Analysis Date2015-10-28 05:36:35
MD5f4056939ef2ab6e6347dc30a2f0c45ba
SHA1b22f8172f25647a872d47f8e1e803fd26d34a5db

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Sectiontext md5: 6bcaa62f2322a921409d95d2ab662a2c sha1: 445314f2d9e44b386f83c3cf2fb3a23be4c97d64 size: 2560
Section.data md5: 49b2b41aaa98a9990961726b6dbdb2a9 sha1: 15393ad3e12e959ae99fb0d641b6827422b3fe63 size: 11776
Section.rsrc md5: 156d9cc93df142c6541deee4945f0899 sha1: c6a0a01b76b5036cee37e348be0d51d141c0a0ea size: 26112
Section.reloc md5: 984dbc0bc33e7f82b1ad8766fe709e2d sha1: 1775a4b71ae12992855378fe7ae99a05c73c6d47 size: 512
Section.DAT md5: 7d4e4551417debebfb9576769ba4a23d sha1: d2a64230a544c825bd115a288a8a7e87cfffe96a size: 512
Timestamp1997-10-28 22:08:58
PEhashfcc5aab56bee31ec645c989eebd1fea8fb919601
IMPhashc312bb98cf45e74c770b5ff6a8bd003b
AVRisingno_virus
AVMcafeeUpatre-FABT!F4056939EF2A
AVAvira (antivir)TR/Kryptik.gtas
AVTwisterTrojan.Generic.lbhj
AVAd-AwareTrojan.Agent.BJIS
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVEset (nod32)Win32/TrojanDownloader.Waski.F
AVGrisoft (avg)Crypt4.TLF
AVSymantecTrojan.Gen.SMH
AVFortinetW32/Waski.F!tr
AVBitDefenderTrojan.Agent.BJIS
AVK7Trojan-Downloader ( 0049d22b1 )
AVMicrosoft Security EssentialsTrojanDownloader:Win32/Upatre.BL
AVMicroWorld (escan)Trojan.Agent.BJIS
AVMalwareBytesSpyware.Dyre
AVAuthentiumW32/Upatre.E
AVFrisk (f-prot)W32/Upatre.E
AVIkarusTrojan.Injector
AVEmsisoftTrojan.Agent.BJIS
AVZillya!no_virus
AVKasperskyTrojan.Win32.Generic
AVTrend MicroTROJ_UP.DB5F9D28
AVCAT (quickheal)TrojanDwnldr.Upatre.MUE.A5
AVVirusBlokAda (vba32)Trojan.AntiAV
AVPadvishno_virus
AVBullGuardTrojan.Agent.BJIS
AVArcabit (arcavir)Trojan.Agent.BJIS
AVClamAVno_virus
AVDr. WebTrojan.Upatre.201
AVF-SecureTrojan.Agent.BJIS
AVCA (E-Trust Ino)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\zil7812.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\zilinad.exe
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\zilinad.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\zilinad.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\icanhazip[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Deletes FileC:\malware.exe
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNS46.16.225.236
Winsock DNS81.7.109.65
Winsock DNS85.248.2.228
Winsock DNS95.80.123.41
Winsock DNS5.44.15.70
Winsock DNS128.0.85.11
Winsock DNS91.240.97.54
Winsock DNS46.151.130.90
Winsock DNSicanhazip.com

Network Details:

DNSicanhazip.com
Type: A
64.182.208.185
DNSicanhazip.com
Type: A
64.182.208.184
HTTP GEThttp://icanhazip.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:34.0) Gecko/20100101 Firefox/34.0
HTTP GEThttp://81.7.109.65:13401/WANS22/COMPUTER-XXXXXX/0/51-SP3/0/
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:34.0) Gecko/20100101 Firefox/34.0
Flows TCP192.168.1.1:1031 ➝ 64.182.208.185:80
Flows TCP192.168.1.1:1032 ➝ 81.7.109.65:13401
Flows TCP192.168.1.1:1033 ➝ 46.16.225.236:443
Flows TCP192.168.1.1:1034 ➝ 46.16.225.236:443
Flows TCP192.168.1.1:1035 ➝ 46.16.225.236:443
Flows TCP192.168.1.1:1036 ➝ 46.16.225.236:443
Flows TCP192.168.1.1:1037 ➝ 128.0.85.11:443
Flows TCP192.168.1.1:1038 ➝ 128.0.85.11:443
Flows TCP192.168.1.1:1039 ➝ 128.0.85.11:443
Flows TCP192.168.1.1:1040 ➝ 128.0.85.11:443
Flows TCP192.168.1.1:1041 ➝ 5.44.15.70:443
Flows TCP192.168.1.1:1042 ➝ 5.44.15.70:443
Flows TCP192.168.1.1:1043 ➝ 5.44.15.70:443
Flows TCP192.168.1.1:1044 ➝ 5.44.15.70:443
Flows TCP192.168.1.1:1045 ➝ 85.248.2.228:443
Flows TCP192.168.1.1:1046 ➝ 85.248.2.228:443
Flows TCP192.168.1.1:1047 ➝ 85.248.2.228:443
Flows TCP192.168.1.1:1048 ➝ 85.248.2.228:443
Flows TCP192.168.1.1:1049 ➝ 95.80.123.41:443
Flows TCP192.168.1.1:1050 ➝ 95.80.123.41:443
Flows TCP192.168.1.1:1051 ➝ 95.80.123.41:443
Flows TCP192.168.1.1:1052 ➝ 95.80.123.41:443
Flows TCP192.168.1.1:1053 ➝ 91.240.97.54:443
Flows TCP192.168.1.1:1054 ➝ 91.240.97.54:443
Flows TCP192.168.1.1:1055 ➝ 91.240.97.54:443
Flows TCP192.168.1.1:1056 ➝ 91.240.97.54:443
Flows TCP192.168.1.1:1057 ➝ 46.151.130.90:443
Flows TCP192.168.1.1:1058 ➝ 46.151.130.90:443

Raw Pcap

Strings
1uaChn
+[2u{o3er
3\caJR
93}kWsy
9?b5%8
AB@CGF
AmpFactorToDB
(|A;S)$
</assembly>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
AtlAxAttachControl
AtlComPtrAssign
atl.dll
authz.dll
AuthzFreeAuditEvent
AuthziAllocateAuditParams
AuthziFreeAuditEventType
AuthziFreeAuditParams
AuthziFreeAuditQueue
AuthziInitializeAuditEvent
AuthziInitializeAuditEventType
AuthziInitializeAuditParams
AuthziInitializeAuditParamsFromArray
AuthziInitializeAuditParamsWithRM
AuthziInitializeAuditQueue
AuthziLogAuditEvent
AuthziModifyAuditEvent
AuthziModifyAuditEventType
AuthziModifyAuditQueue
AuthziSourceAudit
avicap32.DLL
B@CFG"
B@CGFw
B.data
C^AD6+
capCreateCaptureWindowA
capGetDriverDescriptionA
CFGMGR32.dll
CM_Add_Empty_Log_Conf
CM_Add_Empty_Log_Conf_Ex
CM_Add_IDA
CM_Add_ID_ExA
CM_Add_ID_ExW
CM_Add_IDW
CM_Add_Range
CM_Add_Res_Des
CM_Add_Res_Des_Ex
CM_Connect_MachineA
CM_Connect_MachineW
CM_Create_DevNodeA
CMP_Init_Detection
c;M.Z=
</compatibility>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
CreateMutexA
DecodePointer
DNSAPI.dll
DnsQuery_A
DnsQueryConfig
DnsQueryConfigAllocEx
DnsQueryConfigDword
DnsQueryExA
DnsQueryExUTF8
DnsQueryExW
DnsQuery_UTF8
DnsQuery_W
DnsRecordBuild_UTF8
DnsRecordBuild_W
DnsRecordCompare
DnsRecordCopyEx
DnsRecordListFree
DnsRecordSetCompare
DnsRecordSetCopyEx
DsGetDcCloseW
DsGetDcNameA
DsGetDcNameW
DsGetDcNameWithAccountA
DsGetDcNameWithAccountW
DsGetDcNextA
DsGetDcNextW
DsGetDcOpenA
DsGetDcOpenW
DsGetDcSiteCoverageA
DsGetDcSiteCoverageW
DsGetForestTrustInformationW
DsGetSiteNameA
DsGetSiteNameW
ExitProcess
GetCommandLineA
GetCommState
GetOEMCP
GetWindowsDirectoryA
h.dllhtsrv
I+Ihvr
IsRasmanProcess
j	~\ay
kernel32.dll
*k\R#G
#l3\Gl
MprAdminInterfaceCreate
mprapi.dll
msvcrt.dll
/M(V_O{
N5!\E^
NDdeApi.dll
NDdeGetErrorStringA
netapi32.dll
NOKHJI
!&O_6F
pstorec.dll
PStoreCreateInstance
quartz.dll
RasActivateRoute
RasActivateRouteEx
RasAddConnectionPort
RasAddNotification
RasAllocateRoute
RasBundleClearStatistics
RasBundleClearStatisticsEx
RasBundleGetPort
RasBundleGetStatistics
RasBundleGetStatisticsEx
RasCompressionGetInfo
RasCompressionSetInfo
RasConnectionEnum
RasConnectionGetStatistics
RasCreateConnection
RasDeAllocateRoute
RasDestroyConnection
RasDeviceConnect
rasman.dll
REGAPI.dll
RegBuildNumberQuery
RegCdCreateA
RegCdCreateW
RegCdDeleteA
RegCdDeleteW
RegCdEnumerateA
RegCdEnumerateW
RegCdQueryA
RegCdQueryW
RegCloseServer
RegConsoleShadowQueryA
RegConsoleShadowQueryW
RegDefaultUserConfigQueryA
RegDefaultUserConfigQueryW
.reloc
</requestedExecutionLevel>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false">
</requestedPrivileges>
<requestedPrivileges>
S&9T/7
</security>
<security>
SetErrorMode
SetFilePointer
!This program cannot be run in DOS mode.
</trustInfo>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
uem3JRh\sys
W*e51d
-X}`&(]2
xB2j!5J1
X,UR6s
\z|fY3