Analysis Date2016-02-11 05:06:08
MD570ec46d7879ad1ebb4b059a76a4fc22c
SHA1617280b22c9b3efa58b0d7b831f27f2c63c9c48a

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: c2a3a4b2b75bf0e1d3043ee29847526c sha1: 0e6d4a9b025827f5038cfb2146c800acc07c6eb9 size: 198144
Section.rdata md5: 7c7f409e68e2c2047d09029390bee167 sha1: cea96f2c59708a1ad5c7ab3109e63d5666257b6f size: 2560
Section.data md5: 97569cddc6099324359cae7900795cd8 sha1: 6b54878aac1ef67535f2d30ddf6bc13f8d7bd504 size: 15872
Section.reloc md5: 6686aef118f94168ec7229b6a21527b3 sha1: 507ab98a8ffb095389736537201135b7813811f2 size: 30720
Timestamp2014-12-10 09:31:34
PEhash6676bfe27eceb0602c4fdbd0ccddbb0f3adbfb29
IMPhash2d8644f8e95a2fe264e500f5e03e2b0c
AVCA (E-Trust Ino)Gen:Variant.Kazy.790778
AVRisingNo Virus
AVMcafeeTrojan-FHRG!70EC46D7879A
AVAvira (antivir)TR/Nivdort.A.35056
AVTwisterNo Virus
AVAd-AwareGen:Variant.Kazy.790778
AVAlwil (avast)Vupa [Cryp]
AVEset (nod32)Win32/Bayrob.AT.gen
AVGrisoft (avg)Win32/Heur
AVSymantecTrojan.Bayrob!gen6
AVFortinetW32/Bayrob.AQ!tr
AVBitDefenderGen:Variant.Kazy.790778
AVK7Trojan ( 004dc2a31 )
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.DE
AVMicroWorld (escan)Gen:Variant.Kazy.790778
AVMalwareBytesNo Virus
AVAuthentiumW32/Nivdort.H.gen!Eldorado
AVEmsisoftGen:Variant.Kazy.790778
AVFrisk (f-prot)W32/Nivdort.H.gen!Eldorado
AVIkarusTrojan.Win32.Bayrob
AVZillya!No Virus
AVKasperskyTrojan.Win32.Generic
AVTrend MicroNo Virus
AVVirusBlokAda (vba32)No Virus
AVCAT (quickheal)TrojanSpy.Nivdort.r4
AVBullGuardGen:Variant.Kazy.790778
AVArcabit (arcavir)Gen:Variant.Kazy.790778
AVClamAVNo Virus
AVDr. WebNo Virus
AVF-SecureGen:Variant.Kazy.790778

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\jjjaicpqspwb\dp1lrvx0c6gsbudu.exe
Creates FileC:\jjjaicpqspwb\csxanjgqb
Creates FileC:\WINDOWS\jjjaicpqspwb\csxanjgqb
Deletes FileC:\WINDOWS\jjjaicpqspwb\csxanjgqb
Creates ProcessC:\jjjaicpqspwb\dp1lrvx0c6gsbudu.exe

Process
↳ C:\jjjaicpqspwb\dp1lrvx0c6gsbudu.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Discovery CNG Office Builder Provider ➝
C:\jjjaicpqspwb\pfuwuvo.exe
Creates FileC:\jjjaicpqspwb\csxanjgqb
Creates FileC:\jjjaicpqspwb\pfuwuvo.exe
Creates FileC:\jjjaicpqspwb\ayr4qihmpj
Creates FilePIPE\lsarpc
Creates FileC:\WINDOWS\jjjaicpqspwb\csxanjgqb
Deletes FileC:\WINDOWS\jjjaicpqspwb\csxanjgqb
Creates ProcessC:\jjjaicpqspwb\pfuwuvo.exe
Creates ServiceCard Remote DLL BitLocker Helper Auto - C:\jjjaicpqspwb\pfuwuvo.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 804

Process
↳ Pid 852

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1208

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1876

Process
↳ Pid 1172

Process
↳ C:\jjjaicpqspwb\pfuwuvo.exe

Creates FileC:\jjjaicpqspwb\csxanjgqb
Creates Filepipe\net\NtControlPipe10
Creates FileC:\jjjaicpqspwb\gonqima.exe
Creates FileC:\jjjaicpqspwb\ayr4qihmpj
Creates File\Device\Afd\Endpoint
Creates FileC:\jjjaicpqspwb\wgvnxe
Creates FileC:\WINDOWS\jjjaicpqspwb\csxanjgqb
Deletes FileC:\WINDOWS\jjjaicpqspwb\csxanjgqb
Creates Processpwxjqexdexlz "c:\jjjaicpqspwb\pfuwuvo.exe"

Process
↳ C:\jjjaicpqspwb\pfuwuvo.exe

Creates FileC:\jjjaicpqspwb\csxanjgqb
Creates FileC:\WINDOWS\jjjaicpqspwb\csxanjgqb
Deletes FileC:\WINDOWS\jjjaicpqspwb\csxanjgqb

Process
↳ pwxjqexdexlz "c:\jjjaicpqspwb\pfuwuvo.exe"

Creates FileC:\jjjaicpqspwb\csxanjgqb
Creates FileC:\WINDOWS\jjjaicpqspwb\csxanjgqb
Deletes FileC:\WINDOWS\jjjaicpqspwb\csxanjgqb

Network Details:

DNSsweetwomen.net
Type: A
184.168.221.104
DNSmaterialpaint.net
Type: A
208.100.26.234
DNSsimplestream.net
Type: A
141.8.225.124
DNSmountainstream.net
Type: A
207.148.248.143
DNSmountainbottle.net
Type: A
195.22.28.197
DNSmountainbottle.net
Type: A
195.22.28.196
DNSmountainbottle.net
Type: A
195.22.28.199
DNSmountainbottle.net
Type: A
195.22.28.198
DNSwindowstream.net
Type: A
216.21.239.197
DNSsweetnothing.net
Type: A
72.52.4.119
DNSmotheranother.net
Type: A
50.63.202.39
DNSsimplebusiness.net
Type: A
72.52.4.119
DNSmountainmanner.net
Type: A
208.100.26.234
DNSsweetbusiness.net
Type: A
50.240.78.247
DNSprofiles.dexknows.com
Type: A
204.133.117.26
DNSsweetcourse.net
Type: A
DNSprobablycourse.net
Type: A
DNSprobablywomen.net
Type: A
DNSseveralclean.net
Type: A
DNSmaterialclean.net
Type: A
DNSseveralpaint.net
Type: A
DNSseveralcourse.net
Type: A
DNSmaterialcourse.net
Type: A
DNSseveralwomen.net
Type: A
DNSmaterialwomen.net
Type: A
DNSseverastream.net
Type: A
DNSlaughstream.net
Type: A
DNSseveranothing.net
Type: A
DNSlaughnothing.net
Type: A
DNSseverabottle.net
Type: A
DNSlaughbottle.net
Type: A
DNSseveradivide.net
Type: A
DNSlaughdivide.net
Type: A
DNSmotherstream.net
Type: A
DNSsimplenothing.net
Type: A
DNSmothernothing.net
Type: A
DNSsimplebottle.net
Type: A
DNSmotherbottle.net
Type: A
DNSsimpledivide.net
Type: A
DNSmotherdivide.net
Type: A
DNSpossiblestream.net
Type: A
DNSmountainnothing.net
Type: A
DNSpossiblenothing.net
Type: A
DNSpossiblebottle.net
Type: A
DNSmountaindivide.net
Type: A
DNSpossibledivide.net
Type: A
DNSperhapsstream.net
Type: A
DNSperhapsnothing.net
Type: A
DNSwindownothing.net
Type: A
DNSperhapsbottle.net
Type: A
DNSwindowbottle.net
Type: A
DNSperhapsdivide.net
Type: A
DNSwindowdivide.net
Type: A
DNSwinterstream.net
Type: A
DNSsubjectstream.net
Type: A
DNSwinternothing.net
Type: A
DNSsubjectnothing.net
Type: A
DNSwinterbottle.net
Type: A
DNSsubjectbottle.net
Type: A
DNSwinterdivide.net
Type: A
DNSsubjectdivide.net
Type: A
DNSfinishstream.net
Type: A
DNSleavestream.net
Type: A
DNSfinishnothing.net
Type: A
DNSleavenothing.net
Type: A
DNSfinishbottle.net
Type: A
DNSleavebottle.net
Type: A
DNSfinishdivide.net
Type: A
DNSleavedivide.net
Type: A
DNSsweetstream.net
Type: A
DNSprobablystream.net
Type: A
DNSprobablynothing.net
Type: A
DNSsweetbottle.net
Type: A
DNSprobablybottle.net
Type: A
DNSsweetdivide.net
Type: A
DNSprobablydivide.net
Type: A
DNSseveralstream.net
Type: A
DNSmaterialstream.net
Type: A
DNSseveralnothing.net
Type: A
DNSmaterialnothing.net
Type: A
DNSseveralbottle.net
Type: A
DNSmaterialbottle.net
Type: A
DNSseveraldivide.net
Type: A
DNSmaterialdivide.net
Type: A
DNSseveramanner.net
Type: A
DNSlaughmanner.net
Type: A
DNSseveraanother.net
Type: A
DNSlaughanother.net
Type: A
DNSseverabusiness.net
Type: A
DNSlaughbusiness.net
Type: A
DNSseveraappear.net
Type: A
DNSlaughappear.net
Type: A
DNSsimplemanner.net
Type: A
DNSmothermanner.net
Type: A
DNSsimpleanother.net
Type: A
DNSmotherbusiness.net
Type: A
DNSsimpleappear.net
Type: A
DNSmotherappear.net
Type: A
DNSpossiblemanner.net
Type: A
DNSmountainanother.net
Type: A
DNSpossibleanother.net
Type: A
DNSmountainbusiness.net
Type: A
DNSpossiblebusiness.net
Type: A
DNSmountainappear.net
Type: A
DNSpossibleappear.net
Type: A
DNSperhapsmanner.net
Type: A
DNSwindowmanner.net
Type: A
DNSperhapsanother.net
Type: A
DNSwindowanother.net
Type: A
DNSperhapsbusiness.net
Type: A
DNSwindowbusiness.net
Type: A
DNSperhapsappear.net
Type: A
DNSwindowappear.net
Type: A
DNSwintermanner.net
Type: A
DNSsubjectmanner.net
Type: A
DNSwinteranother.net
Type: A
DNSsubjectanother.net
Type: A
DNSwinterbusiness.net
Type: A
DNSsubjectbusiness.net
Type: A
DNSwinterappear.net
Type: A
DNSsubjectappear.net
Type: A
DNSfinishmanner.net
Type: A
DNSleavemanner.net
Type: A
DNSfinishanother.net
Type: A
DNSleaveanother.net
Type: A
DNSfinishbusiness.net
Type: A
DNSleavebusiness.net
Type: A
DNSfinishappear.net
Type: A
DNSleaveappear.net
Type: A
DNSsweetmanner.net
Type: A
DNSprobablymanner.net
Type: A
DNSsweetanother.net
Type: A
DNSprobablyanother.net
Type: A
DNSprobablybusiness.net
Type: A
DNSsweetappear.net
Type: A
DNSprobablyappear.net
Type: A
DNSseveralmanner.net
Type: A
DNSmaterialmanner.net
Type: A
DNSseveralanother.net
Type: A
DNSmaterialanother.net
Type: A
DNSseveralbusiness.net
Type: A
DNSmaterialbusiness.net
Type: A
DNSseveralappear.net
Type: A
DNSmaterialappear.net
Type: A
DNSseverainstead.net
Type: A
DNSlaughinstead.net
Type: A
DNSseveraexplain.net
Type: A
DNSlaughexplain.net
Type: A
DNSseverabright.net
Type: A
DNSlaughbright.net
Type: A
DNSseverainside.net
Type: A
DNSlaughinside.net
Type: A
DNSsimpleinstead.net
Type: A
DNSmotherinstead.net
Type: A
DNSsimpleexplain.net
Type: A
DNSmotherexplain.net
Type: A
DNSsimplebright.net
Type: A
DNSmotherbright.net
Type: A
DNSsimpleinside.net
Type: A
DNSmotherinside.net
Type: A
DNSmountaininstead.net
Type: A
DNSpossibleinstead.net
Type: A
DNSmountainexplain.net
Type: A
DNSpossibleexplain.net
Type: A
DNSmountainbright.net
Type: A
DNSpossiblebright.net
Type: A
DNSmountaininside.net
Type: A
DNSpossibleinside.net
Type: A
DNSperhapsinstead.net
Type: A
DNSwindowinstead.net
Type: A
DNSperhapsexplain.net
Type: A
DNSwindowexplain.net
Type: A
DNSperhapsbright.net
Type: A
DNSwindowbright.net
Type: A
HTTP GEThttp://sweetwomen.net/index.php
User-Agent:
HTTP GEThttp://materialpaint.net/index.php
User-Agent:
HTTP GEThttp://simplestream.net/index.php
User-Agent:
HTTP GEThttp://mountainstream.net/index.php
User-Agent:
HTTP GEThttp://mountainbottle.net/index.php
User-Agent:
HTTP GEThttp://windowstream.net/index.php
User-Agent:
HTTP GEThttp://sweetnothing.net/index.php
User-Agent:
HTTP GEThttp://motheranother.net/index.php
User-Agent:
HTTP GEThttp://simplebusiness.net/index.php
User-Agent:
HTTP GEThttp://mountainmanner.net/index.php
User-Agent:
HTTP GEThttp://sweetbusiness.net/index.php
User-Agent:
HTTP GEThttp://windowbright.net/index.php
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 184.168.221.104:80
Flows TCP192.168.1.1:1032 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1033 ➝ 141.8.225.124:80
Flows TCP192.168.1.1:1034 ➝ 207.148.248.143:80
Flows TCP192.168.1.1:1035 ➝ 195.22.28.197:80
Flows TCP192.168.1.1:1036 ➝ 216.21.239.197:80
Flows TCP192.168.1.1:1037 ➝ 72.52.4.119:80
Flows TCP192.168.1.1:1038 ➝ 50.63.202.39:80
Flows TCP192.168.1.1:1039 ➝ 72.52.4.119:80
Flows TCP192.168.1.1:1040 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1041 ➝ 50.240.78.247:80
Flows TCP192.168.1.1:1042 ➝ 204.133.117.26:80

Raw Pcap

Strings