Analysis Date2015-08-02 00:06:58
MD5795f89d94d824321e8700e3205c0f44b
SHA1822a2d3218ba06d4e81b4afb4e4121b1a822e227

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 73d245d31f5b661f5da75e9f0e7947b8 sha1: 1441685103abe967302845921743eae6068a64ba size: 299520
Section.rdata md5: 613750416043f9f225c1bae35b82e73d sha1: 5ce907113e001df1d71ddc47c151baf5e7073a10 size: 58880
Section.data md5: 743006191988c9894765f6055d587c91 sha1: 0f981f858ea3a527e8108297bd0325ba2dd13b6a size: 7680
Section.reloc md5: 84974f5da3d2d11de7bd7088d8fbc064 sha1: 97978fa38db9b96067aac5b2610ca2c142b82d3b size: 22528
Timestamp2015-05-11 07:12:01
PackerMicrosoft Visual C++ 8
PEhash6bdded81969be606293cd4ebdb652c4e22b0a07f
IMPhash70d9fd08222468697450587e9303d749
AVEset (nod32)Win32/Bayrob.W
AVDr. WebTrojan.Bayrob.1
AVK7Trojan ( 004c3a4d1 )
AVGrisoft (avg)Win32/Cryptor
AVBullGuardGen:Variant.Kazy.610032
AVRisingTrojan.Win32.Bayrod.b
AVBitDefenderGen:Variant.Kazy.610032
AVArcabit (arcavir)Gen:Variant.Kazy.610032
AVF-SecureGen:Variant.Kazy.610032
AVIkarusTrojan.Win32.Bayrob
AVClamAVno_virus
AVCAT (quickheal)TrojanSpy.Nivdort.OD4
AVMalwareBytesTrojan.Agent.KVTGen
AVFrisk (f-prot)no_virus
AVMcafeePWS-FCCE!795F89D94D82
AVMicroWorld (escan)Gen:Variant.Kazy.610032
AVAuthentiumW32/Nivdort.B.gen!Eldorado
AVCA (E-Trust Ino)no_virus
AVTrend MicroTROJ_BAYROB.SM0
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVEmsisoftGen:Variant.Kazy.610032
AVAd-AwareGen:Variant.Kazy.610032
AVSymantecDownloader.Upatre!g15
AVTwisterTrojan.Scar.jnji.cuzl
AVZillya!no_virus
AVPadvishno_virus
AVFortinetW32/Bayrob.T!tr
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.AF
AVKasperskyTrojan.Win32.Generic
AVAvira (antivir)TR/Spy.ZBot.xbbeomq
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\urwiqlphsdnuq\quxkuumrpmr
Creates FileC:\WINDOWS\urwiqlphsdnuq\quxkuumrpmr
Creates FileC:\urwiqlphsdnuq\xjb1lj6kwlw5ym2vrso.exe
Deletes FileC:\WINDOWS\urwiqlphsdnuq\quxkuumrpmr
Creates ProcessC:\urwiqlphsdnuq\xjb1lj6kwlw5ym2vrso.exe

Process
↳ C:\urwiqlphsdnuq\xjb1lj6kwlw5ym2vrso.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Experience Shell Certificate ➝
C:\urwiqlphsdnuq\xbzcgenqd.exe
Creates FileC:\urwiqlphsdnuq\zfuwpuuphpfr
Creates FilePIPE\lsarpc
Creates FileC:\urwiqlphsdnuq\quxkuumrpmr
Creates FileC:\WINDOWS\urwiqlphsdnuq\quxkuumrpmr
Creates FileC:\urwiqlphsdnuq\xbzcgenqd.exe
Deletes FileC:\WINDOWS\urwiqlphsdnuq\quxkuumrpmr
Creates ProcessC:\urwiqlphsdnuq\xbzcgenqd.exe
Creates ServiceTracking Solutions Service Information - C:\urwiqlphsdnuq\xbzcgenqd.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 808

Process
↳ Pid 856

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1212

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00
Creates FileWMIDataDevice

Process
↳ Pid 1852

Process
↳ Pid 1132

Process
↳ C:\urwiqlphsdnuq\xbzcgenqd.exe

Creates FileC:\urwiqlphsdnuq\zfuwpuuphpfr
Creates Filepipe\net\NtControlPipe10
Creates FileC:\urwiqlphsdnuq\quxkuumrpmr
Creates FileC:\WINDOWS\urwiqlphsdnuq\quxkuumrpmr
Creates File\Device\Afd\Endpoint
Creates FileC:\urwiqlphsdnuq\o4thgejodohv
Creates FileC:\urwiqlphsdnuq\bbrfzqa.exe
Deletes FileC:\WINDOWS\urwiqlphsdnuq\quxkuumrpmr
Creates Processonlq7qthnvsf "c:\urwiqlphsdnuq\xbzcgenqd.exe"

Process
↳ C:\urwiqlphsdnuq\xbzcgenqd.exe

Creates FileC:\urwiqlphsdnuq\quxkuumrpmr
Creates FileC:\WINDOWS\urwiqlphsdnuq\quxkuumrpmr
Deletes FileC:\WINDOWS\urwiqlphsdnuq\quxkuumrpmr

Process
↳ onlq7qthnvsf "c:\urwiqlphsdnuq\xbzcgenqd.exe"

Creates FileC:\urwiqlphsdnuq\quxkuumrpmr
Creates FileC:\WINDOWS\urwiqlphsdnuq\quxkuumrpmr
Deletes FileC:\WINDOWS\urwiqlphsdnuq\quxkuumrpmr

Network Details:

DNSprofiles.dexknows.com
Type: A
204.133.117.26
DNSwinterbright.net
Type: A
67.231.253.49
DNSprobablybright.net
Type: A
95.211.230.75
DNSsweetinside.net
Type: A
208.91.197.241
DNSsimplepeople.net
Type: A
91.194.77.112
DNSmotherdaughter.net
Type: A
208.91.197.26
DNSwindowpeople.net
Type: A
208.93.105.60
DNSwinterready.net
Type: A
184.168.221.47
DNSpossibleexplain.net
Type: A
DNSmountainbright.net
Type: A
DNSpossiblebright.net
Type: A
DNSmountaininside.net
Type: A
DNSpossibleinside.net
Type: A
DNSperhapsinstead.net
Type: A
DNSwindowinstead.net
Type: A
DNSperhapsexplain.net
Type: A
DNSwindowexplain.net
Type: A
DNSperhapsbright.net
Type: A
DNSwindowbright.net
Type: A
DNSperhapsinside.net
Type: A
DNSwindowinside.net
Type: A
DNSwinterinstead.net
Type: A
DNSsubjectinstead.net
Type: A
DNSwinterexplain.net
Type: A
DNSsubjectexplain.net
Type: A
DNSsubjectbright.net
Type: A
DNSwinterinside.net
Type: A
DNSsubjectinside.net
Type: A
DNSfinishinstead.net
Type: A
DNSleaveinstead.net
Type: A
DNSfinishexplain.net
Type: A
DNSleaveexplain.net
Type: A
DNSfinishbright.net
Type: A
DNSleavebright.net
Type: A
DNSfinishinside.net
Type: A
DNSleaveinside.net
Type: A
DNSsweetinstead.net
Type: A
DNSprobablyinstead.net
Type: A
DNSsweetexplain.net
Type: A
DNSprobablyexplain.net
Type: A
DNSsweetbright.net
Type: A
DNSprobablyinside.net
Type: A
DNSseveralinstead.net
Type: A
DNSmaterialinstead.net
Type: A
DNSseveralexplain.net
Type: A
DNSmaterialexplain.net
Type: A
DNSseveralbright.net
Type: A
DNSmaterialbright.net
Type: A
DNSseveralinside.net
Type: A
DNSmaterialinside.net
Type: A
DNSseveraready.net
Type: A
DNSlaughready.net
Type: A
DNSseverabrown.net
Type: A
DNSlaughbrown.net
Type: A
DNSseverapeople.net
Type: A
DNSlaughpeople.net
Type: A
DNSseveradaughter.net
Type: A
DNSlaughdaughter.net
Type: A
DNSsimpleready.net
Type: A
DNSmotherready.net
Type: A
DNSsimplebrown.net
Type: A
DNSmotherbrown.net
Type: A
DNSmotherpeople.net
Type: A
DNSsimpledaughter.net
Type: A
DNSmountainready.net
Type: A
DNSpossibleready.net
Type: A
DNSmountainbrown.net
Type: A
DNSpossiblebrown.net
Type: A
DNSmountainpeople.net
Type: A
DNSpossiblepeople.net
Type: A
DNSmountaindaughter.net
Type: A
DNSpossibledaughter.net
Type: A
DNSperhapsready.net
Type: A
DNSwindowready.net
Type: A
DNSperhapsbrown.net
Type: A
DNSwindowbrown.net
Type: A
DNSperhapspeople.net
Type: A
DNSperhapsdaughter.net
Type: A
DNSwindowdaughter.net
Type: A
DNSsubjectready.net
Type: A
DNSwinterbrown.net
Type: A
DNSsubjectbrown.net
Type: A
DNSwinterpeople.net
Type: A
DNSsubjectpeople.net
Type: A
DNSwinterdaughter.net
Type: A
DNSsubjectdaughter.net
Type: A
HTTP GEThttp://windowbright.net/index.php
User-Agent:
HTTP GEThttp://winterbright.net/index.php
User-Agent:
HTTP GEThttp://probablybright.net/index.php
User-Agent:
HTTP GEThttp://sweetinside.net/index.php
User-Agent:
HTTP GEThttp://simplepeople.net/index.php
User-Agent:
HTTP GEThttp://motherdaughter.net/index.php
User-Agent:
HTTP GEThttp://windowpeople.net/index.php
User-Agent:
HTTP GEThttp://winterready.net/index.php
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 204.133.117.26:80
Flows TCP192.168.1.1:1032 ➝ 67.231.253.49:80
Flows TCP192.168.1.1:1033 ➝ 95.211.230.75:80
Flows TCP192.168.1.1:1034 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1035 ➝ 91.194.77.112:80
Flows TCP192.168.1.1:1036 ➝ 208.91.197.26:80
Flows TCP192.168.1.1:1037 ➝ 208.93.105.60:80
Flows TCP192.168.1.1:1038 ➝ 184.168.221.47:80

Raw Pcap
0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2077   : close..Host: w
0x00000040 (00064)   696e646f 77627269 6768742e 6e65740d   indowbright.net.
0x00000050 (00080)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2077   : close..Host: w
0x00000040 (00064)   696e7465 72627269 6768742e 6e65740d   interbright.net.
0x00000050 (00080)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2070   : close..Host: p
0x00000040 (00064)   726f6261 626c7962 72696768 742e6e65   robablybright.ne
0x00000050 (00080)   740d0a0d 0a                           t....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   77656574 696e7369 64652e6e 65740d0a   weetinside.net..
0x00000050 (00080)   0d0a0a0d 0a                           .....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   696d706c 6570656f 706c652e 6e65740d   implepeople.net.
0x00000050 (00080)   0a0d0a0d 0a                           .....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206d   : close..Host: m
0x00000040 (00064)   6f746865 72646175 67687465 722e6e65   otherdaughter.ne
0x00000050 (00080)   740d0a0d 0a                           t....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2077   : close..Host: w
0x00000040 (00064)   696e646f 7770656f 706c652e 6e65740d   indowpeople.net.
0x00000050 (00080)   0a0d0a0d 0a                           .....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2077   : close..Host: w
0x00000040 (00064)   696e7465 72726561 64792e6e 65740d0a   interready.net..
0x00000050 (00080)   0d0a0a0d 0a                           .....


Strings