounipaysms/dialog/images/confirm_bt_on.9.png 0xdde3453f
com/unicom/wounipaysms/dialog/images/main_bg.9.png 0x4c73d498
com/unicom/wounipaysms/dialog/images/unicom.png 0xd42c0d01
com/unicom/wounipaysms/dialog/images/verify_et.9.png 0x327c3939
com/unicom/wounipaysms/dialog/images/woreader.png 0xfde734da
assets/dialog_bg.png 0x2da39f6b
assets/de.txt 0x9567b697
assets/data.txt 0x9567b697
assets/dfmz.txt 0x9567b697
lib/armeabi/libcryptooperad.so 0xa6b4f640
lib/armeabi/libzmojv.so 0xe7ca644e
lib/armeabi-v7a/libcryptooperad.so 0x9fa65671
lib/armeabi-v7a/libzmojv.so 0xcd36937a
lib/mips/libzmojv.so 0x6ca2f971
lib/x86/libzmojv.so 0x7c9fbe1d
META-INF/MANIFEST.MF 0xb7522721
META-INF/CERT.SF 0x444b4572
META-INF/CERT.RSA 0x833d4c62
运行截图
VirSCANVirSCAN
VirSCAN