Analysis Date2015-08-19 08:51:27
MD555f9a1f3bd4b6588aeca4d4bd0066da3
SHA14beb2faeb107e228931427160814de8837fe6260

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 96433aeb8b7de9e599af5116e5320285 sha1: ee53c735b0c78cb802abe8802f7c815eee1be251 size: 299520
Section.rdata md5: 72a9439c6ff087869accd32be38242de sha1: ab512634b7385628eec7a1b37254156c72d303a1 size: 34304
Section.data md5: 5ff41039ae47da11ba6b8ce9ef79591c sha1: bda18c8b4034f7c4f2fb8365a2508bbe4317519e size: 98304
Timestamp2014-10-30 10:10:32
PackerMicrosoft Visual C++ ?.?
PEhashbf684f27c3e73973ff5dd5ac228c5391d4d6cbc4
IMPhash69e8bc9396189de1eb5059fccc3bf34d
AVCA (E-Trust Ino)Heur/Downloader.ZALU!suspicious
AVF-SecureGen:Variant.Symmi.22722
AVDr. WebTrojan.DownLoader15.32945
AVClamAVno_virus
AVArcabit (arcavir)Gen:Variant.Symmi.22722
AVBullGuardGen:Variant.Symmi.22722
AVPadvishno_virus
AVVirusBlokAda (vba32)no_virus
AVCAT (quickheal)Trojan.Dynamer.AC3
AVTrend MicroTROJ_FORUCON.BMC
AVKasperskyTrojan.Win32.Generic
AVZillya!no_virus
AVEmsisoftGen:Variant.Symmi.22722
AVIkarusTrojan.FBAccountLock
AVFrisk (f-prot)no_virus
AVAuthentiumW32/Wonton.B.gen!Eldorado
AVMalwareBytesTrojan.Zbot.WHE
AVMicroWorld (escan)Gen:Variant.Symmi.22722
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.BD
AVK7Trojan ( 004cb2771 )
AVBitDefenderGen:Variant.Symmi.22722
AVFortinetW32/Agent.VNC!tr
AVSymantecDownloader.Upatre!g15
AVGrisoft (avg)Win32/Cryptor
AVEset (nod32)Win32/Agent.VNC
AVAlwil (avast)Downloader-TLD [Trj]
AVAd-AwareGen:Variant.Symmi.22722
AVTwisterno_virus
AVAvira (antivir)BDS/Zegost.Gen4
AVMcafeeTrojan-FEMT!55F9A1F3BD4B
AVRising0x58ef8c3a

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Function Ordering Video Software ➝
C:\Documents and Settings\Administrator\Application Data\qeerarcddwnr\olwprialx.exe
Creates FileC:\Documents and Settings\Administrator\Application Data\qeerarcddwnr\olwprialx.exe
Creates ProcessC:\Documents and Settings\Administrator\Application Data\qeerarcddwnr\olwprialx.exe

Process
↳ C:\Documents and Settings\Administrator\Application Data\qeerarcddwnr\olwprialx.exe

Creates FileC:\Documents and Settings\Administrator\Application Data\qeerarcddwnr\olwprialx.vogp
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Application Data\qeerarcddwnr\xicogfhng.exe
Creates ProcessWATCHDOGPROC "C:\Documents and Settings\Administrator\Application Data\qeerarcddwnr\olwprialx.exe"

Process
↳ WATCHDOGPROC "C:\Documents and Settings\Administrator\Application Data\qeerarcddwnr\olwprialx.exe"

Network Details:

DNSsimpleoffice.net
Type: A
50.63.202.104
DNSmountainsupply.net
Type: A
67.18.199.2
DNSwindowsupply.net
Type: A
173.236.172.44
DNSsweetoffice.net
Type: A
162.213.251.173
DNSmaterialsupply.net
Type: A
184.168.221.36
DNSlaughstrong.net
Type: A
50.21.189.209
DNSseveraoffice.net
Type: A
DNSlaughoffice.net
Type: A
DNSseveraarrive.net
Type: A
DNSlaugharrive.net
Type: A
DNSsimplesupply.net
Type: A
DNSmothersupply.net
Type: A
DNSsimpledistance.net
Type: A
DNSmotherdistance.net
Type: A
DNSmotheroffice.net
Type: A
DNSsimplearrive.net
Type: A
DNSmotherarrive.net
Type: A
DNSpossiblesupply.net
Type: A
DNSmountaindistance.net
Type: A
DNSpossibledistance.net
Type: A
DNSmountainoffice.net
Type: A
DNSpossibleoffice.net
Type: A
DNSmountainarrive.net
Type: A
DNSpossiblearrive.net
Type: A
DNSperhapssupply.net
Type: A
DNSperhapsdistance.net
Type: A
DNSwindowdistance.net
Type: A
DNSperhapsoffice.net
Type: A
DNSwindowoffice.net
Type: A
DNSperhapsarrive.net
Type: A
DNSwindowarrive.net
Type: A
DNSwintersupply.net
Type: A
DNSsubjectsupply.net
Type: A
DNSwinterdistance.net
Type: A
DNSsubjectdistance.net
Type: A
DNSwinteroffice.net
Type: A
DNSsubjectoffice.net
Type: A
DNSwinterarrive.net
Type: A
DNSsubjectarrive.net
Type: A
DNSfinishsupply.net
Type: A
DNSleavesupply.net
Type: A
DNSfinishdistance.net
Type: A
DNSleavedistance.net
Type: A
DNSfinishoffice.net
Type: A
DNSleaveoffice.net
Type: A
DNSfinisharrive.net
Type: A
DNSleavearrive.net
Type: A
DNSsweetsupply.net
Type: A
DNSprobablysupply.net
Type: A
DNSsweetdistance.net
Type: A
DNSprobablydistance.net
Type: A
DNSprobablyoffice.net
Type: A
DNSsweetarrive.net
Type: A
DNSprobablyarrive.net
Type: A
DNSseveralsupply.net
Type: A
DNSseveraldistance.net
Type: A
DNSmaterialdistance.net
Type: A
DNSseveraloffice.net
Type: A
DNSmaterialoffice.net
Type: A
DNSseveralarrive.net
Type: A
DNSmaterialarrive.net
Type: A
DNSseverastrong.net
Type: A
DNSseveratrouble.net
Type: A
DNSlaughtrouble.net
Type: A
DNSseverapresident.net
Type: A
DNSlaughpresident.net
Type: A
DNSseveracaught.net
Type: A
DNSlaughcaught.net
Type: A
DNSsimplestrong.net
Type: A
DNSmotherstrong.net
Type: A
DNSsimpletrouble.net
Type: A
DNSmothertrouble.net
Type: A
DNSsimplepresident.net
Type: A
DNSmotherpresident.net
Type: A
DNSsimplecaught.net
Type: A
DNSmothercaught.net
Type: A
DNSmountainstrong.net
Type: A
DNSpossiblestrong.net
Type: A
DNSmountaintrouble.net
Type: A
DNSpossibletrouble.net
Type: A
DNSmountainpresident.net
Type: A
DNSpossiblepresident.net
Type: A
DNSmountaincaught.net
Type: A
DNSpossiblecaught.net
Type: A
DNSperhapsstrong.net
Type: A
HTTP GEThttp://simpleoffice.net/index.php?email=amalia_rido@yahoo.com&method=post&len
User-Agent:
HTTP GEThttp://mountainsupply.net/index.php?email=amalia_rido@yahoo.com&method=post&len
User-Agent:
HTTP GEThttp://windowsupply.net/index.php?email=amalia_rido@yahoo.com&method=post&len
User-Agent:
HTTP GEThttp://sweetoffice.net/index.php?email=amalia_rido@yahoo.com&method=post&len
User-Agent:
HTTP GEThttp://materialsupply.net/index.php?email=amalia_rido@yahoo.com&method=post&len
User-Agent:
HTTP GEThttp://laughstrong.net/index.php?email=amalia_rido@yahoo.com&method=post&len
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 50.63.202.104:80
Flows TCP192.168.1.1:1032 ➝ 67.18.199.2:80
Flows TCP192.168.1.1:1033 ➝ 173.236.172.44:80
Flows TCP192.168.1.1:1034 ➝ 162.213.251.173:80
Flows TCP192.168.1.1:1035 ➝ 184.168.221.36:80
Flows TCP192.168.1.1:1036 ➝ 50.21.189.209:80

Raw Pcap
0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d616d61 6c69615f 7269646f   mail=amalia_rido
0x00000020 (00032)   40796168 6f6f2e63 6f6d266d 6574686f   @yahoo.com&metho
0x00000030 (00048)   643d706f 7374266c 656e2048 5454502f   d=post&len HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2073 696d706c   ose..Host: simpl
0x00000070 (00112)   656f6666 6963652e 6e65740d 0a0d0a     eoffice.net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d616d61 6c69615f 7269646f   mail=amalia_rido
0x00000020 (00032)   40796168 6f6f2e63 6f6d266d 6574686f   @yahoo.com&metho
0x00000030 (00048)   643d706f 7374266c 656e2048 5454502f   d=post&len HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a206d 6f756e74   ose..Host: mount
0x00000070 (00112)   61696e73 7570706c 792e6e65 740d0a0d   ainsupply.net...
0x00000080 (00128)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d616d61 6c69615f 7269646f   mail=amalia_rido
0x00000020 (00032)   40796168 6f6f2e63 6f6d266d 6574686f   @yahoo.com&metho
0x00000030 (00048)   643d706f 7374266c 656e2048 5454502f   d=post&len HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2077 696e646f   ose..Host: windo
0x00000070 (00112)   77737570 706c792e 6e65740d 0a0d0a0d   wsupply.net.....
0x00000080 (00128)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d616d61 6c69615f 7269646f   mail=amalia_rido
0x00000020 (00032)   40796168 6f6f2e63 6f6d266d 6574686f   @yahoo.com&metho
0x00000030 (00048)   643d706f 7374266c 656e2048 5454502f   d=post&len HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2073 77656574   ose..Host: sweet
0x00000070 (00112)   6f666669 63652e6e 65740d0a 0d0a0a0d   office.net......
0x00000080 (00128)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d616d61 6c69615f 7269646f   mail=amalia_rido
0x00000020 (00032)   40796168 6f6f2e63 6f6d266d 6574686f   @yahoo.com&metho
0x00000030 (00048)   643d706f 7374266c 656e2048 5454502f   d=post&len HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a206d 61746572   ose..Host: mater
0x00000070 (00112)   69616c73 7570706c 792e6e65 740d0a0d   ialsupply.net...
0x00000080 (00128)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d616d61 6c69615f 7269646f   mail=amalia_rido
0x00000020 (00032)   40796168 6f6f2e63 6f6d266d 6574686f   @yahoo.com&metho
0x00000030 (00048)   643d706f 7374266c 656e2048 5454502f   d=post&len HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a206c 61756768   ose..Host: laugh
0x00000070 (00112)   7374726f 6e672e6e 65740d0a 0d0a0a0d   strong.net......
0x00000080 (00128)   0a                                    .

Strings