附件:
您所在的用户组无法下载或查看附件解压密码：virus
文件 1.exe 接收于 2008.08.27 04:25:13 (CET)
| 反病毒引擎 | 版本 | 最后更新 | 扫描结果 |
| AhnLab-V3 | 2008.8.21.0 | 2008.08.26 | Win-Trojan/Downloader.79810 |
| AntiVir | 7.8.1.23 | 2008.08.26 | TR/Agent.75264.7 |
| Authentium | 5.1.0.4 | 2008.08.27 | W32/Downloader.C.gen!Eldorado |
| Avast | 4.8.1195.0 | 2008.08.26 | Win32:Agent-XJP |
| AVG | 8.0.0.161 | 2008.08.26 | BackDoor.Generic9.ALQF |
| BitDefender | 7.2 | 2008.08.27 | Dropped:Backdoor.Generic.47110 |
| CAT-QuickHeal | 9.50 | 2008.08.26 | Trojan.Small.bff |
| ClamAV | 0.93.1 | 2008.08.27 | Trojan.Delf-5552 |
| DrWeb | 4.44.0.09170 | 2008.08.26 | BackDoor.Dgrat |
| eSafe | 7.0.17.0 | 2008.08.26 | - |
| eTrust-Vet | 31.6.6050 | 2008.08.26 | - |
| Ewido | 4.0 | 2008.08.26 | Trojan.Small.bff |
| F-Prot | 4.4.4.56 | 2008.08.26 | W32/Downloader.C.gen!Eldorado |
| F-Secure | 7.60.13501.0 | 2008.08.27 | Trojan.Win32.Small.bff |
| Fortinet | 3.14.0.0 | 2008.08.26 | DelpDldr.B |
| GData | 19 | 2008.08.27 | Trojan.Win32.Small.bff |
| Ikarus | T3.1.1.34.0 | 2008.08.27 | Trojan.Agent.75264.7 |
| K7AntiVirus | 7.10.428 | 2008.08.25 | Backdoor.Win32.Delf.hzq |
| Kaspersky | 7.0.0.125 | 2008.08.27 | Trojan.Win32.Small.bff |
| McAfee | 5370 | 2008.08.26 | - |
| Microsoft | 1.3807 | 2008.08.25 | Backdoor:Win32/Delf.ADI |
| NOD32v2 | 3390 | 2008.08.26 | Win32/Small.BFF |
| Norman | 5.80.02 | 2008.08.26 | W32/Delf.BWZO.dropper |
| Panda | 9.0.0.4 | 2008.08.26 | Trj/Small.YT |
| PCTools | 4.4.2.0 | 2008.08.26 | - |
| Rising | 20.59.11.00 | 2008.08.26 | - |
| Sophos | 4.32.0 | 2008.08.27 | Mal/DelpDldr-B |
| Sunbelt | 3.1.1582.1 | 2008.08.26 | - |
| Symantec | 10 | 2008.08.27 | - |
| TheHacker | 6.3.0.6.060 | 2008.08.23 | - |
| TrendMicro | 8.700.0.1004 | 2008.08.26 | - |
| VBA32 | 3.12.8.4 | 2008.08.26 | Backdoor.Win32.Delf.hzq |
| ViRobot | 2008.8.26.1350 | 2008.08.26 | - |
| VirusBuster | 4.5.11.0 | 2008.08.26 | - |
| Webwasher-Gateway | 6.6.2 | 2008.08.26 | Trojan.Agent.75264.7 |
附加信息
File size: 81442 bytes
MD5...: 284d2bcf6dfbf104750088e42dbb9310
SHA1..: 4700c0bcb36e257aa80b5e3099e145967409aa70
SHA256: 0650b47eb63b70541d99a8fda7382b5876955315655bb9e3bc593876f4b81136
SHA512: e8a9770a98bae6846fb1e626541152447438a68bc95c06a51b44b5b106d2ef13
dc06e90553e5902d3f1ba48a11659d447340b942ebaa8eafd90113ec9f8f2e8b
PEiD..: BobSoft Mini Delphi -> BoB / BobSoft
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x401ad4
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)
( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0xaf4 0xc00 5.72 9e4a6bdb86002af477462b176e99c750
DATA 0x2000 0x14 0x200 0.31 6a30d5b8fb81fddd73a7815511c3ab35
BSS 0x3000 0x335 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.idata 0x4000 0x33a 0x400 3.75 e98c48affa99eb8861b3de4f09e87924
.reloc 0x5000 0xc4 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x6000 0x10 0x200 0.08 1de2ac252c79f240445fbc718433cac3
( 3 imports )
> kernel32.dll: GetProcAddress, LoadLibraryA
> advapi32.dll: CreateServiceA, ChangeServiceConfigA, CloseServiceHandle, ControlService, StartServiceA, OpenServiceA, OpenSCManagerA, RegCloseKey, RegQueryValueExA, RegSetValueExA, RegCreateKeyExA, RegOpenKeyExA
> kernel32.dll: lstrlenA, lstrcpyA, lstrcatA, lstrcmpA, GetWindowsDirectoryA, GetSystemDirectoryA, GetShortPathNameA, GetModuleFileNameA, GetLastError, ExitProcess, WinExec, CreateMutexA, SetFileTime, GetFileTime, CloseHandle, GetFileSize, ReadFile, WriteFile, SetFilePointer, CreateFileA
( 0 exports )
Norman Sandbox: [ General information ]
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO:
ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
* File length: 81442 bytes.
[ Changes to filesystem ]
* Creates file C:\WINDOWS\12345.dll.
[ Changes to registry ]
* Accesses Registry key \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\".
[ Process/window information ]
* Creates a mutex DGRAT2008.
* Creates process \"cmd.EXE\".
[ Signature Scanning ]
* C:\WINDOWS\12345.dll (75298 bytes) : W32/Delf.BWZO.
用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
