Analysis Date2013-11-04 15:05:19
MD55990c59728e9d63db33aaae5e8eace05
SHA1bdbc10692e55e276a0249c82f1b6369eb00b3405

Static Details:

File typeMS-DOS executable, PE for MS Windows (GUI) Intel 80386 32-bit
Section md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section md5: 7f933afd5b3e319046842bbc6844fa7a sha1: 0d2e71d14cd1bebece3a296b8d0ca0259abb28b9 size: 44933
Timestamp1987-09-11 01:35:02
VersionInternalName: setup1002
FileVersion: 1.00
CompanyName: Microsoft Corporation
ProductName: Microsoft(R) Windows(R) Operating System
ProductVersion: 1.00
OriginalFilename: setup1002.exe
PackerFSG v2.0
PEhash16a89834ae69872cbdd5c8ce080b1ff18e60bb1f
AVmsseWorm:Win32/Nuj.B
AVavgSHeur2.CFLA.dropper
AVaviraTR/Crypt.FKM.Gen

Runtime Details:

Screenshot

Process
↳ C:\malware.bin

Creates ProcessC:\malware.bin

Process
↳ C:\malware.bin

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FilePIPE\wkssvc
Creates FileC:\WINDOWS\system32\cideamon.exe
Creates FileC:\WINDOWS\system32\winIogon.exe
Creates FileC:\WINDOWS\system32\syswindows.ini
Creates Process"C:\WINDOWS\system32\winIogon.exe"

Process
↳ "C:\WINDOWS\system32\cideamon.exe"

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\~DFE1D4.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates File\Device\Netbios
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\ip138[1].htm
Creates FileC:\WINDOWS\system32\qqver.txt
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSwww.ip138.cn
Winsock DNSwww.ip138.com
Winsock DNSu.nowpride.com

Process
↳ "C:\WINDOWS\system32\winIogon.exe"

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FilePIPE\wkssvc
Deletes FileC:\WINDOWS\system32\syswindows.ini
Creates Process"C:\WINDOWS\system32\cideamon.exe"
Creates ServiceNetwork Access Security Agent - C:\WINDOWS\system32\winIogon.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Creates FileWMIDataDevice

Process
↳ Pid 840

Process
↳ C:\WINDOWS\System32\svchost.exe

Process
↳ Pid 1096

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00
Creates FileWMIDataDevice

Process
↳ Pid 1844

Process
↳ Pid 1116

Network Details:

DNSyd.ecoma.glb0.lxdns.com
Type: A
209.170.78.73
DNSyd.ecoma.glb0.lxdns.com
Type: A
209.170.78.72
DNSwww.ip138.cn
Type: A
218.133.22.66
DNSwww.ip138.com
Type: A
DNSu.nowpride.com
Type: A
HTTP GEThttp://www.ip138.com/ips.asp
User-Agent: MyAgent
HTTP GEThttp://www.ip138.cn/
User-Agent: MyAgent
Flows TCP192.168.1.1:1031 ➝ 209.170.78.73:80
Flows TCP192.168.1.1:1032 ➝ 218.133.22.66:80

Raw Pcap
0x00000000 (00000)   47455420 2f697073 2e617370 20485454   GET /ips.asp HTT
0x00000010 (00016)   502f312e 310d0a55 7365722d 4167656e   P/1.1..User-Agen
0x00000020 (00032)   743a204d 79416765 6e740d0a 486f7374   t: MyAgent..Host
0x00000030 (00048)   3a207777 772e6970 3133382e 636f6d0d   : www.ip138.com.
0x00000040 (00064)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x00000050 (00080)   6e6f2d63 61636865 0d0a0d0a            no-cache....

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   55736572 2d416765 6e743a20 4d794167   User-Agent: MyAg
0x00000020 (00032)   656e740d 0a486f73 743a2077 77772e69   ent..Host: www.i
0x00000030 (00048)   70313338 2e636e0d 0a436163 68652d43   p138.cn..Cache-C
0x00000040 (00064)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000050 (00080)   0d0a0d0a 74657874 2f68746d 6c0d0a44   ....text/html..D
0x00000060 (00096)   6174653a 204d6f6e 2c203034 204e6f76   ate: Mon, 04 Nov
0x00000070 (00112)   20323031 33203134 3a35333a 33382047    2013 14:53:38 G
0x00000080 (00128)   4d540d0a 0d0a3c68 746d6c3e 0a20203c   MT....<html>.  <
0x00000090 (00144)   68656164 3e0a2020 20203c74 69746c65   head>.    <title
0x000000a0 (00160)   3e343034 204e6f74 20466f75 6e643c2f   >404 Not Found</
0x000000b0 (00176)   7469746c 653e0a20 203c2f68 6561643e   title>.  </head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.


Strings
080404B0
1.00
CompanyName
CUSTOM
FileVersion
InternalName
Microsoft Corporation
Microsoft(R) Windows(R) Operating System
OriginalFilename
ProductName
ProductVersion
setup1002
setup1002.exe
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
0">Dx}
:"1\En
1l	{K 1
@1<S	D'F
`21h	x$
_2)4#=
{ 2$c%m
2-!\;N
2)PL%R
".39YV"	qD
3B!O"	\Div
3y4N|!0
$<"\,4
*40C0)
<4f(8	D<L
<4LhiP
4pYm*x
4Rm<!h}q(
($5\)x
6++* `
6LTC	P
6.=OLZ
7"NEHqei2<
7)r3 cOp
8(+3q+
`8pe\nrp
8YVR0sGh
<9@vBEX
a4@)A?
A6.8DL
Ab/p,L
acVvN|
adv2piu
AHsi#:
^&aqRs
b# `'_6
BXh`#i
By,i@YT#~+t
CacheE{n
!\>C|BH|D83L
#cef7l
;`C'Eu
^CF!`D0m
chs.d]fFS*"
chs.dl
}CRO8I(D
C,*x$C(*
d0jbW 
d\&1GL)H
d4Z[!{Qh`K-Il
D6hdIm"
]d`92S
-Dfl!H+
dfyT^(
DlDFun
D?OS%mXI8.
e6&i.U
!ej L(S
eN2\1_
er)M%<S
E"	SDeg
ET]QH:
EV NT_SuIuK
\{Evu~
ExScu2
*eXyMPI
#f&4TRn_S
f8>aRa,
fb9dx	
$f"&CT
fold!I-
f*Tjpg
%<^FU!
 !]G&#`
GetProcAddress
%_gLI]QH
gMyxaO(
'g	t6|
gTQPRR
H'|dUP"!
+Hex%l
h`m+pN\
HW-96s
&\	I+@
I1 \LD
I9 &'|R
#I+d9	
IHX0Wr@Y/
itAYR+
IwZy%U
I]Y:h4RWV
j46}#2.
:"	JDT^
jEZ@=D|
<Jf Q	D`
KERNEL32.dll
"{Kl>#
):l4tpsTh
Ld<2,)
L d4/%oW
!LeIWY
Li)gJX
LoadLibraryA
Lueg1lr
lX;<TV
m|~-!>?
]mpHZ]
MtFd U{
	+\"n|
N'e79,
NIrb82
NXV^QP
O"P#<3
@`OS_)MRx	:N(
Ox-\ t
p:E/	L
PL]k+]7e	<+
pN81w%W_
PP8M5AC
ppVpBp9g8
 prog3am
+(P.t9ex
pzqSdpl`
q"\dp	zH
qhcEk"
RaC`0q
R/ouB;Mw
.rrspc
(r'*Rv
%RuE2%um
SHDocV
?s;M7c ~Bft 
sR;qu)sLD
 sultCh
' t( F*D]|
Th	is p
T-_kgn
tL(P%ct
!TQ_	^
!tZ.<"
=T'Zuv
VB5!6&:vb
vb^J60
VE3D"	3RG
V'.p.G
Vymp~X
	wdZE,`
+WE|j;
winIorg
,wnh1 9
&xBtCJ
Y4$p(&
YK<Q68
yO1v`K
Z&(#)?C