Analysis Date2015-07-29 14:36:21
MD5e273790899107dd9769ce5a090e9e072
SHA17af14cdc09195a3023cc67bd1e8ea064b78b30ed

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 2a9e29a09bf40404b087a4a59c151e36 sha1: e7d5f5ceba65c00df30f0bcddfa75fe98ceb9e53 size: 793600
Section.rdata md5: bd1089d34f9c2fc92493c7b2a54fff88 sha1: 03bb6a76e397cf606cd54722910d54a8059c87d3 size: 57856
Section.data md5: 484d5e51531f45458f09063bca39db55 sha1: cbabb756eaf25c60253af9a372710a9e141c06b5 size: 400896
Timestamp2014-09-05 11:04:33
PackerMicrosoft Visual C++ ?.?
PEhashea275a90a0ce868c3b3563faeb912ab8a70070ca
IMPhashf2864cd64b1bcec9ef1b8cf9c3741f43
AVSymantecDownloader.Upatre!g15
AVMicroWorld (escan)Gen:Variant.Symmi.22722
AVAvira (antivir)TR/Crypt.Xpack.268607
AVEset (nod32)Win32/Kryptik.CCLE
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.AE
AVIkarusWin32.Cryptor
AVBitDefenderGen:Variant.Symmi.22722
AVTwisterno_virus
AVVirusBlokAda (vba32)no_virus
AVAlwil (avast)Kryptik-OOC [Trj]
AVFortinetW32/Kryptik.DDQD!tr
AVPadvishno_virus
AVTrend MicroTROJ_WONTON.SMJ1
AVEmsisoftGen:Variant.Symmi.22722
AVMalwareBytesno_virus
AVK7no_virus
AVGrisoft (avg)Win32/Cryptor
AVAd-AwareGen:Variant.Symmi.22722
AVRising0x58e50d2e
AVArcabit (arcavir)Gen:Variant.Symmi.22722
AVMcafeeno_virus
AVCA (E-Trust Ino)no_virus
AVFrisk (f-prot)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVBullGuardGen:Variant.Symmi.22722
AVCAT (quickheal)no_virus
AVKasperskyTrojan.Win32.Generic
AVZillya!no_virus
AVF-SecureGen:Variant.Symmi.22722
AVAuthentiumW32/Nivdort.A.gen!Eldorado

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\WINDOWS\system32\jsypkrgidqs\tst
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\qn5jpx1lg5gd8femtpgs.exe
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\qn5jpx1lg5gd8femtpgs.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\qn5jpx1lg5gd8femtpgs.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Reports SNMP Socket Spooler DHCP Server ➝
C:\WINDOWS\system32\ghqcttbmq.exe
Creates FileC:\WINDOWS\system32\ghqcttbmq.exe
Creates FileC:\WINDOWS\system32\drivers\etc\hosts
Creates FileC:\WINDOWS\system32\jsypkrgidqs\lck
Creates FileC:\WINDOWS\system32\jsypkrgidqs\tst
Creates FileC:\WINDOWS\system32\jsypkrgidqs\etc
Deletes FileC:\WINDOWS\system32\\drivers\etc\hosts
Creates ProcessC:\WINDOWS\system32\ghqcttbmq.exe
Creates ServiceSearch Authentication IPsec Software - C:\WINDOWS\system32\ghqcttbmq.exe

Process
↳ Pid 804

Process
↳ Pid 852

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1112

Process
↳ Pid 1212

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1848

Process
↳ Pid 1136

Process
↳ C:\WINDOWS\system32\ghqcttbmq.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝
1
Creates FileC:\WINDOWS\system32\jsypkrgidqs\cfg
Creates FileC:\WINDOWS\system32\jsypkrgidqs\lck
Creates Filepipe\net\NtControlPipe10
Creates FileC:\WINDOWS\system32\lrjygsp.exe
Creates FileC:\WINDOWS\system32\jsypkrgidqs\run
Creates FileC:\WINDOWS\system32\jsypkrgidqs\tst
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\jsypkrgidqs\rng
Creates FileC:\WINDOWS\TEMP\qn5jpx1s4lgd8f.exe
Creates ProcessC:\WINDOWS\TEMP\qn5jpx1s4lgd8f.exe -r 47637 tcp
Creates ProcessWATCHDOGPROC "c:\windows\system32\ghqcttbmq.exe"

Process
↳ C:\WINDOWS\system32\ghqcttbmq.exe

Creates FileC:\WINDOWS\system32\jsypkrgidqs\tst

Process
↳ WATCHDOGPROC "c:\windows\system32\ghqcttbmq.exe"

Creates FileC:\WINDOWS\system32\jsypkrgidqs\tst

Process
↳ C:\WINDOWS\TEMP\qn5jpx1s4lgd8f.exe -r 47637 tcp

Creates File\Device\Afd\Endpoint
Winsock DNS239.255.255.250

Network Details:

DNSsaltsecond.net
Type: A
74.220.199.6
DNSwheelreply.net
Type: A
50.22.11.22
DNSlifecount.net
Type: A
50.63.202.59
DNSmouthcount.net
Type: A
95.211.230.75
DNSlonghope.net
Type: A
192.254.233.60
DNSlifehope.net
Type: A
208.91.197.26
DNSsouthblood.net
Type: A
DNSenemydont.net
Type: A
DNSsellsmall.net
Type: A
DNSenemyfell.net
Type: A
DNSlifefell.net
Type: A
DNSenemycount.net
Type: A
DNSmouthcompe.net
Type: A
DNStillcompe.net
Type: A
DNSmouthhour.net
Type: A
DNStillhour.net
Type: A
DNSmouthfell.net
Type: A
DNStillfell.net
Type: A
DNStillcount.net
Type: A
DNSshallcompe.net
Type: A
DNSdeepcompe.net
Type: A
DNSshallhour.net
Type: A
DNSdeephour.net
Type: A
DNSshallfell.net
Type: A
DNSdeepfell.net
Type: A
DNSshallcount.net
Type: A
DNSdeepcount.net
Type: A
DNSpushcompe.net
Type: A
DNSfridaycompe.net
Type: A
DNSpushhour.net
Type: A
DNSfridayhour.net
Type: A
DNSpushfell.net
Type: A
DNSfridayfell.net
Type: A
DNSpushcount.net
Type: A
DNSfridaycount.net
Type: A
DNSalongcompe.net
Type: A
DNSdecembercompe.net
Type: A
DNSalonghour.net
Type: A
DNSdecemberhour.net
Type: A
DNSalongfell.net
Type: A
DNSdecemberfell.net
Type: A
DNSalongcount.net
Type: A
DNSdecembercount.net
Type: A
DNSsoilhope.net
Type: A
DNSlongleft.net
Type: A
DNSsoilleft.net
Type: A
DNSlongthirteen.net
Type: A
DNSsoilthirteen.net
Type: A
DNSlonghurry.net
Type: A
DNSsoilhurry.net
Type: A
DNSwheelhope.net
Type: A
DNSsaidhope.net
Type: A
DNSwheelleft.net
Type: A
DNSsaidleft.net
Type: A
DNSwheelthirteen.net
Type: A
DNSsaidthirteen.net
Type: A
DNSwheelhurry.net
Type: A
DNSsaidhurry.net
Type: A
DNSstickhope.net
Type: A
DNSballhope.net
Type: A
DNSstickleft.net
Type: A
DNSballleft.net
Type: A
DNSstickthirteen.net
Type: A
DNSballthirteen.net
Type: A
DNSstickhurry.net
Type: A
DNSballhurry.net
Type: A
DNSenemyhope.net
Type: A
DNSenemyleft.net
Type: A
DNSlifeleft.net
Type: A
DNSenemythirteen.net
Type: A
DNSlifethirteen.net
Type: A
DNSenemyhurry.net
Type: A
DNSlifehurry.net
Type: A
DNSmouthhope.net
Type: A
DNStillhope.net
Type: A
DNSmouthleft.net
Type: A
DNStillleft.net
Type: A
DNSmouththirteen.net
Type: A
DNStillthirteen.net
Type: A
DNSmouthhurry.net
Type: A
DNStillhurry.net
Type: A
DNSshallhope.net
Type: A
DNSdeephope.net
Type: A
DNSshallleft.net
Type: A
DNSdeepleft.net
Type: A
DNSshallthirteen.net
Type: A
DNSdeepthirteen.net
Type: A
DNSshallhurry.net
Type: A
DNSdeephurry.net
Type: A
DNSpushhope.net
Type: A
HTTP GEThttp://saltsecond.net/index.php?method=validate&mode=sox&v=031&sox=3bc5aa00
User-Agent:
HTTP GEThttp://wheelreply.net/index.php?method=validate&mode=sox&v=031&sox=3bc5aa00
User-Agent:
HTTP GEThttp://lifecount.net/index.php?method=validate&mode=sox&v=031&sox=3bc5aa00
User-Agent:
HTTP GEThttp://mouthcount.net/index.php?method=validate&mode=sox&v=031&sox=3bc5aa00
User-Agent:
HTTP GEThttp://longhope.net/index.php?method=validate&mode=sox&v=031&sox=3bc5aa00
User-Agent:
HTTP GEThttp://lifehope.net/index.php?method=validate&mode=sox&v=031&sox=3bc5aa00
User-Agent:
HTTP GEThttp://saltsecond.net/index.php?method=validate&mode=sox&v=031&sox=3bc5aa00
User-Agent:
Flows TCP192.168.1.1:1036 ➝ 74.220.199.6:80
Flows TCP192.168.1.1:1038 ➝ 50.22.11.22:80
Flows TCP192.168.1.1:1039 ➝ 50.63.202.59:80
Flows TCP192.168.1.1:1040 ➝ 95.211.230.75:80
Flows TCP192.168.1.1:1041 ➝ 192.254.233.60:80
Flows TCP192.168.1.1:1042 ➝ 208.91.197.26:80
Flows TCP192.168.1.1:1043 ➝ 74.220.199.6:80

Raw Pcap
0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3126736f   ode=sox&v=031&so
0x00000030 (00048)   783d3362 63356161 30302048 5454502f   x=3bc5aa00 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2073 616c7473   ose..Host: salts
0x00000070 (00112)   65636f6e 642e6e65 740d0a0d 0a         econd.net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3126736f   ode=sox&v=031&so
0x00000030 (00048)   783d3362 63356161 30302048 5454502f   x=3bc5aa00 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2077 6865656c   ose..Host: wheel
0x00000070 (00112)   7265706c 792e6e65 740d0a0d 0a         reply.net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3126736f   ode=sox&v=031&so
0x00000030 (00048)   783d3362 63356161 30302048 5454502f   x=3bc5aa00 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a206c 69666563   ose..Host: lifec
0x00000070 (00112)   6f756e74 2e6e6574 0d0a0d0a 0a         ount.net.....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3126736f   ode=sox&v=031&so
0x00000030 (00048)   783d3362 63356161 30302048 5454502f   x=3bc5aa00 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a206d 6f757468   ose..Host: mouth
0x00000070 (00112)   636f756e 742e6e65 740d0a0d 0a         count.net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3126736f   ode=sox&v=031&so
0x00000030 (00048)   783d3362 63356161 30302048 5454502f   x=3bc5aa00 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a206c 6f6e6768   ose..Host: longh
0x00000070 (00112)   6f70652e 6e65740d 0a0d0a0d 0a         ope.net......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3126736f   ode=sox&v=031&so
0x00000030 (00048)   783d3362 63356161 30302048 5454502f   x=3bc5aa00 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a206c 69666568   ose..Host: lifeh
0x00000070 (00112)   6f70652e 6e65740d 0a0d0a0d 0a         ope.net......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3126736f   ode=sox&v=031&so
0x00000030 (00048)   783d3362 63356161 30302048 5454502f   x=3bc5aa00 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2073 616c7473   ose..Host: salts
0x00000070 (00112)   65636f6e 642e6e65 740d0a0d 0a         econd.net....


Strings