好友
阅读权限30
听众
最后登录1970-1-1
|
使用论坛附件上传样本压缩包时必须使用压缩密码保护,压缩密码:52pojie,否则会导致论坛被杀毒软件等误报,论坛有权随时删除相关附件和帖子! 病毒分析分区附件样本、网址谨慎下载点击,可能对计算机产生破坏,仅供安全人员在法律允许范围内研究,禁止非法用途! 禁止求非法渗透测试、非法网络攻击、获取隐私等违法内容,即使对方是非法内容,也应向警方求助!
MD5: | cfc37eb89e19de422eb6ef52fff8ba09
|
关键行为行为描述: | 直接调用系统关键API | 详情信息: | Index = 0x0000009A, Name: NtQueryInformationProcess, Instruction Address = 0x00BFB75EIndex = 0x000000E5, Name: NtSetInformationThread, Instruction Address = 0x010EC144Index = 0x00000074, Name: NtOpenFile, Instruction Address = 0x00BFB75EIndex = 0x00000032, Name: NtCreateSection, Instruction Address = 0x01086C01Index = 0x0000006C, Name: NtMapViewOfSection, Instruction Address = 0x00B15BBAIndex = 0x0000010B, Name: NtUnmapViewOfSection, Instruction Address = 0x00BCAA46Index = 0x00000019, Name: NtClose, Instruction Address = 0x00BCAA46Index = 0x00000019, Name: NtClose, Instruction Address = 0x01086C01Index = 0x00000089, Name: NtProtectVirtualMemory, Instruction Address = 0x01086C01 | 行为描述: | 直接获取CPU时钟 | 详情信息: | EAX = 0xa6f793d5, EDX = 0x000000b9EAX = 0xa6f79421, EDX = 0x000000b9EAX = 0xac3262da, EDX = 0x000000b9EAX = 0xac326326, EDX = 0x000000b9EAX = 0xb16d31df, EDX = 0x000000b9EAX = 0xb16d322b, EDX = 0x000000b9EAX = 0xb16d3277, EDX = 0x000000b9EAX = 0xb16d32c3, EDX = 0x000000b9EAX = 0xb16d330f, EDX = 0x000000b9EAX = 0xb16d335b, EDX = 0x000000b9 | 行为描述: | VMWare特殊指令检测虚拟机 | 详情信息: | N/A |
进程行为
[url=]更多>>[/url]
其他行为
- 直接调用系统关键API
- 检测自身是否被调试
- 创建互斥体
- 创建事件对象
- 打开互斥体
- 查找指定窗口
- 打开事件
- 搜索kernel32.dll基地址
- 窗口信息
- 调用Sleep函数
- 直接获取CPU时钟
- VMWare特殊指令检测虚拟机
[url=]更多>>[/url] |
|
发帖前要善用【论坛搜索】功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。 |
|
|
|
|