Analysis Date2018-06-06 15:17:13
MD55fcd39ed68258d2e6b76243f0f945c84
SHA1aad8e0d8b9a813a138fb49fc8f34e14d2df46137

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.textE0 md5: f58aff9291f8b26420145460b3a1fdb8 sha1: 0f83aae0a81ca2a6db06ab48cfbc058797169de0 size: 16896
Section.dataE0 md5: 2b2d1c15c6081bff4ddf165d42e6f9c8 sha1: 347c90f282a5e0876a2ec659708caf16a9c0a13f size: 6144
Timestamp2014-08-05 15:12:55
VersionLegalCopyright: © Корпорация Майкрософт. Все права защищены.
InternalName: MSPAINT
FileVersion: 5.1.2600.5918 (xpsp_sp3_qfe.091216-2118)
CompanyName: Корпорация Майкрософт
ProductName: Операционная система Microsoft® Windows®
ProductVersion: 5.1.2600.5918
FileDescription: Paint
OriginalFilename: MSPAINT.EXE
PackerPECompact 2.5x -> Jeremy Collake
PEhash6be449613298b32b50d767124636b04e5dfb70b7
IMPhash09d0478591d4f788cb3e5ea416c25237
AV360 Safeno_virus
AVAd-Awareno_virus
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVArcabit (arcavir)no_virus
AVAuthentiumno_virus
AVAvira (antivir)TR/Symmi.44947
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftGen:Variant.Symmi.44947
AVEset (nod32)Win32/Spy.Zbot.ABX
AVFortinetW32/URELAS.AM!tr
AVFrisk (f-prot)no_virus
AVF-SecureGen:Variant.Symmi.44947
AVGrisoft (avg)Zbot.MIO
AVIkarusno_virus
AVK7no_virus
AVKasperskyTrojan.Win32.VB.cooh
AVMalwareBytesSpyware.Passwords.ED
AVMcafeeRDN/Generic PWS.y!b2q
AVMicrosoft Security EssentialsPWS:Win32/Zbot
AVMicroWorld (escan)no_virus
AVNormanno_virus
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus
AVYara APTno_virus
AVZillya!no_virus

Runtime Details:

Screenshot

Process
↳ C:\Windows\System32\lsass.exe

Process
↳ C:\Users\Phil\AppData\Local\Temp\aad8e0d8b9a813a138fb49fc8f34e14d2df46137.exe

Creates Mutex

Network Details:


Raw Pcap

Strings
B!.

041904B0
5.1.2600.5918
5.1.2600.5918 (xpsp_sp3_qfe.091216-2118)
CompanyName
FileDescription
FileVersion
InternalName
LegalCopyright
 Microsoft
MSPAINT
MSPAINT.EXE
OriginalFilename
Paint
ProductName
ProductVersion
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
 Windows
?				>
/,=%' *
'$.?#&	
$+-$)!
*/$#.,
	<>!'		
		___\
						
							
								
									
										
											
												
0,0'0Q3
0!0%3=6L0N3G2U5V0m0y0~0u0
01?&?'!~;13
0+395=553A3@3]3i0n3c3r0
(#04 0%
0.4%:=:<:N:F3^0f0t6v0
0'8.:t5#2			
0+9):3$q
:&0<9Y;b9
	0	AQK	
0B?_sb
%'0-${D
0E5P7i6p7
0I2j7{1
< <\0u4
102<-:4
1.1>262N;]1R6j2f1~1u1
/1=15?z!
135B5W6c6
=.=%13;N8f;~;
1(5"2 221?0<0@2F2@2]9]2P2W2h4a4o1x2r1v2
1$6G6W6i6`6
,$1'7/9*
1"9:9N9X?
({1AGt1
1i)*Ab_c@R
		_`1Q
	1Waus
=1:\=x>
2+014s0
2#>==04A4^>
$2>)( +0$ 'a1f"+#6$<*:# 		
2?0O0A0j3
2!1?40764M4@7G7Z7R7T4l7y7p786?625J6B1	
2??1922&
2#2>0K0O2B0c2x0
2)2&20272G1^2U2b1|2s2
2,225A1b2f9~5
2!2H2`2~2
2301w0
252L5G5_6u5
253A4F4h0g0
;+262H1[2l2w2
297M7T6Q5v5
	2(		ASCC@YGP				d
2k6:4~7
?>*</2nkx309	
]-2XZ@
3+1,3!3:96323J3E4V3c3
33)/0/!q70&	
3$350I3]7b3}9u4
364i=;<2:N5K5
<:3+7-5$2	
#3)8<'
3|.9}N
=,3C2U3
	3	E[K
3F1^3h0|0
3J>^4p>
3M)!{C
		3M-J{
3v1p2]3
427Y3m0
44432222221
4)4?7O4_3
-455-7!6
<-<%?4?5?M?L?]?U?m<e?u<
4&784E0f4}0
	498345abq920	
4.*H	^
4I4P4c4s7
4JRx+b
4M6T5c6
4pmwt	
4	$	?UM
;?5<,,
))&=;5
	5															
53OHATyWRFF
5+4-4?4
= 5.555J6Y5
5$6:114J2]4j5|4q4
5.6&6=650M6E6[6U5m?e6}?v6
56N6]2R1j8l2}2r2
595L6Z<f6
		5	@chnEek{mxpM
5D4I6			{
5^V`5U<
	5XK	g
624C6F4m4
:6#3';=5
6 6?1N6w7
6)6&59636K6F5S6e5{2s3
6=6I6\6f1s6
;$;68m;};
6	imK		
}6OO}2b;
6U-Ly3
6Y:R0q0
6Z_^`1;
7*2f7v5
=%7<2N7@=m4v4
7-4N4D4^7`4~3
75<E?c?
7]6g6z6
7.7%7=>57M>E7V>m7c7}7
7$7,;>7<>L>T>U=d>e7}=u=
7/7O7Y=U4
7.7\=V7
<78R;y<
7	|/c	a	
7Dl @P$,
<-<&<=<7?E9X<k<e<s<
7--I	c
7JH6]9
7;j/i9QD
?(<??7?J?^?W?m?d?z?
7L0Y0d3
7NO^)}
7V|G\Z
_7W	}@
7Y\])}
7ZFZ]|q
%(8&:'2%
=$?8<48C:U:b?
8(>58F>l=n8e8x>
8+*'7;
:8:7?n<
8.=&;?86?M>h=c=x8
8,8"808
8.8&86>N8C;^;S>n;~;u8
;+8:8J>
,,8#9%/
!(89(>.
89;E;k;)8
:=8C8d;
8FLtb]Q
?#8I?Z8
;=:8&<p923594={"6f+)/ ci8g
;.8S;p;
		\_^9
9				~
]"=9<0 8S
>)>-=!>&=9>==1>5=J>M>I=E=Z>[=R=V=i>m=a>f>z=~>s>v>
:):#919N:Y:m9
?9=1>m>`;,1
'94%$0$6&
9@=*<5<
;98X=U=m;
9(9$9C<m:
9.:':;9A9i:w9
:&9=9M<F9^?U?m9`?~9v<
]/9al,H	c
>!9b9k=
9Bp5,F
9I8U0a8
9j1x;08|<
9k>3<I=\?U?c=q?
9K6Vzb
9.:%:>:M:E?V9f:v:
;;9S;i=o9d>
9~:w:(>L8P;f;
_a)-		^
	[[a		
	]_\a	
.?%/A{
A>2C2y
	a4		a9		e;	
		\]^a7GK
A7	wy2
a#:;8$>)(m		
A923?D
		AA}1B
a!aI	a
		A|bc3[;
[a;bI	X
			aBt`
a-CO	Y
adseKa`uz6<}nqmlhu(wt`swy
	{!a>@H
\aIRd|b
	A_K	'
A+K	M(K
AK	X	:
Alm|O~nmxl
aLNK	`
a]pp~!
		aq(K	
AS_\]c
_aUEI	
	AVAB_XZ
		av(K	
a``WUG
		ay(K	
;B2X9u8-3X8
	b86|>b
;.;B9C8
?b**AaZ`KY
bB^aEIOdBK
bDiGBV
B--"E*qy
Bfgxkgt#Modkza
b)G		]:
BI1A7|R
bK	bybK	Z
`	b}*K	c	
BL4D7{
			b>m
@B>_R%_!M
	bs8K	
			bwp;,($p6+}I.z6(a
BXXY.='
by"		i=
<$(B	Z
b}}z				/x1%$)z
C2DbgMs
		\_^c7
			c	a
		c	a.A
cb+0F\c,
c	d2&o
C	{DG@F_E	@UUIU
@`cdvs/@ghanabk7
C[F_R[R
		_cGQ
Cgxo{`chdlnCgh~iain~
		cIf	9		_c
c	i>OK
C`=K\@
\^_cLR
		[cLR
	Co$Deh`o`hm$Z`gil			
}:c+Q3
c	WiTJK
}>c	[Y
c/YaB@
^_]c-Ye6"o
]c	Yf>
da.0Fd
dE.		a
DEITMC^[
$dgfm{URP
Diw|hoaNfpc
D	-k0UqV0H
dntjog,fpl
	Do$Gfcl'@k}na7*,z
DP}eS!
D-&PZSk
D%?QX^k ]c6 l
\dxonbz}o{Iekzy]	
		_`dY
d	Y	{	c	{
d_^]]]\[ZC
@E3OC>HKD
e8		m`|
e	:		a	
EA@B:ghFRD
Eb}e~efjblhLtjamgni	
E	}-%c
edm*#$z+
E-DXYYc
EexixefjbinMll|ifld}		O
E+=$F-
e}}}feep				b}}yy		
e.*Ff^fMQ
!	EjH	
E-qKt7
E.u9s-
		EUVKOAEWCD@
>*>*>F>{=
fccbTSD
_f,)Fkf
f.FV\b[cH	U
~ffxhpo~`ag
]flkz	BL]GLF:<"jbb
	_f+)		X
?G=[=\:{=
gb>H}nqh
/	^\^_g	c(
`g*dqhyu)(,|-)mcun!m
	Gescffk&=$;)"jffyh
GetProcAddress
GI	dq_
gkEL	Y
GUMB		
G-{]Ya
g@yI	a/~O	
?.*H	]
H[^>0r5+;'+
%,),H4'&25-39q(:.3
		HC}AA
@H	eVLz
h~fk4	
+(_hGm
	Hhblq} Hgjfm`gm	`mlc}b}p	
_^H^HD_
^h-/		j
;H;];k3
Hlx^g`hf}EadnK		
<H?Z<t<
I=0A>|
i1;#Du
I.2N.>~
-I-@8<
i@	arYa
ibtgblm	Nbgglj}dng	
id|SDqL
	*%#.'i?+e*.+&i/0<?3~:5?4?2$(0%<
ifpA	iorN
I		H		
IH7H^8v
[iiBK	
	ikhcbdx"nef
index:
Ino~oo}'^wyd	
Ioibn/eol
I&			z
i~~z0&%	i~}yy4&%
i~zgend{nnj,|(qpd3|shp3jivw}wzqqO
		izko
J2XQRR
J&3A%|
~j^cN[3
}Jc	PbL
JIX}SR
jJGK@@ON
J-K4M-
Jk`djj)zk#emqlimxy0
	Jlh[cgja}\|cjY
			JL]	Nfgghj~dbe3-bgfzh
|JLWUapu	
	)		j/{mh}h
Jod`no*|k&ucud#os}~v8zuvq|qbbsfz@C
JOEHnnLefi
jr		&&#
%:J--t
;+)K	^
?-*K	^
?-*K	\
?**K	]
	)	}^K
[K	2	%
	k26}s4t
K	|5Z_
			k	a
<-)K	^a
K	]a3"o
K	]b5"l
K	e			
`ken2)FY@H-='92*^`gib}z)G])<';2-^_8"	B]Y]$8#8
kernel32.dll
\+K	F(K
$+)K	\^g
k	m	`	V
#KM^ZJ*SIBSWDQ]
k	QamyK	c
>krm=PD
}$k-T2F
K	Wh6"o
K	\X^c
K	Ya6!h
kZ{IJF\JDVNLJ	
		$	l	
L(b}dt
(lbXm9O.
L	c	bC
L-!M-=
LoaderSvt
LoadLibraryA
lq?=]%6
Lx(			
*L~|x1
&lzFc^ojhg
M--:			
M.1g	Y
M.?3M.
M(-a\kB
		maxdak&kek
	Mayiydhte+Uuh~jcpr		nc`b`i{$vubhuf
m(C	i-K
mD^yn+
M*;E2K.
}(Me	c	c	_a 7
;]^M_HP\G
Mhtq!Pqnlm|y*ndx6C}{v
mIDLHaEEQynmD>oD4Vqrfvaa
M		J'no~h
MlxDfm|`oAmdhelN
M-"%M*up
M+MYgX
M*N^_`ZQ
	M}otkm9ho{bth0ua~a|"
M%PYato
<-)M	Y
M- YbyaK	\
M-ZXYYY
N-.0U.9}
N-59M.
NexZyfjezsHnhy	
	^NFMK
Nhplz8Osyf
N@K	]X]
nle)&O*+/y+
Nl~Z{cjHmm{lz
Nlz}xfp]cgnf~	_ZL[:;'nef	
N-&QbY+
n	:	QhK	L	
](N	Q K
N-*RcUl
NT^JI^NXN^yud{`}jyTYaahbuw\BurvgTOn\LLUR_if^ZVW_LXrzW\XHO
N-*Y`]o
N%*Y`Qk
N.*Zb&;
N.!Z_][c;R
#$.":=o
			o01
			o01}u2
		o0E1
Oa1Ly{
OBCHdy~sfu		hingmagmagy}~y}z~wv	kiea
Obo|Ee~ixY
OCVEeOJEJR
OIEIxo`ui
	OIELmyyaIhkcbo}
o	j	h	
Ok~ej+
OMf}Qj
OmY\]X
?)<(;O;P?g<w;
		otxbfzmx+a|k
o$WH'V
OY@_ZOYz&">"%'#r-?:=yr{ul
p5	t#:
PDF	ii.qqmue%.ec ihm}s;2~gb`2lxjzrr|@RD
PEC2^O
P^\jLX
PnK+2W
pN	t+$i
pO	bBpI	a
*!",ponl
pPMFEKCnGHEN|LZG
"p_Qavx	
P-XpT@
PY_[cDP
pyF]@+HNM[B&C@OQD(Y_TO^:_^S@P4US]K*N
};[Q`+
}.%^_`\Q
	QaK	\	
QeQGI	
QEZ_g%Q
*QH	`	
 +)				Qjkqtws=Pnagw`c	
QKVRYQ
}qo02~r
QS[gwU
~qupq(-(-.--46IHNJHLONA@@B@GGD_^]ZU\_].---.+QPSRSWWVihkjmnoncf`aegonzp
QX]\`;R
QYKs2^
QYX]YTX]N
R\,>0)
		`	R0Jz}"
r2zP +
RE_c&W
REYc%W
	RjK	y
RJP@NBMH
	-RK	M	
%RK	z	
	RSK	@	
r=SY$Uh
}?S{!^
s2VI_8{
/sati\u{|nrp~Cdsrbes
S([?A:u
;S=d:y:
}shPFH	
sj$'=6
S$kg^;@
S|KJR	
s		N	e
~				SPDZVN^
{S^Q]TmXB	
S_.\S+YZY	Glo
!S.WVP 
%sy5|l
+t(0V.v
	.	t`B	-	
tctenjp/kto
!This program cannot be run in DOS mode.
	TJW	qleuqfv`veEJXC_BTDierphrvwh[JV
		tkm{o-/&?t
T^O[NP
[=tUxK
tybruxrijgvsujbzlvrdibvesyuyyfydepoktnjurskugcesbGZ
tybruxrijgvsujbzlvrdibvesyuyyfydepoktnjurskugcesbPasswordtybruxrijgvsujbzlvrdibvesyuyyfydepoktnjurskugcesbae|gef<;tybruxrijgvsujbzlvrdibvesyuyyfydepoktnjurskugcesbdtjel0tybruxrijgvsujbzlvrdibvesyuyyfydepoktnjurskugcesb0
t?ZVYa
U-$ E-&p
uJ	g8sO	b
U^JUcXPM[E__SlETRd
UK	t	6	iVK	F	*	LSH
UPN	 	
|u+pz$+3)b,FH-#o+1!87
	uRH				
%!]ur|?V
US^cwU
uV0X"z
UW`msvb
|uY_j6S
#V" \~
VBYc!Y
		VcnQ
V-!h.	
VirtualAlloc
VirtualFree
	V]M	~	
v.*P|C:
	{vsz|j
VTTVPS
vubbprez>siq
			<vvaq<
$[,)&W
w`|A-c`vUigknkj{<	
wj	}@Z\]`
WNVHYVU
^^WQa>%l
WQN[Pk[LN^J
	wqojxwq}
WTYRfsGqza
w---t}z~|
WU\cwQ
WW_Y_bMe
_]`	]]X
x#5%78~562><0;=,n
x7ZY\YbJ
]x_*	 #=<=93 r302		
			X\^a
@X@E[0
XEX`&R
		X`FsptS{qy	
$xhefb
		'xls}			
X~mc~li{ Ldnemcdl
	XmK	6	
Xutl|pj2\w
|/X^[Xa
,Xx}gDs
XXZ_^9
X_Y_]`
^X^_YfE@
	XZ\_V
\XZ_Z9
	(	$	y
y*	~.:
			]_Y
		Y_]`
[]Y]a<
		Y_^a0
[Y__a5DH	c
Ya=CK	aPoZ
Y@A^JW@
YaMbI	X
}-+YbnI
		Y\^c
^YES		
	y{e`uo2Ujffrd
	Y\^f	
	^Y@/F
	yK3V-
	Y[MZ^WO
yni"028D,3BP2@/1{
			yPH
Y"Q6@5t
	yS_VW{^\FPLGp]^_IMYEDD
		Y{swXzt`ymc_
Y\X_a?
yxchul2^oxdl
Y]Ya=(K
y:Y;R:u8
\YYXiU9K	`
YZabGK
y+Z\]b
		Y_Zd
YZe81|8b
_Y_Zg0"j
	)	YZK	Y	
[.%YZX
[YZXZb
,	z	+		
			.Z_
			Z_^
		Z_^`
		Z_^:
Z(\`3X
		z!4F.7{+
<Z4Q5v6
		z6[cNS;
.z6%&/Y	)z/Z
		Z\^a	
|Za1DK	a!DK	
		\\_Za9
Zb6EH	c
Z\\b[[N
Zc	cJ`
-Z_^cI`	8		
Zc	QYZ
		Z{eux Jfgoii}`bc			
	z{fhul<Ueylg8?		AZ\)fnpox			
		Z_j*
		Z\]j
[	ZnK	
*$ZO43o
zoydy}	
z-Ri*)Ae_dHV
ZT]Ye;R
		Z_V}
ZV^j3U
zxfc~d2Plqjj
ZXHGYIV
		Z_XX
		,z/y				
		Z_Y`
Z^_Y[]
>ZYb28
ZYc/Zb6!o
ZYZcIY\a3.
	Z_Z^:
ZZ\ad\
ZZ`#Zb5"d