Analysis Date2015-08-01 23:12:03
MD55509c3d64e45f9dec134770c2a1bc9b8
SHA1294b382fae77f65be2d040bb0a224f2426a2c52e

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: a8046587d3d69f7c50fd81e0b390a358 sha1: 8ed311c0bed7986b9df8cbdeb21749c351ac8d2a size: 319488
Section.rdata md5: f583da8679041ba567a4eb6bad510ee2 sha1: 3d04eabc9be82b5f9ebd9ffcf619cf7aee2d280a size: 59392
Section.data md5: 73f98a623b33254d10c085ee310c3b58 sha1: 4351263c7ab695e289b686251e9a0754a66011e9 size: 7680
Section.reloc md5: 87a590759cf88c73fee80d3360823497 sha1: 4c5a660b4c928acb8a68efad0e3bcdb4a2ae6b84 size: 26112
Timestamp2015-05-11 06:46:55
PackerMicrosoft Visual C++ 8
PEhash9e75c3afa7df6c21e5a42f231dc296d45019a6b6
IMPhash2916b8e8191ebe59d398759bd2b1ac1a
AVAuthentiumW32/Nivdort.B.gen!Eldorado
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVAvira (antivir)TR/Spy.ZBot.xbbeomq
AVF-SecureGen:Variant.Kazy.611009
AVDr. WebTrojan.Bayrob.1
AVRisingTrojan.Win32.Bayrod.b
AVClamAVno_virus
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.AY
AVEmsisoftGen:Variant.Kazy.611009
AVK7Trojan ( 004c3a4d1 )
AVEset (nod32)Win32/Bayrob.V.gen
AVBitDefenderGen:Variant.Kazy.611009
AVTwisterTrojan.Scar.jiiv.alhj
AVFrisk (f-prot)no_virus
AVMalwareBytesTrojan.Agent.KVTGen
AVTrend MicroTROJ_BAYROB.SM0
AVMcafeePWS-FCCE!5509C3D64E45
AVMicroWorld (escan)Gen:Variant.Kazy.611009
AVCA (E-Trust Ino)no_virus
AVSymantecDownloader.Upatre!g15
AVIkarusTrojan.Win32.Bayrob
AVPadvishno_virus
AVGrisoft (avg)Win32/Cryptor
AVFortinetW32/Bayrob.T!tr
AVArcabit (arcavir)Gen:Variant.Kazy.611009
AVVirusBlokAda (vba32)no_virus
AVCAT (quickheal)TrojanSpy.Nivdort.OD4
AVZillya!no_virus
AVAd-AwareGen:Variant.Kazy.611009
AVKasperskyTrojan.Win32.Generic
AVBullGuardGen:Variant.Kazy.611009

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\gcexoqonmp\vhkrv1lvclw9gdvrvdn.exe
Creates FileC:\gcexoqonmp\pqreslhxgkzx
Creates FileC:\WINDOWS\gcexoqonmp\pqreslhxgkzx
Deletes FileC:\WINDOWS\gcexoqonmp\pqreslhxgkzx
Creates ProcessC:\gcexoqonmp\vhkrv1lvclw9gdvrvdn.exe

Process
↳ C:\gcexoqonmp\vhkrv1lvclw9gdvrvdn.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Device Connection Alerts Fax Search Bus IKE ➝
C:\gcexoqonmp\ppwzczb.exe
Creates FileC:\gcexoqonmp\pqreslhxgkzx
Creates FileC:\WINDOWS\gcexoqonmp\pqreslhxgkzx
Creates FileC:\gcexoqonmp\ppwzczb.exe
Creates FilePIPE\lsarpc
Creates FileC:\gcexoqonmp\fjoutltcz
Deletes FileC:\WINDOWS\gcexoqonmp\pqreslhxgkzx
Creates ProcessC:\gcexoqonmp\ppwzczb.exe
Creates ServiceControls Builder Initiator Software PnP-X - C:\gcexoqonmp\ppwzczb.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 804

Process
↳ Pid 860

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates Filepipe\PCHFaultRepExecPipe

Process
↳ Pid 1216

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1876

Process
↳ Pid 1152

Process
↳ C:\gcexoqonmp\ppwzczb.exe

Creates Filepipe\net\NtControlPipe10
Creates FileC:\gcexoqonmp\iprvsnbleyme
Creates FileC:\gcexoqonmp\pqreslhxgkzx
Creates FileC:\WINDOWS\gcexoqonmp\pqreslhxgkzx
Creates FileC:\gcexoqonmp\fjoutltcz
Creates File\Device\Afd\Endpoint
Creates FileC:\gcexoqonmp\dckuwbwibcgn.exe
Deletes FileC:\WINDOWS\gcexoqonmp\pqreslhxgkzx
Creates Processqifwvwexdyal "c:\gcexoqonmp\ppwzczb.exe"

Process
↳ C:\gcexoqonmp\ppwzczb.exe

Creates FileC:\gcexoqonmp\pqreslhxgkzx
Creates FileC:\WINDOWS\gcexoqonmp\pqreslhxgkzx
Deletes FileC:\WINDOWS\gcexoqonmp\pqreslhxgkzx

Process
↳ qifwvwexdyal "c:\gcexoqonmp\ppwzczb.exe"

Creates FileC:\gcexoqonmp\pqreslhxgkzx
Creates FileC:\WINDOWS\gcexoqonmp\pqreslhxgkzx
Deletes FileC:\WINDOWS\gcexoqonmp\pqreslhxgkzx

Network Details:

DNSprofiles.dexknows.com
Type: A
204.133.117.26
DNSwinterbright.net
Type: A
67.231.253.49
DNSprobablybright.net
Type: A
95.211.230.75
DNSsweetinside.net
Type: A
208.91.197.241
DNSsimplepeople.net
Type: A
91.194.77.112
DNSmotherdaughter.net
Type: A
208.91.197.26
DNSwindowpeople.net
Type: A
208.93.105.60
DNSwinterready.net
Type: A
184.168.221.47
DNSmountaininstead.net
Type: A
DNSpossibleinstead.net
Type: A
DNSmountainexplain.net
Type: A
DNSpossibleexplain.net
Type: A
DNSmountainbright.net
Type: A
DNSpossiblebright.net
Type: A
DNSmountaininside.net
Type: A
DNSpossibleinside.net
Type: A
DNSperhapsinstead.net
Type: A
DNSwindowinstead.net
Type: A
DNSperhapsexplain.net
Type: A
DNSwindowexplain.net
Type: A
DNSperhapsbright.net
Type: A
DNSwindowbright.net
Type: A
DNSperhapsinside.net
Type: A
DNSwindowinside.net
Type: A
DNSwinterinstead.net
Type: A
DNSsubjectinstead.net
Type: A
DNSwinterexplain.net
Type: A
DNSsubjectexplain.net
Type: A
DNSsubjectbright.net
Type: A
DNSwinterinside.net
Type: A
DNSsubjectinside.net
Type: A
DNSfinishinstead.net
Type: A
DNSleaveinstead.net
Type: A
DNSfinishexplain.net
Type: A
DNSleaveexplain.net
Type: A
DNSfinishbright.net
Type: A
DNSleavebright.net
Type: A
DNSfinishinside.net
Type: A
DNSleaveinside.net
Type: A
DNSsweetinstead.net
Type: A
DNSprobablyinstead.net
Type: A
DNSsweetexplain.net
Type: A
DNSprobablyexplain.net
Type: A
DNSsweetbright.net
Type: A
DNSprobablyinside.net
Type: A
DNSseveralinstead.net
Type: A
DNSmaterialinstead.net
Type: A
DNSseveralexplain.net
Type: A
DNSmaterialexplain.net
Type: A
DNSseveralbright.net
Type: A
DNSmaterialbright.net
Type: A
DNSseveralinside.net
Type: A
DNSmaterialinside.net
Type: A
DNSseveraready.net
Type: A
DNSlaughready.net
Type: A
DNSseverabrown.net
Type: A
DNSlaughbrown.net
Type: A
DNSseverapeople.net
Type: A
DNSlaughpeople.net
Type: A
DNSseveradaughter.net
Type: A
DNSlaughdaughter.net
Type: A
DNSsimpleready.net
Type: A
DNSmotherready.net
Type: A
DNSsimplebrown.net
Type: A
DNSmotherbrown.net
Type: A
DNSmotherpeople.net
Type: A
DNSsimpledaughter.net
Type: A
DNSmountainready.net
Type: A
DNSpossibleready.net
Type: A
DNSmountainbrown.net
Type: A
DNSpossiblebrown.net
Type: A
DNSmountainpeople.net
Type: A
DNSpossiblepeople.net
Type: A
DNSmountaindaughter.net
Type: A
DNSpossibledaughter.net
Type: A
DNSperhapsready.net
Type: A
DNSwindowready.net
Type: A
DNSperhapsbrown.net
Type: A
DNSwindowbrown.net
Type: A
DNSperhapspeople.net
Type: A
DNSperhapsdaughter.net
Type: A
DNSwindowdaughter.net
Type: A
DNSsubjectready.net
Type: A
DNSwinterbrown.net
Type: A
DNSsubjectbrown.net
Type: A
DNSwinterpeople.net
Type: A
HTTP GEThttp://windowbright.net/index.php
User-Agent:
HTTP GEThttp://winterbright.net/index.php
User-Agent:
HTTP GEThttp://probablybright.net/index.php
User-Agent:
HTTP GEThttp://sweetinside.net/index.php
User-Agent:
HTTP GEThttp://simplepeople.net/index.php
User-Agent:
HTTP GEThttp://motherdaughter.net/index.php
User-Agent:
HTTP GEThttp://windowpeople.net/index.php
User-Agent:
HTTP GEThttp://winterready.net/index.php
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 204.133.117.26:80
Flows TCP192.168.1.1:1032 ➝ 67.231.253.49:80
Flows TCP192.168.1.1:1033 ➝ 95.211.230.75:80
Flows TCP192.168.1.1:1034 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1035 ➝ 91.194.77.112:80
Flows TCP192.168.1.1:1036 ➝ 208.91.197.26:80
Flows TCP192.168.1.1:1037 ➝ 208.93.105.60:80
Flows TCP192.168.1.1:1038 ➝ 184.168.221.47:80

Raw Pcap

Strings