火眼 :
http://xp.gd/eUB virscan:
http://xp.gd/eUCMD5:35283a82492de3d256e3c2933be7eb3d
Sha-1:d3cb1af3a16918d0caa1c3487c7e1b18bfe978f6
文件大小:1.18MB
创建时间:2014-06-26 21:46:30
文件类型:ZIP
PEID信息:Not a valid PE file
火眼点评
inline hook 自身进程;搜索指定窗口;查找反病毒常用工具窗口,常被病毒或外挂用于反调试
其他行为监控
行为描述:查找反病毒常用工具窗口,常被病毒或外挂用于反调试
附加信息:["" , "File Monitor - Sysinternals:
www.sysinternals.com"]["" , "Process Monitor - Sysinternals:
www.sysinternals.com"]["" , "Registry Monitor - Sysinternals:
www.sysinternals.com"]["18467-41" , ""]["FilemonClass" , ""]["Filemonclass" , ""]["GBDYLLO" , ""]["OLLYDBG" , ""]["PROCMON_WINDOW_CLASS" , ""]["RegmonClass" , ""]["pediy06" , ""]
行为描述:搜索指定窗口
附加信息:["Regmonclass" , ""]
行为描述:inline hook 自身进程
附加信息:地图全白长期稳定可用.exe ntdll.dll!DbgUiRemoteBreakin Ordinal: 36 HookType: InlineHook GDI32.dll!ExtTextOutA Ordinal: 222 HookType: InlineHook GDI32.dll!ExtTextOutW Ordinal: 223 HookType: InlineHook USER32.dll!BeginPaint Ordinal: 14 HookType: InlineHook USER32.dll!EnableScrollBar Ordinal: 196 HookType: InlineHook USER32.dll!EndPaint Ordinal: 201 HookType: InlineHook USER32.dll!GetDC Ordinal: 269 HookType: InlineHook USER32.dll!GetScrollBarInfo Ordinal: 341 HookType: InlineHook USER32.dll!GetScrollInfo Ordinal: 342 HookType: InlineHook USER32.dll!GetScrollPos Ordinal: 343 HookType: InlineHook USER32.dll!GetScrollRange Ordinal: 344 HookType: InlineHook USER32.dll!GetWindowDC Ordinal: 365 HookType: InlineHook USER32.dll!GetWindowLongA Ordinal: 367 HookType: InlineHook USER32.dll!GetWindowLongW Ordinal: 368 HookType: InlineHook USER32.dll!ReleaseDC Ordinal: 555 HookType: InlineHook USER32.dll!SetScrollInfo Ordinal: 623 HookType: InlineHook USER32.dll!SetScrollPos Ordinal: 624 HookType: InlineHook USER32.dll!SetScrollRange Ordinal: 625 HookType: InlineHook USER32.dll!SetWindowLongA Ordinal: 641 HookType: InlineHook USER32.dll!SetWindowLongW Ordinal: 642 HookType: InlineHook USER32.dll!SetWindowRgn Ordinal: 645 HookType: InlineHook USER32.dll!WindowFromDC Ordinal: 725 HookType: InlineHook
新增删除修改 注册表监控
HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib
[vga.drv 1024x768x32(BGR 0)] = [31,31,31,31]
扫描结果:0%的杀软(0/38)报告发现病毒
时间: 2014-06-26 22:31:54 (CST)