Analysis Date2016-03-04 17:27:55
MD5686fa0b2eeb100c24ff07ec789522e72
SHA1516b3e48e88b88445d8c6d2ad444d5a45a3ad33b

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 14a2cb70ec6693b50fea3d36bb5b4b17 sha1: 83cbdc79239014746e122124d47091e8d64e76aa size: 186368
Section.rdata md5: b1b318fdc180c84e7c6ab49221bcfe59 sha1: 1fbd5d14e624bae217bff930ae8bf260bd221243 size: 2560
Section.data md5: 6119dacc24421339a0a133f3503a5fc2 sha1: 51128dc48eeccbe242c2f0c5ad3072776b983c5e size: 16384
Section.reloc md5: c14b809a619fd84298ebee7170adda41 sha1: dde39fc16fca3b46904120dc0216f4c9e7f00283 size: 31232
Timestamp2015-01-09 00:38:09
PEhash4f0716ef3de32dba745b7275fab0c9418b76433d
IMPhash0e175bf5a6ad7d76230d6d638534abe4
AVMcafeeTrojan-FHQT!686FA0B2EEB1
AVZillya!Trojan.Bayrob.Win32.12376
AVDr. WebTrojan.DownLoader19.39651
AVMalwareBytesNo Virus
AVAuthentiumW32/Nivdort.G.gen!Eldorado
AVEmsisoftGen:Variant.Razy.15494
AVKasperskyTrojan.Win32.Generic
AVTrend MicroNo Virus
AVEset (nod32)Win32/Bayrob.BA
AVK7Trojan ( 004dc2a31 )
AVAlwil (avast)Trojan-gen
AVFortinetW32/Bayrob.AQ!tr
AVIkarusTrojan.Win32.Bayrob
AVAvira (antivir)TR/Nivdort.A.36449
AVFrisk (f-prot)W32/Nivdort.G.gen!Eldorado
AVGrisoft (avg)Generic37.XNZ
AVSymantecTrojan.Bayrob!gen6
AVF-SecureGen:Variant.Razy.15494
AVAlwil (avast)Win32:Trojan-gen
AVBitDefenderGen:Variant.Razy.15494
AVVirusBlokAda (vba32)No Virus
AVBullGuardGen:Variant.Razy.15494
AVRisingNo Virus
AVAd-AwareGen:Variant.Razy.15494
AVCA (E-Trust Ino)Gen:Variant.Razy.15494
AVMicroWorld (escan)Gen:Variant.Razy.15494
AVArcabit (arcavir)Gen:Variant.Razy.15494
AVCAT (quickheal)TrojanSpy.Nivdort.WR4
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.DE
AVTwisterNo Virus
AVClamAVNo Virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\WINDOWS\tpkufbhp\rygicvesivt
Creates FileC:\tpkufbhp\rygicvesivt
Creates FileC:\tpkufbhp\irhk1l65ixpxyzxs7.exe
Deletes FileC:\WINDOWS\tpkufbhp\rygicvesivt
Creates ProcessC:\tpkufbhp\irhk1l65ixpxyzxs7.exe

Process
↳ C:\tpkufbhp\irhk1l65ixpxyzxs7.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\DNS Defender Base Health Counter Endpoint Wired ➝
C:\tpkufbhp\rkwvbbml.exe
Creates FileC:\tpkufbhp\rkwvbbml.exe
Creates FileC:\WINDOWS\tpkufbhp\rygicvesivt
Creates FileC:\tpkufbhp\jzrnrz3fk2
Creates FileC:\tpkufbhp\rygicvesivt
Creates FilePIPE\lsarpc
Deletes FileC:\WINDOWS\tpkufbhp\rygicvesivt
Creates ProcessC:\tpkufbhp\rkwvbbml.exe
Creates ServiceCenter Logs Office IKE Card Encryption - C:\tpkufbhp\rkwvbbml.exe

Process
↳ Pid 804

Process
↳ Pid 852

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\WERd420.dir00\svchost.exe.hdmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\WERd420.dir00\svchost.exe.mdmp
Creates Filepipe\PCHFaultRepExecPipe
Creates ProcessC:\WINDOWS\system32\dumprep.exe 1020 -dm 7 7 C:\Documents and Settings\Administrator\Local Settings\Temp\WERd420.dir00\svchost.exe.mdmp 16325836412031020

Process
↳ Pid 1112

Process
↳ Pid 1208

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1860

Process
↳ Pid 1144

Process
↳ C:\tpkufbhp\rkwvbbml.exe

Creates FileC:\WINDOWS\tpkufbhp\rygicvesivt
Creates Filepipe\net\NtControlPipe10
Creates FileC:\tpkufbhp\jzrnrz3fk2
Creates FileC:\tpkufbhp\rygicvesivt
Creates File\Device\Afd\Endpoint
Creates FileC:\tpkufbhp\kxpboxjek
Creates FileC:\tpkufbhp\kqemhbhosns.exe
Deletes FileC:\WINDOWS\tpkufbhp\rygicvesivt
Creates Processuqwe9nsc2kel "c:\tpkufbhp\rkwvbbml.exe"

Process
↳ C:\tpkufbhp\rkwvbbml.exe

Creates FileC:\WINDOWS\tpkufbhp\rygicvesivt
Creates FileC:\tpkufbhp\rygicvesivt
Deletes FileC:\WINDOWS\tpkufbhp\rygicvesivt

Process
↳ C:\WINDOWS\system32\dumprep.exe 1020 -dm 7 7 C:\Documents and Settings\Administrator\Local Settings\Temp\WERd420.dir00\svchost.exe.mdmp 16325836412031020

Process
↳ uqwe9nsc2kel "c:\tpkufbhp\rkwvbbml.exe"

Creates FileC:\WINDOWS\tpkufbhp\rygicvesivt
Creates FileC:\tpkufbhp\rygicvesivt
Deletes FileC:\WINDOWS\tpkufbhp\rygicvesivt

Network Details:

DNSfightanger.net
Type: A
52.0.217.44
DNSfreshschool.net
Type: A
203.189.109.65
DNSfollowschool.net
Type: A
208.100.26.234
DNScrowdschool.net
Type: A
59.106.167.73
DNSthoughtschool.net
Type: A
50.63.202.53
DNSmelbourneit.hotkeysparking.com
Type: A
8.5.1.16
DNSwomanschool.net
Type: A
121.254.178.252
DNSsmokeschool.net
Type: A
69.89.31.60
DNSpartyschool.net
Type: A
69.172.201.208
DNSexperiencetraining.net
Type: A
74.220.199.8
DNSsummertraining.net
Type: A
216.239.139.94
DNSsummerstorm.net
Type: A
72.52.4.119
DNScrowdstorm.net
Type: A
184.168.221.41
DNSsummerthrown.net
Type: A
208.100.26.234
DNSwatertraining.net
Type: A
216.21.239.197
DNSwomantraining.net
Type: A
208.91.197.66
DNSpartyhunger.net
Type: A
82.165.25.210
DNSfighthunger.net
Type: A
72.52.4.120
DNSfighttraining.net
Type: A
69.172.201.208
DNSmelbourneit.hotkeysparking.com
Type: A
8.5.1.16
DNSpartyalways.net
Type: A
DNSfightalways.net
Type: A
DNSpartyforest.net
Type: A
DNSfightforest.net
Type: A
DNSexperienceschool.net
Type: A
DNSfreshwhile.net
Type: A
DNSexperiencewhile.net
Type: A
DNSfreshquestion.net
Type: A
DNSexperiencequestion.net
Type: A
DNSfreshtherefore.net
Type: A
DNSexperiencetherefore.net
Type: A
DNSgentlemanschool.net
Type: A
DNSalreadyschool.net
Type: A
DNSgentlemanwhile.net
Type: A
DNSalreadywhile.net
Type: A
DNSgentlemanquestion.net
Type: A
DNSalreadyquestion.net
Type: A
DNSgentlemantherefore.net
Type: A
DNSalreadytherefore.net
Type: A
DNSmemberschool.net
Type: A
DNSfollowwhile.net
Type: A
DNSmemberwhile.net
Type: A
DNSfollowquestion.net
Type: A
DNSmemberquestion.net
Type: A
DNSfollowtherefore.net
Type: A
DNSmembertherefore.net
Type: A
DNSbeginschool.net
Type: A
DNSknownschool.net
Type: A
DNSbeginwhile.net
Type: A
DNSknownwhile.net
Type: A
DNSbeginquestion.net
Type: A
DNSknownquestion.net
Type: A
DNSbegintherefore.net
Type: A
DNSknowntherefore.net
Type: A
DNSsummerschool.net
Type: A
DNSsummerwhile.net
Type: A
DNScrowdwhile.net
Type: A
DNSsummerquestion.net
Type: A
DNScrowdquestion.net
Type: A
DNSsummertherefore.net
Type: A
DNScrowdtherefore.net
Type: A
DNSwaterschool.net
Type: A
DNSthoughtwhile.net
Type: A
DNSwaterwhile.net
Type: A
DNSthoughtquestion.net
Type: A
DNSwaterquestion.net
Type: A
DNSthoughttherefore.net
Type: A
DNSwatertherefore.net
Type: A
DNSwomanwhile.net
Type: A
DNSsmokewhile.net
Type: A
DNSwomanquestion.net
Type: A
DNSsmokequestion.net
Type: A
DNSwomantherefore.net
Type: A
DNSsmoketherefore.net
Type: A
DNSfightschool.net
Type: A
DNSpartywhile.net
Type: A
DNSfightwhile.net
Type: A
DNSpartyquestion.net
Type: A
DNSfightquestion.net
Type: A
DNSpartytherefore.net
Type: A
DNSfighttherefore.net
Type: A
DNSfreshhunger.net
Type: A
DNSexperiencehunger.net
Type: A
DNSfreshtraining.net
Type: A
DNSfreshstorm.net
Type: A
DNSexperiencestorm.net
Type: A
DNSfreshthrown.net
Type: A
DNSexperiencethrown.net
Type: A
DNSgentlemanhunger.net
Type: A
DNSalreadyhunger.net
Type: A
DNSgentlemantraining.net
Type: A
DNSalreadytraining.net
Type: A
DNSgentlemanstorm.net
Type: A
DNSalreadystorm.net
Type: A
DNSgentlemanthrown.net
Type: A
DNSalreadythrown.net
Type: A
DNSfollowhunger.net
Type: A
DNSmemberhunger.net
Type: A
DNSfollowtraining.net
Type: A
DNSmembertraining.net
Type: A
DNSfollowstorm.net
Type: A
DNSmemberstorm.net
Type: A
DNSfollowthrown.net
Type: A
DNSmemberthrown.net
Type: A
DNSbeginhunger.net
Type: A
DNSknownhunger.net
Type: A
DNSbegintraining.net
Type: A
DNSknowntraining.net
Type: A
DNSbeginstorm.net
Type: A
DNSknownstorm.net
Type: A
DNSbeginthrown.net
Type: A
DNSknownthrown.net
Type: A
DNSsummerhunger.net
Type: A
DNScrowdhunger.net
Type: A
DNScrowdtraining.net
Type: A
DNScrowdthrown.net
Type: A
DNSthoughthunger.net
Type: A
DNSwaterhunger.net
Type: A
DNSthoughttraining.net
Type: A
DNSthoughtstorm.net
Type: A
DNSwaterstorm.net
Type: A
DNSthoughtthrown.net
Type: A
DNSwaterthrown.net
Type: A
DNSwomanhunger.net
Type: A
DNSsmokehunger.net
Type: A
DNSsmoketraining.net
Type: A
DNSwomanstorm.net
Type: A
DNSsmokestorm.net
Type: A
DNSwomanthrown.net
Type: A
DNSsmokethrown.net
Type: A
DNSpartytraining.net
Type: A
DNSpartystorm.net
Type: A
DNSfightstorm.net
Type: A
DNSpartythrown.net
Type: A
DNSfightthrown.net
Type: A
DNSfreshchoose.net
Type: A
DNSexperiencechoose.net
Type: A
DNSfreshalthough.net
Type: A
DNSexperiencealthough.net
Type: A
DNSfreshperiod.net
Type: A
DNSexperienceperiod.net
Type: A
DNSfreshhowever.net
Type: A
DNSexperiencehowever.net
Type: A
DNSgentlemanchoose.net
Type: A
DNSalreadychoose.net
Type: A
DNSgentlemanalthough.net
Type: A
DNSalreadyalthough.net
Type: A
DNSgentlemanperiod.net
Type: A
DNSalreadyperiod.net
Type: A
DNSgentlemanhowever.net
Type: A
DNSalreadyhowever.net
Type: A
DNSfollowchoose.net
Type: A
DNSmemberchoose.net
Type: A
DNSfollowalthough.net
Type: A
DNSmemberalthough.net
Type: A
DNSfollowperiod.net
Type: A
DNSmemberperiod.net
Type: A
DNSfollowhowever.net
Type: A
DNSmemberhowever.net
Type: A
DNSbeginchoose.net
Type: A
DNSknownchoose.net
Type: A
DNSbeginalthough.net
Type: A
DNSknownalthough.net
Type: A
DNSbeginperiod.net
Type: A
DNSknownperiod.net
Type: A
DNSbeginhowever.net
Type: A
DNSknownhowever.net
Type: A
DNSsummerchoose.net
Type: A
DNScrowdchoose.net
Type: A
DNSsummeralthough.net
Type: A
DNScrowdalthough.net
Type: A
DNSsummerperiod.net
Type: A
HTTP GEThttp://fightanger.net/index.php
User-Agent:
HTTP GEThttp://freshschool.net/index.php
User-Agent:
HTTP GEThttp://followschool.net/index.php
User-Agent:
HTTP GEThttp://crowdschool.net/index.php
User-Agent:
HTTP GEThttp://thoughtschool.net/index.php
User-Agent:
HTTP GEThttp://thoughttherefore.net/index.php
User-Agent:
HTTP GEThttp://womanschool.net/index.php
User-Agent:
HTTP GEThttp://smokeschool.net/index.php
User-Agent:
HTTP GEThttp://partyschool.net/index.php
User-Agent:
HTTP GEThttp://experiencetraining.net/index.php
User-Agent:
HTTP GEThttp://summertraining.net/index.php
User-Agent:
HTTP GEThttp://summerstorm.net/index.php
User-Agent:
HTTP GEThttp://crowdstorm.net/index.php
User-Agent:
HTTP GEThttp://summerthrown.net/index.php
User-Agent:
HTTP GEThttp://watertraining.net/index.php
User-Agent:
HTTP GEThttp://womantraining.net/index.php
User-Agent:
HTTP GEThttp://partyhunger.net/index.php
User-Agent:
HTTP GEThttp://fighthunger.net/index.php
User-Agent:
HTTP GEThttp://fighttraining.net/index.php
User-Agent:
HTTP GEThttp://alreadyperiod.net/index.php
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 52.0.217.44:80
Flows TCP192.168.1.1:1032 ➝ 203.189.109.65:80
Flows TCP192.168.1.1:1033 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1034 ➝ 59.106.167.73:80
Flows TCP192.168.1.1:1035 ➝ 50.63.202.53:80
Flows TCP192.168.1.1:1036 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1037 ➝ 121.254.178.252:80
Flows TCP192.168.1.1:1038 ➝ 69.89.31.60:80
Flows TCP192.168.1.1:1039 ➝ 69.172.201.208:80
Flows TCP192.168.1.1:1040 ➝ 74.220.199.8:80
Flows TCP192.168.1.1:1041 ➝ 216.239.139.94:80
Flows TCP192.168.1.1:1042 ➝ 72.52.4.119:80
Flows TCP192.168.1.1:1043 ➝ 184.168.221.41:80
Flows TCP192.168.1.1:1044 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1045 ➝ 216.21.239.197:80
Flows TCP192.168.1.1:1046 ➝ 208.91.197.66:80
Flows TCP192.168.1.1:1047 ➝ 82.165.25.210:80
Flows TCP192.168.1.1:1048 ➝ 72.52.4.120:80
Flows TCP192.168.1.1:1049 ➝ 69.172.201.208:80
Flows TCP192.168.1.1:1050 ➝ 8.5.1.16:80

Raw Pcap

Strings