Analysis Date2014-08-07 00:23:13
MD59ce7101f0786fbaed32199da16a8a309
SHA1742a1aabf8ea52b886c2830d903dd1be655a5548

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 6e86899ea2ccd37e430b854789808273 sha1: bad9cf7102b9e8990b8e7a9acc2d2dab2281cd9d size: 4096
Section.rdata md5: 775b1b9b7de082046e13db8348304075 sha1: 423c94d9a5dedd8064c739cbd3413c7f4cb01440 size: 1024
Section.data md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rsrc md5: 89612b53145ec4d7b6496042aabfcbb7 sha1: bb4a39dcfb0585cc561e3ee1ee47a2c37ac6d08e size: 59392
Timestamp2014-07-01 17:46:15
VersionLegalCopyright: Copyright (C) 2007
InternalName: tendency
FileVersion: 8,4,4,26
ProductName: tendency Application
ProductVersion: 3,3,1,45
FileDescription: tendency Application
OriginalFilename: tendency.exe
PEhash5d6b51049c2846e84fc46d037a1604fef747a084
IMPhash5fb1dc1346b88e9086c0c7d29c6f059c
AV360 SafeGen:Trojan.Heur.Zbot.eq0@bGb93vbi
AVAd-AwareGen:Trojan.Heur.Zbot.eq0@bGb93vbi
AVAlwil (avast)Dropper-gen [Drp]
AVArcabit (arcavir)no_virus
AVAuthentiumW32/Trojan.ABVF-8224
AVAvira (antivir)TR/Dropper.Gen
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)Trojan.Cutwail.r4
AVClamAVno_virus
AVDr. WebTrojan.MulDrop3.14959
AVEmsisoftGen:Trojan.Heur.Zbot.eq0@bGb93vbi
AVEset (nod32)Win32/Kryptik.CFVL
AVFortinetW32/Cutwail.CFVL!tr
AVFrisk (f-prot)no_virus
AVF-SecureGen:Trojan.Heur.Zbot.eq0@bGb93vbi
AVGrisoft (avg)Agent
AVIkarusTrojan.Win32.Cutwail
AVK7Trojan ( 0049cbf01 )
AVKasperskyTrojan.Win32.Cutwail.deq
AVMalwareBytesno_virus
AVMcafeeRDN/Downloader.a!sb
AVMicrosoft Security EssentialsTrojanDownloader:Win32/Cutwail.BS
AVMicroWorld (escan)Gen:Trojan.Heur.Zbot.eq0@bGb93vbi
AVNormanwinpe/ZBot.UHTO
AVRisingno_virus
AVSophosno_virus
AVSymantecTrojan.Gen
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\miqhynrossex ➝
C:\Documents and Settings\Administrator\miqhynrossex.exe
RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\AppManagement ➝
NULL
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\Crypto\RSA\S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-500\a18ca4003deb042bbee7a40f15e1970b_666939c9-243b-475e-9504-51724db22670
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\miqhynrossex.exe
Creates Mutexmiqhynrossex

Network Details:

DNSsmtp.glbdns2.microsoft.com
Type: A
65.55.176.126
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
63.250.193.228
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
98.138.105.21
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
98.139.211.125
DNSsmtp.live.com
Type: A
DNSsmtp.mail.yahoo.com
Type: A
Flows TCP192.168.1.1:1031 ➝ 65.55.176.126:25
Flows TCP192.168.1.1:1032 ➝ 63.250.193.228:25

Raw Pcap

Strings
.8u...
4
041904b0
3,3,1,45
8,4,4,26
across
&acting; embarrassed
&actress regardless
added addressed
addition rather
Admirable everything+appealing father himself Cousine perceptive*approaching moments illustration creatures4contradicted brushed taking something daresay seemed!guessed continued Julia important8produced rural opined impression sauntered Dormer seemed8almost though conveniences considering slowly imperative
&advised
affairs
again
&Against been--and
&already
&already C??lie
altogether subjects
always position
&always Sherringham
amiable wouldnt specimens
&another direct
&another estate
&anybody reply
&anything careful
&anythings Paradise
applied arrange
&apprehension smiling
:artless spoken affairs words infatuation adoption national0tolerate insatiate chosen Bohemian besides Tiens
ashamed'evening elapsed better wonderful judged.Carr?? critics Dashwood invite rather position/articles herself future; commercial corner--the
&asked figures
assumption
&attached
&augmented
bargain accommodate
beauty
&beauty
become
&before enamels
Before to-day examples
behind
&bending nearest
between
&between mortal
&Biddys
&blessed
&blossom
bowled
brocanteur
&broken before
&burning
&business agency
business riddle Gardens
called
cannon noble?--how keeping friendly
&canvas
captured
carefully do--you
Carterets
central
&centurys pretty
charity--without exactly
&Chayter
chill then--youve)English lodgings circled continuity brain-taught associated returned taste faith people
&choose induced
&clapped
clear
clever
&clever
clever sentiments
&clever unchallenged
&Clorinde
closed
&comedy
&coming
company blinds Miriam faith
&complimentary
composing
&conceal excuse
&conduct giving
&confidence terrible
considering
&continued Tories
Copyright (C) 2007
&course
course embark development to-day
&courses
course seemingly
&creatures exactly
cried
critic
critical$diversion affection himself possibly
&curtains become
customary really little evening
&Dallows undertaking
decision
&declaration
declared little
&degree
&delightful
&derivative
different
&dinner-party--he question
&discussion almost
&divine telling
&doesnt
&Dormer it--without
&Dormer performing
dragged us--each tended paint
droll against ten-shilling
&dropped Madame
eating
&effort
&elapsed
&eloquence tongue
embassy it--had appearance
&encounter appeared
&enemies
engaged dropped
&engagement
&enlightened
&espousing moneys
everything
everything delays surprise!--for
evidently
exaggerate
exclaimed wondrous
&exclamation clever
&explanation impose
&exponent quieter
express manner
extinguished ordeal
&families centuries
&fathers
&figure
FileDescription
FileVersion
&flashed
&flocking
follow express--I
friend magnificent
&friend without
(frugality constituted certain capricious;personally school baignoire should Madame continuity theres
future
&future candour
Gabriel
Gabriel received Lovick perhaps
&gained
&gallantry
&general
gentleman forbore represents
getting
giving
graced like--paint
&grateful woman
Gutenberg enough about
&handling because
hansom wouldnt
&happened
hateful
havent people variety
having
&having miracles
herself
&hesitated
&higher everything
&highly styles
&himself
&himself later
himself opinions
&honest something
&horrid
hospitable
&hostess
house
&house little
&howling
&ignorance
immense galleries
impenetrable inspired
impulse greater training
incident validity points element
&inclined
&indication;
&infatuation
&inferior Fran?ais
information
informing explanatory little
infringement remarked
&injury
innocent--thousands
instance--from
interest
interested waived
InternalName
;I&Q
&it--Im
&itself qualities
Julia1indiscreet Carteret sense placidly Peter precious!distinction cathedral information+father refuse completed added to-day fallen0really something Rooth Miriams surprise question
&Julia mother
&kinsmans Peter
&knocked
knowing
&lady--to centre
&language
LegalCopyright
&lightly yourself
&likely
limbs it--sometimes
&limits therefore
literally ready
&little
Little
little better appeals reflexion
little responsibility
little theres fraternising
&London--go
&looked
&looked patience
losing
Madame
Madame imploringly
manner
&manner repeated
&married--these little
&martyr
&matter without
&meaning
&me--not conception
&mentioned
&mercy better
&might--I
&mingled
Miriam
mirror desire There
mirrors usually
missed
moment; freedom
moment magnified
&moments
moreover
morning
mother necessity
mother retention
MS Shell Dlg
&narrated allude
nature speaking equally doctrines
&nearer
&Neither different
&Never mistook
&night
&nineteenth months
nothing
nothing exposure; confidence whatever
noting Miriam alone
now--something should
&objection
&object replied
obligations silence
&occupied half-hour
&official
OriginalFilename
&others
others--a Nicholas7benefactor something carpet always--not unholy listened)friend finding thought foreigners glanced(richest simplicity direction Sherringham*Julias attending expectations distributing>Dormer affectionate seemed proposition feeling solitude please almost contentedly richly stayedEspeech believing beautiful lady--sometimes impatient matter answering
&painted
painting
&Palais said--not
&Parliament amusement
passion
pencil--the
&performance
Perhaps Julia--nothing entreat
&perversity importance
Peter
pieces--is
&placed
&placed hundred
playing advertisement-sheet
please learned thinks
&plenty ball-room
poetry
point!--and
&portals
&portrait experience
&possible
&possible afraid
&postern
&practical corner
&practice anomalous
&presence
&presently remembered
previous crack
&private
&probation spirit
problems
ProductName
ProductVersion
&professing become
profession--Biddys rubbish3listened attitude--the dreariness Hawthorne without.leaving quavered simple putting opened visitor-analogy serious Macgeorge--what strong Madame
proportion
&propriety Foundation
&providing
&question
&questionable
&questions
&Rachel prolongation
really
&really
&reasonable
&reason resorted
&received
&received interpreter
REFUND reminded
&relation
&relent own--those
relevant
&remark hostesss
&remember States
&resented
resource disturb
&resource mother
responses
&rested
result expression
&retorted theatre
&retreat insist
&returned scarcely
RichEdit20A
richness
right
&right duties
romantic call--he Signor
&Rooth
ruffled immense
sacrifices
&sapient
&satiric reason
&scattered nature
sc??ne friend
&seated
&Sections called
seeing
seeing impatient
&seemed
&serenity
&serious
&seriously usage
&Sherringham
&Sherringham pretty
&should
should effort
should matter
silence
simple
&simple cousin;
&sketch
&something
&sometimes
sometimes daughter
&speak neither
&splendid friend
&spontaneous
s??tait canvas dependent others
startled
stayed
stockbroker
&strange
stress;
StringFileInfo
studio remoter
studying actresss
&style course
&suburban altogether
suffers disconcerted
&superficial
&supposed
&surprise
surprised always portraits#herself towering reinstated finding
&sweetness
sympathy little
SysListView32
Tahoma
talent
talked others
tendency
tendency Application
tendency.exe
that--and Miriam
&themes
them--scarce
&there
there affection irregular compliance
&therefore darkened
things
&thinking other
&thinks professions
though replied
&thought
&thought constituted
&Thoughtfully family
&through Chayter
tinsel sometimes
to-morrow
to-morrow pudding good-natured
&touched
&trained actors
&training
Translation
tremendously piously;
triumph
&trust continued
&turned
VarFileInfo
variety-show
&veritable Constantinople;
&visitor grandly
VS_VERSION_INFO
&vulgar sometimes
&wage-earning servants--she
&want--to
warmth inspired supper
&waters actress--you
what--a
where another
&which
&which affairs
windows
windows soreness
&wished before
wished other
wonder anything
Wonderful Michael
&worlds;
&wouldnt promptly
wretchedly second
&writing station
yesterday
you--I
}+0[aN&
=4%sEL
4$U[j~
6)#xCjKV
8'W#3>
=9Db*i
]a#a9{
%=aE 8
c *cUD
]c[:lf
)CoU!s
cp<8@-
CreateWindowExA
c#V'n^
+[CZ3 
@.data
DefWindowProcA
DispatchMessageA
;E	.;M
explorer
 f1?B_
fD,o0j
FindResourceA
!&Gc`A
GetCurrentProcess
GetExitCodeProcess
GetMessageA
GetModuleHandleA
GetProcessHeap
g*$"pB
H@'\!?5UOV
HeapAlloc
$hXdk^/=HB#
H,/+y.
` -/Ih}
i]\q01
}\J1k7qY
?k7B%`
$kDwh"
Kep$\!
kernel32.dll
k%hDhUx
KillTimer
kZ_*S"O
l#1e`/L
LoadCursorA
LoadIconA
LoadResource
L-@rn8
L;-s}c[
[L`xb^+
@M`DX+
MKJuoiu9867_965iygfhj
m,zf0[*
nArzyk
|n[E2$
nibFV0
nx"cbEs
?o!e+GK
|O<~J"
\p*-lg
PostQuitMessage
?pZjl-
q=5bgQQ&>eEi
`.rdata
RegisterClassExA
SetTimer
ShowWindow
!This program cannot be run in DOS mode.
TKq>-:
"tO;;5R
T#q!7Y
TranslateMessage
TU8f-v
UpdateWindow
user32.dll
vTRAR 
VWw8Fy0)	
Wu'	`JA
Y)9'"~
=yC+rO>j
	~-YOd
Y>`/oS
YxpGYb
zxn@A2