Analysis Date2014-12-27 12:37:07
MD5d732b558bff634b3a0d6b7d160b4aa90
SHA14adc1ce204d9de9c303a8a60ccf07c05cf601208

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 33ed9b88b2dae2fe86d434e2b09a4122 sha1: 6ce7ae1e9771daf8d8283aaa70ae464f71a54de0 size: 4096
Section.rdata md5: 775b1b9b7de082046e13db8348304075 sha1: 423c94d9a5dedd8064c739cbd3413c7f4cb01440 size: 1024
Section.data md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rsrc md5: 36448ade6214cd066bbc62e562426caa sha1: 75e50f83f714f2ade3857e8c4becc11dc21d297d size: 59392
Timestamp2014-07-01 17:49:01
VersionLegalCopyright: Copyright (C) 2007
InternalName: tendency
FileVersion: 8,4,4,26
ProductName: tendency Application
ProductVersion: 3,3,1,45
FileDescription: tendency Application
OriginalFilename: tendency.exe
PEhash438ac25c5f7a04500cd3624defc4e114eb8a81de
IMPhash5fb1dc1346b88e9086c0c7d29c6f059c
AV360 SafeGen:Trojan.Heur.Zbot.eq0@byxkIyfi
AVAd-AwareGen:Trojan.Heur.Zbot.eq0@byxkIyfi
AVAlwil (avast)Dropper-gen [Drp]
AVArcabit (arcavir)Gen:Trojan.Heur.Zbot.eq0@byxkIyfi
AVAuthentiumW32/Trojan.NYYT-5690
AVAvira (antivir)TR/Dropper.Gen
AVBullGuardGen:Trojan.Heur.Zbot.eq0@byxkIyfi
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)Trojan.Cutwail.r4
AVClamAVno_virus
AVDr. WebTrojan.MulDrop3.14959
AVEmsisoftGen:Trojan.Heur.Zbot.eq0@byxkIyfi
AVEset (nod32)Win32/Kryptik.CFVL
AVFortinetW32/Cutwail.CFVL!tr
AVFrisk (f-prot)no_virus
AVF-SecureGen:Trojan.Heur.Zbot.eq0@byxkIyfi
AVGrisoft (avg)Agent
AVIkarusTrojan.Win32.Cutwail
AVK7Trojan ( 0049cbf01 )
AVKasperskyTrojan.Win32.Cutwail.deq
AVMalwareBytesno_virus
AVMcafeeRDN/Downloader.a!ty
AVMicrosoft Security EssentialsTrojanDownloader:Win32/Cutwail.BS
AVMicroWorld (escan)Gen:Trojan.Heur.Zbot.eq0@byxkIyfi
AVRisingno_virus
AVSophosno_virus
AVSymantecTrojan.Gen
AVTrend Microno_virus
AVVirusBlokAda (vba32)Trojan.Cutwail

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\moqogdarkewy ➝
C:\Documents and Settings\Administrator\moqogdarkewy.exe
RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\AppManagement ➝
NULL
Creates FileC:\Documents and Settings\Administrator\moqogdarkewy.exe
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\Crypto\RSA\S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-500\a18ca4003deb042bbee7a40f15e1970b_666939c9-243b-475e-9504-51724db22670
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates Mutexmoqogdarkewy

Network Details:

DNSsmtp.glbdns2.microsoft.com
Type: A
65.55.176.126
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
98.139.211.125
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
63.250.193.228
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
98.138.105.21
DNSsmtp.live.com
Type: A
DNSsmtp.mail.yahoo.com
Type: A
Flows TCP192.168.1.1:1031 ➝ 65.55.176.126:25
Flows TCP192.168.1.1:1032 ➝ 98.139.211.125:25

Raw Pcap

Strings
-
.. .
041904b0
3,3,1,45
8,4,4,26
across
&acting; embarrassed
&actress regardless
added addressed
addition rather
Admirable everything+appealing father himself Cousine perceptive*approaching moments illustration creatures4contradicted brushed taking something daresay seemed!guessed continued Julia important8produced rural opined impression sauntered Dormer seemed8almost though conveniences considering slowly imperative
&advised
affairs
again
&Against been--and
&already
&already C??lie
altogether subjects
always position
&always Sherringham
amiable wouldnt specimens
&another direct
&another estate
&anybody reply
&anything careful
&anythings Paradise
applied arrange
&apprehension smiling
:artless spoken affairs words infatuation adoption national0tolerate insatiate chosen Bohemian besides Tiens
ashamed'evening elapsed better wonderful judged.Carr?? critics Dashwood invite rather position/articles herself future; commercial corner--the
&asked figures
assumption
&attached
&augmented
bargain accommodate
beauty
&beauty
become
&before enamels
Before to-day examples
behind
&bending nearest
between
&between mortal
&Biddys
&blessed
&blossom
bowled
brocanteur
&broken before
&burning
&business agency
business riddle Gardens
called
cannon noble?--how keeping friendly
&canvas
captured
carefully do--you
Carterets
central
&centurys pretty
charity--without exactly
&Chayter
chill then--youve)English lodgings circled continuity brain-taught associated returned taste faith people
&choose induced
&clapped
clear
clever
&clever
clever sentiments
&clever unchallenged
&Clorinde
closed
&comedy
&coming
company blinds Miriam faith
&complimentary
composing
&conceal excuse
&conduct giving
&confidence terrible
considering
&continued Tories
Copyright (C) 2007
&course
course embark development to-day
&courses
course seemingly
&creatures exactly
cried
critic
critical$diversion affection himself possibly
&curtains become
customary really little evening
&Dallows undertaking
decision
&declaration
declared little
&degree
&delightful
&derivative
different
&dinner-party--he question
&discussion almost
&divine telling
&doesnt
&Dormer it--without
&Dormer performing
dragged us--each tended paint
droll against ten-shilling
&dropped Madame
eating
&effort
&elapsed
&eloquence tongue
embassy it--had appearance
&encounter appeared
&enemies
engaged dropped
&engagement
&enlightened
&espousing moneys
everything
everything delays surprise!--for
evidently
exaggerate
exclaimed wondrous
&exclamation clever
&explanation impose
&exponent quieter
express manner
extinguished ordeal
&families centuries
&fathers
&figure
FileDescription
FileVersion
&flashed
&flocking
follow express--I
friend magnificent
&friend without
(frugality constituted certain capricious;personally school baignoire should Madame continuity theres
future
&future candour
Gabriel
Gabriel received Lovick perhaps
&gained
&gallantry
&general
gentleman forbore represents
getting
giving
graced like--paint
&grateful woman
Gutenberg enough about
&handling because
hansom wouldnt
&happened
hateful
havent people variety
having
&having miracles
herself
&hesitated
&higher everything
&highly styles
&himself
&himself later
himself opinions
&honest something
&horrid
hospitable
&hostess
house
&house little
&howling
&ignorance
immense galleries
impenetrable inspired
impulse greater training
incident validity points element
&inclined
&indication;
&infatuation
&inferior Fran?ais
information
informing explanatory little
infringement remarked
&injury
innocent--thousands
instance--from
interest
interested waived
InternalName
;I&Q
&it--Im
&itself qualities
Julia1indiscreet Carteret sense placidly Peter precious!distinction cathedral information+father refuse completed added to-day fallen0really something Rooth Miriams surprise question
&Julia mother
&kinsmans Peter
&knocked
knowing
&lady--to centre
&language
LegalCopyright
&lightly yourself
&likely
limbs it--sometimes
&limits therefore
literally ready
&little
Little
little better appeals reflexion
little responsibility
little theres fraternising
&London--go
&looked
&looked patience
losing
Madame
Madame imploringly
manner
&manner repeated
&married--these little
&martyr
&matter without
&meaning
&me--not conception
&mentioned
&mercy better
&might--I
&mingled
Miriam
mirror desire There
mirrors usually
missed
moment; freedom
moment magnified
&moments
moreover
morning
mother necessity
mother retention
MS Shell Dlg
&narrated allude
nature speaking equally doctrines
&nearer
&Neither different
&Never mistook
&night
&nineteenth months
nothing
nothing exposure; confidence whatever
noting Miriam alone
now--something should
&objection
&object replied
obligations silence
&occupied half-hour
&official
OriginalFilename
&others
others--a Nicholas7benefactor something carpet always--not unholy listened)friend finding thought foreigners glanced(richest simplicity direction Sherringham*Julias attending expectations distributing>Dormer affectionate seemed proposition feeling solitude please almost contentedly richly stayedEspeech believing beautiful lady--sometimes impatient matter answering
&painted
painting
&Palais said--not
&Parliament amusement
passion
pencil--the
&performance
Perhaps Julia--nothing entreat
&perversity importance
Peter
pieces--is
&placed
&placed hundred
playing advertisement-sheet
please learned thinks
&plenty ball-room
poetry
point!--and
&portals
&portrait experience
&possible
&possible afraid
&postern
&practical corner
&practice anomalous
&presence
&presently remembered
previous crack
&private
&probation spirit
problems
ProductName
ProductVersion
&professing become
profession--Biddys rubbish3listened attitude--the dreariness Hawthorne without.leaving quavered simple putting opened visitor-analogy serious Macgeorge--what strong Madame
proportion
&propriety Foundation
&providing
&question
&questionable
&questions
&Rachel prolongation
really
&really
&reasonable
&reason resorted
&received
&received interpreter
REFUND reminded
&relation
&relent own--those
relevant
&remark hostesss
&remember States
&resented
resource disturb
&resource mother
responses
&rested
result expression
&retorted theatre
&retreat insist
&returned scarcely
RichEdit20A
richness
right
&right duties
romantic call--he Signor
&Rooth
ruffled immense
sacrifices
&sapient
&satiric reason
&scattered nature
sc??ne friend
&seated
&Sections called
seeing
seeing impatient
&seemed
&serenity
&serious
&seriously usage
&Sherringham
&Sherringham pretty
&should
should effort
should matter
silence
simple
&simple cousin;
&sketch
&something
&sometimes
sometimes daughter
&speak neither
&splendid friend
&spontaneous
s??tait canvas dependent others
startled
stayed
stockbroker
&strange
stress;
StringFileInfo
studio remoter
studying actresss
&style course
&suburban altogether
suffers disconcerted
&superficial
&supposed
&surprise
surprised always portraits#herself towering reinstated finding
&sweetness
sympathy little
SysListView32
Tahoma
talent
talked others
tendency
tendency Application
tendency.exe
that--and Miriam
&themes
them--scarce
&there
there affection irregular compliance
&therefore darkened
things
&thinking other
&thinks professions
though replied
&thought
&thought constituted
&Thoughtfully family
&through Chayter
tinsel sometimes
to-morrow
to-morrow pudding good-natured
&touched
&trained actors
&training
Translation
tremendously piously;
triumph
&trust continued
&turned
VarFileInfo
variety-show
&veritable Constantinople;
&visitor grandly
VS_VERSION_INFO
&vulgar sometimes
&wage-earning servants--she
&want--to
warmth inspired supper
&waters actress--you
what--a
where another
&which
&which affairs
windows
windows soreness
&wished before
wished other
wonder anything
Wonderful Michael
&worlds;
&wouldnt promptly
wretchedly second
&writing station
yesterday
you--I
14&'76
31r*%h
3EInwA3Yl
(3=sdy
3UY+kJ8
#4\Ers
6{t:oW~@
>7?&05ILZ[KJ|IUP
7$>9=><#;0ruazp
]*8[4>vj
>8)8W7C;
 =8=Ox)
8p\}bFGj
>?/.<9E@R[SJpui\
A}97g.
bd!"lU
-bK*Pg
c!f-x{
CGJ	y[xM
cjSb&f
cl"mu,
CreateWindowExA
@.data
DefWindowProcA
DispatchMessageA
 E5Y&<}lu
e=$iQmq
Eoa+6s6
explorer
!&,';<FE]ZX[gpbi
FindResourceA
F&iR9_
Gd*y1+
GetCurrentProcess
GetExitCodeProcess
GetMessageA
GetModuleHandleA
GetProcessHeap
$"gK%!
gkR|[j
GME6t:
gxrI}rpsslfMY
H@'\!?5UOV
HeapAlloc
?')$hQ
igPt9rt
<IjmaUXrs
I&Lh1p9
Kep$\!
kernel32.dll
KillTimer
`k#Y8i
l#1e`/L
LoadCursorA
LoadIconA
LoadResource
[L`xb^+
m{bH'_?n
mI)<df
MKJuoiu9867_965iygfhj
MM@7L%-
,;MnB'G1D,
m>=Oio
m^tHyA
N	5L[Rho5P,
NaWG%J
NO1uN`
~NXRlD
|O<~J"
@OP?},w]
-P-+aT S
p?h5`|
\p*-lg
PostQuitMessage
/?.\Q58
q=5bgQQ&>eEi
QB9z?*
 q(L5#d
q.MML?
QMwB:Z
!@QV C
`.rdata
R!=&$e
RegisterClassExA
Rhq0|"1x"Ur
SetTimer
ShowWindow
sutC5~
T%+Bar
!This program cannot be run in DOS mode.
Ti#uql
TranslateMessage
\U6JO"
UpdateWindow
user32.dll
&?V2xE
/|V?N=:
.*v	_OFE!7
vTRAR 
@w9q@o
W9V_yWV
w>:lJ.
XAa,: 
*"@YiW
~YW+{d
_zB187
>Zg(.32
"z)K+>
z'~LZm
{zsq-^