Analysis Date2015-08-02 01:13:44
MD5a2cba9a53f69cc4464c4f87aa11f722f
SHA16515040f036176f66e8db0a5a59ac59bcd144628

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 68878f05a64e061c44fade3c3043b6e5 sha1: c7a4b805d5f27f0d70cb37021f9ec4cd6158d76c size: 292864
Section.rdata md5: 9712892407c69af4b81a537ce0ea743a sha1: 1b879501390c2a56313cdd2ead52b75621edac07 size: 58368
Section.data md5: daf975cd1254cbc9a88d32332296cdfe sha1: 72047ed1b1c303044e805cfdc6a45cdc636b098e size: 7680
Section.reloc md5: 360aaffa5158aaae542e8fdf76b3fa53 sha1: 09b4b39264952910ac83341b6e26c5350e59be48 size: 20992
Timestamp2015-05-11 06:30:41
PackerMicrosoft Visual C++ 8
PEhashea7e69fbc293fe9e06109157b8dbe557941c346d
IMPhashc1fd487b8d3a74409ce00bcfa66c8f99
AVEmsisoftGen:Variant.Kazy.611009
AVPadvishno_virus
AVDr. WebTrojan.Bayrob.1
AVFrisk (f-prot)no_virus
AVZillya!no_virus
AVVirusBlokAda (vba32)no_virus
AVArcabit (arcavir)Gen:Variant.Kazy.611009
AVMalwareBytesTrojan.Agent
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVTrend MicroTROJ_BAYROB.SM0
AVAuthentiumW32/Nivdort.B.gen!Eldorado
AVAvira (antivir)TR/Crypt.ZPACK.55467
AVKasperskyTrojan.Win32.Generic
AVCA (E-Trust Ino)no_virus
AVBitDefenderGen:Variant.Kazy.611009
AVEset (nod32)Win32/Bayrob.V.gen
AVRisingTrojan.Win32.Bayrod.b
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.BG
AVF-SecureGen:Variant.Kazy.611009
AVTwisterTrojan.Generic.wgfl
AVFortinetW32/Bayrob.T!tr
AVMicroWorld (escan)Gen:Variant.Kazy.611009
AVCAT (quickheal)TrojanSpy.Nivdort.OD4
AVMcafeePWS-FCCE!A2CBA9A53F69
AVAd-AwareGen:Variant.Kazy.611009
AVClamAVno_virus
AVK7Trojan ( 004c3a4d1 )
AVBullGuardGen:Variant.Kazy.611009
AVGrisoft (avg)Win32/Cryptor
AVSymantecDownloader.Upatre!g15
AVIkarusTrojan.Win32.Bayrob

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\WINDOWS\uwluchalfnfqv\zqzphp
Creates FileC:\uwluchalfnfqv\zqzphp
Creates FileC:\uwluchalfnfqv\ufkp1lz8icup3tap8fv.exe
Deletes FileC:\WINDOWS\uwluchalfnfqv\zqzphp
Creates ProcessC:\uwluchalfnfqv\ufkp1lz8icup3tap8fv.exe

Process
↳ C:\uwluchalfnfqv\ufkp1lz8icup3tap8fv.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Image Controls Problem Encryption ➝
C:\uwluchalfnfqv\tkhtayjfup.exe
Creates FileC:\WINDOWS\uwluchalfnfqv\zqzphp
Creates FileC:\uwluchalfnfqv\tkhtayjfup.exe
Creates FileC:\uwluchalfnfqv\kplgqqs
Creates FileC:\uwluchalfnfqv\zqzphp
Creates FilePIPE\lsarpc
Deletes FileC:\WINDOWS\uwluchalfnfqv\zqzphp
Creates ProcessC:\uwluchalfnfqv\tkhtayjfup.exe
Creates ServiceNetBIOS Name Link-Layer Ordering - C:\uwluchalfnfqv\tkhtayjfup.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 804

Process
↳ Pid 848

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1204

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1848

Process
↳ Pid 1164

Process
↳ C:\uwluchalfnfqv\tkhtayjfup.exe

Creates Filepipe\net\NtControlPipe10
Creates FileC:\uwluchalfnfqv\sdmspvpm
Creates FileC:\WINDOWS\uwluchalfnfqv\zqzphp
Creates FileC:\uwluchalfnfqv\kplgqqs
Creates FileC:\uwluchalfnfqv\zqzphp
Creates File\Device\Afd\Endpoint
Creates FileC:\uwluchalfnfqv\tsyymdkvc.exe
Deletes FileC:\WINDOWS\uwluchalfnfqv\zqzphp
Creates Processjiwspklgbdjd "c:\uwluchalfnfqv\tkhtayjfup.exe"

Process
↳ C:\uwluchalfnfqv\tkhtayjfup.exe

Creates FileC:\WINDOWS\uwluchalfnfqv\zqzphp
Creates FileC:\uwluchalfnfqv\zqzphp
Deletes FileC:\WINDOWS\uwluchalfnfqv\zqzphp

Process
↳ jiwspklgbdjd "c:\uwluchalfnfqv\tkhtayjfup.exe"

Creates FileC:\WINDOWS\uwluchalfnfqv\zqzphp
Creates FileC:\uwluchalfnfqv\zqzphp
Deletes FileC:\WINDOWS\uwluchalfnfqv\zqzphp

Network Details:

DNSprofiles.dexknows.com
Type: A
204.133.117.26
DNSwinterbright.net
Type: A
67.231.253.49
DNSprobablybright.net
Type: A
95.211.230.75
DNSsweetinside.net
Type: A
208.91.197.241
DNSsimplepeople.net
Type: A
91.194.77.112
DNSmotherdaughter.net
Type: A
208.91.197.26
DNSwindowpeople.net
Type: A
208.93.105.60
DNSwinterready.net
Type: A
184.168.221.47
DNSwindowbright.net
Type: A
DNSperhapsinside.net
Type: A
DNSwindowinside.net
Type: A
DNSwinterinstead.net
Type: A
DNSsubjectinstead.net
Type: A
DNSwinterexplain.net
Type: A
DNSsubjectexplain.net
Type: A
DNSsubjectbright.net
Type: A
DNSwinterinside.net
Type: A
DNSsubjectinside.net
Type: A
DNSfinishinstead.net
Type: A
DNSleaveinstead.net
Type: A
DNSfinishexplain.net
Type: A
DNSleaveexplain.net
Type: A
DNSfinishbright.net
Type: A
DNSleavebright.net
Type: A
DNSfinishinside.net
Type: A
DNSleaveinside.net
Type: A
DNSsweetinstead.net
Type: A
DNSprobablyinstead.net
Type: A
DNSsweetexplain.net
Type: A
DNSprobablyexplain.net
Type: A
DNSsweetbright.net
Type: A
DNSprobablyinside.net
Type: A
DNSseveralinstead.net
Type: A
DNSmaterialinstead.net
Type: A
DNSseveralexplain.net
Type: A
DNSmaterialexplain.net
Type: A
DNSseveralbright.net
Type: A
DNSmaterialbright.net
Type: A
DNSseveralinside.net
Type: A
DNSmaterialinside.net
Type: A
DNSseveraready.net
Type: A
DNSlaughready.net
Type: A
DNSseverabrown.net
Type: A
DNSlaughbrown.net
Type: A
DNSseverapeople.net
Type: A
DNSlaughpeople.net
Type: A
DNSseveradaughter.net
Type: A
DNSlaughdaughter.net
Type: A
DNSsimpleready.net
Type: A
DNSmotherready.net
Type: A
DNSsimplebrown.net
Type: A
DNSmotherbrown.net
Type: A
DNSmotherpeople.net
Type: A
DNSsimpledaughter.net
Type: A
DNSmountainready.net
Type: A
DNSpossibleready.net
Type: A
DNSmountainbrown.net
Type: A
DNSpossiblebrown.net
Type: A
DNSmountainpeople.net
Type: A
DNSpossiblepeople.net
Type: A
DNSmountaindaughter.net
Type: A
DNSpossibledaughter.net
Type: A
DNSperhapsready.net
Type: A
DNSwindowready.net
Type: A
DNSperhapsbrown.net
Type: A
DNSwindowbrown.net
Type: A
DNSperhapspeople.net
Type: A
DNSperhapsdaughter.net
Type: A
DNSwindowdaughter.net
Type: A
DNSsubjectready.net
Type: A
DNSwinterbrown.net
Type: A
DNSsubjectbrown.net
Type: A
DNSwinterpeople.net
Type: A
DNSsubjectpeople.net
Type: A
DNSwinterdaughter.net
Type: A
DNSsubjectdaughter.net
Type: A
DNSfinishready.net
Type: A
DNSleaveready.net
Type: A
DNSfinishbrown.net
Type: A
DNSleavebrown.net
Type: A
DNSfinishpeople.net
Type: A
DNSleavepeople.net
Type: A
DNSfinishdaughter.net
Type: A
DNSleavedaughter.net
Type: A
DNSsweetready.net
Type: A
DNSprobablyready.net
Type: A
HTTP GEThttp://windowbright.net/index.php
User-Agent:
HTTP GEThttp://winterbright.net/index.php
User-Agent:
HTTP GEThttp://probablybright.net/index.php
User-Agent:
HTTP GEThttp://sweetinside.net/index.php
User-Agent:
HTTP GEThttp://simplepeople.net/index.php
User-Agent:
HTTP GEThttp://motherdaughter.net/index.php
User-Agent:
HTTP GEThttp://windowpeople.net/index.php
User-Agent:
HTTP GEThttp://winterready.net/index.php
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 204.133.117.26:80
Flows TCP192.168.1.1:1032 ➝ 67.231.253.49:80
Flows TCP192.168.1.1:1033 ➝ 95.211.230.75:80
Flows TCP192.168.1.1:1034 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1035 ➝ 91.194.77.112:80
Flows TCP192.168.1.1:1036 ➝ 208.91.197.26:80
Flows TCP192.168.1.1:1037 ➝ 208.93.105.60:80
Flows TCP192.168.1.1:1038 ➝ 184.168.221.47:80

Raw Pcap
0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2077   : close..Host: w
0x00000040 (00064)   696e646f 77627269 6768742e 6e65740d   indowbright.net.
0x00000050 (00080)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2077   : close..Host: w
0x00000040 (00064)   696e7465 72627269 6768742e 6e65740d   interbright.net.
0x00000050 (00080)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2070   : close..Host: p
0x00000040 (00064)   726f6261 626c7962 72696768 742e6e65   robablybright.ne
0x00000050 (00080)   740d0a0d 0a                           t....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   77656574 696e7369 64652e6e 65740d0a   weetinside.net..
0x00000050 (00080)   0d0a0a0d 0a                           .....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   696d706c 6570656f 706c652e 6e65740d   implepeople.net.
0x00000050 (00080)   0a0d0a0d 0a                           .....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206d   : close..Host: m
0x00000040 (00064)   6f746865 72646175 67687465 722e6e65   otherdaughter.ne
0x00000050 (00080)   740d0a0d 0a                           t....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2077   : close..Host: w
0x00000040 (00064)   696e646f 7770656f 706c652e 6e65740d   indowpeople.net.
0x00000050 (00080)   0a0d0a0d 0a                           .....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2077   : close..Host: w
0x00000040 (00064)   696e7465 72726561 64792e6e 65740d0a   interready.net..
0x00000050 (00080)   0d0a0a0d 0a                           .....


Strings