Analysis Date2016-02-11 04:59:55
MD57f3b59808b41d432fec45755dcc5703d
SHA158f08ae8215175d2ac1e0e1550cc956fc09fed71

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 8d4c9bfbcd6ba8bc28d4218446260dc3 sha1: 962ac07af4b5b3603dbe409d551e1b0b66421418 size: 264704
Section.rdata md5: 1c86ce97d6e82f596d56f1e77460320e sha1: 4f8c6377231f7c16c9f248188ad6d8484ea3a1a0 size: 42496
Section.data md5: b29b9381cc8472f843fe903256f22575 sha1: 4d904e18bc82d2256ad473d3e634b48df01ed298 size: 1536
Section.reloc md5: 236981ff610f5853d1504d9cbc7cf8fa sha1: 6f2a81c33775ced9bb8cab1a41a56ca5aff0005a size: 52224
Timestamp2015-12-23 04:50:14
PackerBorland Delphi 3.0 (???)
PEhash24c4ac0a5b103b3766e8a00cb55370ee5734aa7b
IMPhashf1cd47ac122cec77c69319fe8eb8b501
AVCA (E-Trust Ino)Gen:Variant.Razy.11545
AVRisingNo Virus
AVMcafeeTrojan-FHPD!7F3B59808B41
AVAvira (antivir)TR/Taranis.1209
AVTwisterNo Virus
AVAd-AwareGen:Variant.Razy.11545
AVAlwil (avast)Win32:Malware-gen
AVEset (nod32)Win32/Bayrob.AQ
AVGrisoft (avg)Win32/Heur
AVSymantecTrojan.Bayrob!gen6
AVFortinetW32/Bayrob.AQ!tr
AVBitDefenderGen:Variant.Razy.11545
AVK7Trojan ( 004db0c61 )
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.CW
AVMicroWorld (escan)Gen:Variant.Razy.11545
AVMalwareBytesNo Virus
AVAuthentiumW32/Nivdort.F.gen!Eldorado
AVEmsisoftGen:Variant.Razy.11545
AVFrisk (f-prot)W32/Nivdort.F.gen!Eldorado
AVIkarusTrojan.Win32.Bayrob
AVZillya!Downloader.Small.Win32.86797
AVKasperskyTrojan.Win32.Generic
AVTrend MicroNo Virus
AVVirusBlokAda (vba32)BScope.Malware-Cryptor.Msgfake
AVCAT (quickheal)TrojanSpy.Nivdort.r4
AVBullGuardGen:Variant.Razy.11545
AVArcabit (arcavir)Gen:Variant.Razy.11545
AVClamAVNo Virus
AVDr. WebNo Virus
AVF-SecureGen:Variant.Razy.11545

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\WINDOWS\nsfewnukbowva\tlhqfvnlca
Creates FileC:\nsfewnukbowva\tlhqfvnlca
Creates FileC:\nsfewnukbowva\dc9fu1kcnq0hoesfyue.exe
Deletes FileC:\WINDOWS\nsfewnukbowva\tlhqfvnlca
Creates ProcessC:\nsfewnukbowva\dc9fu1kcnq0hoesfyue.exe

Process
↳ C:\nsfewnukbowva\dc9fu1kcnq0hoesfyue.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Shell Logs DLL Auto-Discovery Services ➝
C:\nsfewnukbowva\jhuaalmmo.exe
Creates FileC:\nsfewnukbowva\jhuaalmmo.exe
Creates FileC:\nsfewnukbowva\sd3fl5m
Creates FileC:\WINDOWS\nsfewnukbowva\tlhqfvnlca
Creates FileC:\nsfewnukbowva\tlhqfvnlca
Creates FilePIPE\lsarpc
Deletes FileC:\WINDOWS\nsfewnukbowva\tlhqfvnlca
Creates ProcessC:\nsfewnukbowva\jhuaalmmo.exe
Creates ServiceLog BitLocker Ordering Now Thread - C:\nsfewnukbowva\jhuaalmmo.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 820

Process
↳ Pid 864

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1220

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1864

Process
↳ Pid 1172

Process
↳ C:\nsfewnukbowva\jhuaalmmo.exe

Creates FileC:\nsfewnukbowva\pehi3ofx6u9
Creates Filepipe\net\NtControlPipe10
Creates FileC:\nsfewnukbowva\sd3fl5m
Creates FileC:\WINDOWS\nsfewnukbowva\tlhqfvnlca
Creates FileC:\nsfewnukbowva\tlhqfvnlca
Creates File\Device\Afd\Endpoint
Creates FileC:\nsfewnukbowva\ajqqzcxdev.exe
Deletes FileC:\WINDOWS\nsfewnukbowva\tlhqfvnlca
Creates Processr5axaypw7oli "c:\nsfewnukbowva\jhuaalmmo.exe"

Process
↳ C:\nsfewnukbowva\jhuaalmmo.exe

Creates FileC:\WINDOWS\nsfewnukbowva\tlhqfvnlca
Creates FileC:\nsfewnukbowva\tlhqfvnlca
Deletes FileC:\WINDOWS\nsfewnukbowva\tlhqfvnlca

Process
↳ r5axaypw7oli "c:\nsfewnukbowva\jhuaalmmo.exe"

Creates FileC:\WINDOWS\nsfewnukbowva\tlhqfvnlca
Creates FileC:\nsfewnukbowva\tlhqfvnlca
Deletes FileC:\WINDOWS\nsfewnukbowva\tlhqfvnlca

Network Details:

DNSsweetwomen.net
Type: A
184.168.221.104
DNSmaterialpaint.net
Type: A
208.100.26.234
DNSsimplestream.net
Type: A
141.8.225.124
DNSmountainstream.net
Type: A
207.148.248.143
DNSmountainbottle.net
Type: A
195.22.26.248
DNSwindowstream.net
Type: A
216.21.239.197
DNSsweetnothing.net
Type: A
72.52.4.119
DNSmotheranother.net
Type: A
50.63.202.39
DNSsimplebusiness.net
Type: A
72.52.4.119
DNSmountainmanner.net
Type: A
208.100.26.234
DNSsweetbusiness.net
Type: A
50.240.78.247
DNSprobablypaint.net
Type: A
DNSsweetcourse.net
Type: A
DNSprobablycourse.net
Type: A
DNSprobablywomen.net
Type: A
DNSseveralclean.net
Type: A
DNSmaterialclean.net
Type: A
DNSseveralpaint.net
Type: A
DNSseveralcourse.net
Type: A
DNSmaterialcourse.net
Type: A
DNSseveralwomen.net
Type: A
DNSmaterialwomen.net
Type: A
DNSseverastream.net
Type: A
DNSlaughstream.net
Type: A
DNSseveranothing.net
Type: A
DNSlaughnothing.net
Type: A
DNSseverabottle.net
Type: A
DNSlaughbottle.net
Type: A
DNSseveradivide.net
Type: A
DNSlaughdivide.net
Type: A
DNSmotherstream.net
Type: A
DNSsimplenothing.net
Type: A
DNSmothernothing.net
Type: A
DNSsimplebottle.net
Type: A
DNSmotherbottle.net
Type: A
DNSsimpledivide.net
Type: A
DNSmotherdivide.net
Type: A
DNSpossiblestream.net
Type: A
DNSmountainnothing.net
Type: A
DNSpossiblenothing.net
Type: A
DNSpossiblebottle.net
Type: A
DNSmountaindivide.net
Type: A
DNSpossibledivide.net
Type: A
DNSperhapsstream.net
Type: A
DNSperhapsnothing.net
Type: A
DNSwindownothing.net
Type: A
DNSperhapsbottle.net
Type: A
DNSwindowbottle.net
Type: A
DNSperhapsdivide.net
Type: A
DNSwindowdivide.net
Type: A
DNSwinterstream.net
Type: A
DNSsubjectstream.net
Type: A
DNSwinternothing.net
Type: A
DNSsubjectnothing.net
Type: A
DNSwinterbottle.net
Type: A
DNSsubjectbottle.net
Type: A
DNSwinterdivide.net
Type: A
DNSsubjectdivide.net
Type: A
DNSfinishstream.net
Type: A
DNSleavestream.net
Type: A
DNSfinishnothing.net
Type: A
DNSleavenothing.net
Type: A
DNSfinishbottle.net
Type: A
DNSleavebottle.net
Type: A
DNSfinishdivide.net
Type: A
DNSleavedivide.net
Type: A
DNSsweetstream.net
Type: A
DNSprobablystream.net
Type: A
DNSprobablynothing.net
Type: A
DNSsweetbottle.net
Type: A
DNSprobablybottle.net
Type: A
DNSsweetdivide.net
Type: A
DNSprobablydivide.net
Type: A
DNSseveralstream.net
Type: A
DNSmaterialstream.net
Type: A
DNSseveralnothing.net
Type: A
DNSmaterialnothing.net
Type: A
DNSseveralbottle.net
Type: A
DNSmaterialbottle.net
Type: A
DNSseveraldivide.net
Type: A
DNSmaterialdivide.net
Type: A
DNSseveramanner.net
Type: A
DNSlaughmanner.net
Type: A
DNSseveraanother.net
Type: A
DNSlaughanother.net
Type: A
DNSseverabusiness.net
Type: A
DNSlaughbusiness.net
Type: A
DNSseveraappear.net
Type: A
DNSlaughappear.net
Type: A
DNSsimplemanner.net
Type: A
DNSmothermanner.net
Type: A
DNSsimpleanother.net
Type: A
DNSmotherbusiness.net
Type: A
DNSsimpleappear.net
Type: A
DNSmotherappear.net
Type: A
DNSpossiblemanner.net
Type: A
DNSmountainanother.net
Type: A
DNSpossibleanother.net
Type: A
DNSmountainbusiness.net
Type: A
DNSpossiblebusiness.net
Type: A
DNSmountainappear.net
Type: A
DNSpossibleappear.net
Type: A
DNSperhapsmanner.net
Type: A
DNSwindowmanner.net
Type: A
DNSperhapsanother.net
Type: A
DNSwindowanother.net
Type: A
DNSperhapsbusiness.net
Type: A
DNSwindowbusiness.net
Type: A
DNSperhapsappear.net
Type: A
DNSwindowappear.net
Type: A
DNSwintermanner.net
Type: A
DNSsubjectmanner.net
Type: A
DNSwinteranother.net
Type: A
DNSsubjectanother.net
Type: A
DNSwinterbusiness.net
Type: A
DNSsubjectbusiness.net
Type: A
DNSwinterappear.net
Type: A
DNSsubjectappear.net
Type: A
DNSfinishmanner.net
Type: A
DNSleavemanner.net
Type: A
DNSfinishanother.net
Type: A
DNSleaveanother.net
Type: A
DNSfinishbusiness.net
Type: A
DNSleavebusiness.net
Type: A
DNSfinishappear.net
Type: A
DNSleaveappear.net
Type: A
DNSsweetmanner.net
Type: A
DNSprobablymanner.net
Type: A
DNSsweetanother.net
Type: A
DNSprobablyanother.net
Type: A
DNSprobablybusiness.net
Type: A
DNSsweetappear.net
Type: A
DNSprobablyappear.net
Type: A
DNSseveralmanner.net
Type: A
DNSmaterialmanner.net
Type: A
DNSseveralanother.net
Type: A
DNSmaterialanother.net
Type: A
DNSseveralbusiness.net
Type: A
DNSmaterialbusiness.net
Type: A
DNSseveralappear.net
Type: A
DNSmaterialappear.net
Type: A
DNSseverainstead.net
Type: A
DNSlaughinstead.net
Type: A
DNSseveraexplain.net
Type: A
DNSlaughexplain.net
Type: A
DNSseverabright.net
Type: A
DNSlaughbright.net
Type: A
DNSseverainside.net
Type: A
DNSlaughinside.net
Type: A
DNSsimpleinstead.net
Type: A
DNSmotherinstead.net
Type: A
DNSsimpleexplain.net
Type: A
DNSmotherexplain.net
Type: A
DNSsimplebright.net
Type: A
DNSmotherbright.net
Type: A
DNSsimpleinside.net
Type: A
DNSmotherinside.net
Type: A
DNSmountaininstead.net
Type: A
DNSpossibleinstead.net
Type: A
DNSmountainexplain.net
Type: A
DNSpossibleexplain.net
Type: A
DNSmountainbright.net
Type: A
DNSpossiblebright.net
Type: A
DNSmountaininside.net
Type: A
DNSpossibleinside.net
Type: A
DNSperhapsinstead.net
Type: A
DNSwindowinstead.net
Type: A
DNSperhapsexplain.net
Type: A
DNSwindowexplain.net
Type: A
DNSperhapsbright.net
Type: A
HTTP GEThttp://sweetwomen.net/index.php
User-Agent:
HTTP GEThttp://materialpaint.net/index.php
User-Agent:
HTTP GEThttp://simplestream.net/index.php
User-Agent:
HTTP GEThttp://mountainstream.net/index.php
User-Agent:
HTTP GEThttp://mountainbottle.net/index.php
User-Agent:
HTTP GEThttp://windowstream.net/index.php
User-Agent:
HTTP GEThttp://sweetnothing.net/index.php
User-Agent:
HTTP GEThttp://motheranother.net/index.php
User-Agent:
HTTP GEThttp://simplebusiness.net/index.php
User-Agent:
HTTP GEThttp://mountainmanner.net/index.php
User-Agent:
HTTP GEThttp://sweetbusiness.net/index.php
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 184.168.221.104:80
Flows TCP192.168.1.1:1032 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1033 ➝ 141.8.225.124:80
Flows TCP192.168.1.1:1034 ➝ 207.148.248.143:80
Flows TCP192.168.1.1:1035 ➝ 195.22.26.248:80
Flows TCP192.168.1.1:1036 ➝ 216.21.239.197:80
Flows TCP192.168.1.1:1037 ➝ 72.52.4.119:80
Flows TCP192.168.1.1:1038 ➝ 50.63.202.39:80
Flows TCP192.168.1.1:1039 ➝ 72.52.4.119:80
Flows TCP192.168.1.1:1040 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1041 ➝ 50.240.78.247:80

Raw Pcap

Strings