Trojaner-Board - Msn Bildergallerylink Virus

Hallo und :hallo:

Wer den Link anklickt, lädt folgende Datei:
Code:
Datei IMG000230090310-GIF.EXE empfangen 2009.03.16 21:31:56 (CET)

Status:    Beendet 

Ergebnis: 3/39 (7.7%) 

 Filter 

Drucken der Ergebnisse  Antivirus        Version        letzte aktualisierung        Ergebnis

a-squared        4.0.0.101        2009.03.16        Riskware.Win32.CeeInject!IK

AhnLab-V3        5.0.0.2        2009.03.16        -

AntiVir        7.9.0.116        2009.03.16        -

Authentium        5.1.0.4        2009.03.16        -

Avast        4.8.1335.0        2009.03.16        -

AVG        8.0.0.237        2009.03.16        -

BitDefender        7.2        2009.03.16        -

CAT-QuickHeal        10.00        2009.03.16        -

ClamAV        0.94.1        2009.03.16        -

Comodo        1060        2009.03.16        -

DrWeb        4.44.0.09170        2009.03.16        -

eSafe        7.0.17.0        2009.03.15        -

eTrust-Vet        31.6.6388        2009.03.09        -

F-Prot        4.4.4.56        2009.03.15        -

F-Secure        8.0.14470.0        2009.03.16        -

Fortinet        3.117.0.0        2009.03.16        -

GData        19        2009.03.16        -

Ikarus        T3.1.1.45.0        2009.03.16        VirTool.Win32.CeeInject

K7AntiVirus        7.10.673        2009.03.16        -

Kaspersky        7.0.0.125        2009.03.16        -

McAfee        5555        2009.03.16        -

McAfee+Artemis        5555        2009.03.16        -

McAfee-GW-Edition        6.7.6        2009.03.16        -

Microsoft        1.4405        2009.03.16        VirTool:Win32/CeeInject.gen!J

NOD32        3938        2009.03.16        -

Norman        6.00.06        2009.03.16        -

nProtect        2009.1.8.0        2009.03.16        -

Panda        10.0.0.10        2009.03.16        -

PCTools        4.4.2.0        2009.03.16        -

Prevx1        V2        2009.03.16        -

Rising        21.21.02.00        2009.03.16        -

Sophos        4.39.0        2009.03.16        -

Sunbelt        3.2.1858.2        2009.03.15        -

Symantec        1.4.4.12        2009.03.16        -

TheHacker        6.3.3.0.283        2009.03.16        -

TrendMicro        8.700.0.1004        2009.03.16        -

VBA32        3.12.10.1        2009.03.16        -

ViRobot        2009.3.16.1650        2009.03.16        -

VirusBuster        4.6.5.0        2009.03.16        -

weitere Informationen

File size: 99840 bytes

MD5...: 5c4556b9b396760ca0111703a199a6ca

SHA1..: 475085545725f97e956d8a5813e7dbaa4f9e2242

SHA256: 524418dcfc7555ebdc355733afe700fd6b74ebec440cbb7aadc7219fcd798ce4

SHA512: 2218f2222ec0b7c3881da58930d5037324e051cc35936b8f600790e0932c6941

523a3c815136f84ccddba1ecd6de634f9ec08d0322ff1734149cd0ccc1f37696

ssdeep: 3072:2nj9jtfU+INndIc0Je5GlQorIz28qtzJGP0L:2jbeiytKzJGk

PEiD..: -

TrID..: File type identification

Win64 Executable Generic (59.6%)

Win32 Executable MS Visual C++ (generic) (26.2%)

Win32 Executable Generic (5.9%)

Win32 Dynamic Link Library (generic) (5.2%)

Generic Win/DOS Executable (1.3%)

PEInfo: PE Structure information
 

( base data )

entrypointaddress.: 0x645c

timedatestamp.....: 0x41107bc1 (Wed Aug 04 06:01:37 2004)

machinetype.......: 0x14c (I386)
 

( 3 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x992c 0x9a00 6.57 17a6fbe18a834b6f3462304415675d36

.data 0xb000 0x1be4 0x400 4.25 99858e86526942a66950c7139f78a725

.rsrc 0xd000 0xe3bc 0xe400 6.82 a558275c2285b792d93fc473a4889399
 

( 6 imports ) 

> ADVAPI32.dll: FreeSid, AllocateAndInitializeSid, EqualSid, GetTokenInformation, OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueA, RegCloseKey, RegDeleteValueA, RegOpenKeyExA, RegSetValueExA, RegQueryValueExA, RegCreateKeyExA, RegQueryInfoKeyA

> KERNEL32.dll: LocalFree, LocalAlloc, GetLastError, GetCurrentProcess, lstrlenA, GetModuleFileNameA, GetSystemDirectoryA, _lclose, _llseek, _lopen, WritePrivateProfileStringA, GetWindowsDirectoryA, CreateDirectoryA, GetFileAttributesA, ExpandEnvironmentStringsA, lstrcpyA, GlobalFree, GlobalUnlock, GlobalLock, GlobalAlloc, IsDBCSLeadByte, GetShortPathNameA, GetPrivateProfileStringA, GetPrivateProfileIntA, lstrcmpiA, RemoveDirectoryA, FindClose, FindNextFileA, DeleteFileA, SetFileAttributesA, lstrcmpA, FindFirstFileA, FreeResource, GetProcAddress, LoadResource, SizeofResource, FindResourceA, lstrcatA, CloseHandle, WriteFile, SetFilePointer, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, SetCurrentDirectoryA, GetTempFileNameA, ExitProcess, CreateFileA, LoadLibraryExA, lstrcpynA, GetVolumeInformationA, FormatMessageA, GetCurrentDirectoryA, GetVersionExA, GetExitCodeProcess, WaitForSingleObject, CreateProcessA, GetTempPathA, GetSystemInfo, CreateMutexA, SetEvent, CreateEventA, CreateThread, ResetEvent, TerminateThread, GetDriveTypeA, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, ReadFile, LoadLibraryA, GetDiskFreeSpaceA, MulDiv, EnumResourceLanguagesA, FreeLibrary, LockResource

> GDI32.dll: GetDeviceCaps

> USER32.dll: ExitWindowsEx, wsprintfA, CharNextA, CharUpperA, CharPrevA, SetWindowLongA, GetWindowLongA, CallWindowProcA, DispatchMessageA, MsgWaitForMultipleObjects, PeekMessageA, SendMessageA, SetWindowPos, ReleaseDC, GetDC, GetWindowRect, SendDlgItemMessageA, GetDlgItem, SetForegroundWindow, SetWindowTextA, MessageBoxA, DialogBoxIndirectParamA, ShowWindow, EnableWindow, GetDlgItemTextA, EndDialog, GetDesktopWindow, MessageBeep, SetDlgItemTextA, LoadStringA, GetSystemMetrics

> COMCTL32.dll: -

> VERSION.dll: GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA
 

( 0 exports ) 

ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=5c4556b9b396760ca0111703a199a6ca' target='_blank'>http://www.threatexpert.com/report.aspx?md5=5c4556b9b396760ca0111703a199a6ca</a>

packers (F-Prot): CAB
Die muss relativ neu sein, da sie kaum ein AVP erkennt.

Ich habe sie an Avira und MalwareBytes geschickt. Die Analyse von Avira kann unter folgendem Link eingesehen werden: Avira Antivirus Solutions

ciao, andreas