Analysis Date2014-10-09 21:44:44
MD5cd5a95f490c6c3b5807b755600247eaf
SHA1cbe685b537f779f97d787a527b40d79328cab012

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: a27900b576bc7a227cfbea4d4b7d25d5 sha1: 22add411a46b04a3f4749b191aecb4d40058c67d size: 4096
Section.rdata md5: 775b1b9b7de082046e13db8348304075 sha1: 423c94d9a5dedd8064c739cbd3413c7f4cb01440 size: 1024
Section.data md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rsrc md5: e287c2bd9a0136c0f322f158d646b001 sha1: 160f1a4f71901ec1b1c4e7aab65d5a54be60e07f size: 59392
Timestamp2014-07-01 17:45:52
VersionLegalCopyright: Copyright (C) 2007
InternalName: tendency
FileVersion: 8,4,4,26
ProductName: tendency Application
ProductVersion: 3,3,1,45
FileDescription: tendency Application
OriginalFilename: tendency.exe
PEhash438ac25c5f7a04500cd3624defc4e114eb8a81de
IMPhash5fb1dc1346b88e9086c0c7d29c6f059c
AV360 SafeGen:Trojan.Heur.Zbot.eq0@bCITRrli
AVAd-AwareGen:Trojan.Heur.Zbot.eq0@bCITRrli
AVAlwil (avast)Dropper-gen [Drp]
AVArcabit (arcavir)no_virus
AVAuthentiumno_virus
AVAvira (antivir)TR/Dropper.Gen
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. WebTrojan.MulDrop3.14959
AVEmsisoftGen:Trojan.Heur.Zbot.eq0@bCITRrli
AVEset (nod32)Win32/Kryptik.CFVL
AVFortinetno_virus
AVFrisk (f-prot)no_virus
AVF-SecureGen:Trojan.Heur.Zbot.eq0@bCITRrli
AVGrisoft (avg)Agent
AVIkarusTrojan.Win32.Cutwail
AVK7no_virus
AVKasperskyTrojan.Win32.Cutwail.deq
AVMalwareBytesno_virus
AVMcafeeno_virus
AVMicrosoft Security EssentialsTrojanDownloader:Win32/Cutwail.BS
AVMicroWorld (escan)no_virus
AVNormanno_virus
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)Trojan.Cutwail
AVYara APTno_virus
AVZillya!no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\fisduflyrfat ➝
C:\Documents and Settings\Administrator\fisduflyrfat.exe
RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\AppManagement ➝
NULL
Creates FileC:\Documents and Settings\Administrator\fisduflyrfat.exe
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\Crypto\RSA\S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-500\a18ca4003deb042bbee7a40f15e1970b_666939c9-243b-475e-9504-51724db22670
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutexfisduflyrfat
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!

Network Details:

DNSsmtp.glbdns2.microsoft.com
Type: A
65.55.176.126
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
98.139.211.125
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
63.250.193.228
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
98.138.105.21
DNSsmtp.live.com
Type: A
DNSsmtp.mail.yahoo.com
Type: A
Flows TCP192.168.1.1:1031 ➝ 65.55.176.126:25
Flows TCP192.168.1.1:1032 ➝ 98.139.211.125:25

Raw Pcap

Strings
.B6D

041904b0
3,3,1,45
8,4,4,26
across
&acting; embarrassed
&actress regardless
added addressed
addition rather
Admirable everything+appealing father himself Cousine perceptive*approaching moments illustration creatures4contradicted brushed taking something daresay seemed!guessed continued Julia important8produced rural opined impression sauntered Dormer seemed8almost though conveniences considering slowly imperative
&advised
affairs
again
&Against been--and
&already
&already C??lie
altogether subjects
always position
&always Sherringham
amiable wouldnt specimens
&another direct
&another estate
&anybody reply
&anything careful
&anythings Paradise
applied arrange
&apprehension smiling
:artless spoken affairs words infatuation adoption national0tolerate insatiate chosen Bohemian besides Tiens
ashamed'evening elapsed better wonderful judged.Carr?? critics Dashwood invite rather position/articles herself future; commercial corner--the
&asked figures
assumption
&attached
&augmented
bargain accommodate
beauty
&beauty
become
&before enamels
Before to-day examples
behind
&bending nearest
between
&between mortal
&Biddys
&blessed
&blossom
bowled
brocanteur
&broken before
&burning
&business agency
business riddle Gardens
called
cannon noble?--how keeping friendly
&canvas
captured
carefully do--you
Carterets
central
&centurys pretty
charity--without exactly
&Chayter
chill then--youve)English lodgings circled continuity brain-taught associated returned taste faith people
&choose induced
&clapped
clear
clever
&clever
clever sentiments
&clever unchallenged
&Clorinde
closed
&comedy
&coming
company blinds Miriam faith
&complimentary
composing
&conceal excuse
&conduct giving
&confidence terrible
considering
&continued Tories
Copyright (C) 2007
&course
course embark development to-day
&courses
course seemingly
&creatures exactly
cried
critic
critical$diversion affection himself possibly
&curtains become
customary really little evening
&Dallows undertaking
decision
&declaration
declared little
&degree
&delightful
&derivative
different
&dinner-party--he question
&discussion almost
&divine telling
&doesnt
&Dormer it--without
&Dormer performing
dragged us--each tended paint
droll against ten-shilling
&dropped Madame
eating
&effort
&elapsed
&eloquence tongue
embassy it--had appearance
&encounter appeared
&enemies
engaged dropped
&engagement
&enlightened
&espousing moneys
everything
everything delays surprise!--for
evidently
exaggerate
exclaimed wondrous
&exclamation clever
&explanation impose
&exponent quieter
express manner
extinguished ordeal
&families centuries
&fathers
&figure
FileDescription
FileVersion
&flashed
&flocking
follow express--I
friend magnificent
&friend without
(frugality constituted certain capricious;personally school baignoire should Madame continuity theres
future
&future candour
Gabriel
Gabriel received Lovick perhaps
&gained
&gallantry
&general
gentleman forbore represents
getting
giving
graced like--paint
&grateful woman
Gutenberg enough about
&handling because
hansom wouldnt
&happened
hateful
havent people variety
having
&having miracles
herself
&hesitated
&higher everything
&highly styles
&himself
&himself later
himself opinions
&honest something
&horrid
hospitable
&hostess
house
&house little
&howling
&ignorance
immense galleries
impenetrable inspired
impulse greater training
incident validity points element
&inclined
&indication;
&infatuation
&inferior Fran?ais
information
informing explanatory little
infringement remarked
&injury
innocent--thousands
instance--from
interest
interested waived
InternalName
;I&Q
&it--Im
&itself qualities
Julia1indiscreet Carteret sense placidly Peter precious!distinction cathedral information+father refuse completed added to-day fallen0really something Rooth Miriams surprise question
&Julia mother
&kinsmans Peter
&knocked
knowing
&lady--to centre
&language
LegalCopyright
&lightly yourself
&likely
limbs it--sometimes
&limits therefore
literally ready
&little
Little
little better appeals reflexion
little responsibility
little theres fraternising
&London--go
&looked
&looked patience
losing
Madame
Madame imploringly
manner
&manner repeated
&married--these little
&martyr
&matter without
&meaning
&me--not conception
&mentioned
&mercy better
&might--I
&mingled
Miriam
mirror desire There
mirrors usually
missed
moment; freedom
moment magnified
&moments
moreover
morning
mother necessity
mother retention
MS Shell Dlg
&narrated allude
nature speaking equally doctrines
&nearer
&Neither different
&Never mistook
&night
&nineteenth months
nothing
nothing exposure; confidence whatever
noting Miriam alone
now--something should
&objection
&object replied
obligations silence
&occupied half-hour
&official
OriginalFilename
&others
others--a Nicholas7benefactor something carpet always--not unholy listened)friend finding thought foreigners glanced(richest simplicity direction Sherringham*Julias attending expectations distributing>Dormer affectionate seemed proposition feeling solitude please almost contentedly richly stayedEspeech believing beautiful lady--sometimes impatient matter answering
&painted
painting
&Palais said--not
&Parliament amusement
passion
pencil--the
&performance
Perhaps Julia--nothing entreat
&perversity importance
Peter
pieces--is
&placed
&placed hundred
playing advertisement-sheet
please learned thinks
&plenty ball-room
poetry
point!--and
&portals
&portrait experience
&possible
&possible afraid
&postern
&practical corner
&practice anomalous
&presence
&presently remembered
previous crack
&private
&probation spirit
problems
ProductName
ProductVersion
&professing become
profession--Biddys rubbish3listened attitude--the dreariness Hawthorne without.leaving quavered simple putting opened visitor-analogy serious Macgeorge--what strong Madame
proportion
&propriety Foundation
&providing
&question
&questionable
&questions
&Rachel prolongation
really
&really
&reasonable
&reason resorted
&received
&received interpreter
REFUND reminded
&relation
&relent own--those
relevant
&remark hostesss
&remember States
&resented
resource disturb
&resource mother
responses
&rested
result expression
&retorted theatre
&retreat insist
&returned scarcely
RichEdit20A
richness
right
&right duties
romantic call--he Signor
&Rooth
ruffled immense
sacrifices
&sapient
&satiric reason
&scattered nature
sc??ne friend
&seated
&Sections called
seeing
seeing impatient
&seemed
&serenity
&serious
&seriously usage
&Sherringham
&Sherringham pretty
&should
should effort
should matter
silence
simple
&simple cousin;
&sketch
&something
&sometimes
sometimes daughter
&speak neither
&splendid friend
&spontaneous
s??tait canvas dependent others
startled
stayed
stockbroker
&strange
stress;
StringFileInfo
studio remoter
studying actresss
&style course
&suburban altogether
suffers disconcerted
&superficial
&supposed
&surprise
surprised always portraits#herself towering reinstated finding
&sweetness
sympathy little
SysListView32
Tahoma
talent
talked others
tendency
tendency Application
tendency.exe
that--and Miriam
&themes
them--scarce
&there
there affection irregular compliance
&therefore darkened
things
&thinking other
&thinks professions
though replied
&thought
&thought constituted
&Thoughtfully family
&through Chayter
tinsel sometimes
to-morrow
to-morrow pudding good-natured
&touched
&trained actors
&training
Translation
tremendously piously;
triumph
&trust continued
&turned
VarFileInfo
variety-show
&veritable Constantinople;
&visitor grandly
VS_VERSION_INFO
&vulgar sometimes
&wage-earning servants--she
&want--to
warmth inspired supper
&waters actress--you
what--a
where another
&which
&which affairs
windows
windows soreness
&wished before
wished other
wonder anything
Wonderful Michael
&worlds;
&wouldnt promptly
wretchedly second
&writing station
yesterday
you--I
0b$`u0X
0:@TrD
1>,SWHBEEJ@OKTVQYVTk
1\y_=<<
2Ssm`\|
6,5]}Ys
%.6I_LHwqBBMKPT[]V
an^]3LHSEzryGHL
AnJ[b/C
.a$OWl
=)a$s~
\brpNQ
cdQO@:
CreateWindowExA
@.data
DefWindowProcA
DispatchMessageA
dYP,h,
Ek<Oio
explorer
FindResourceA
+f<Px4e!yC
Ft|g@2;!
Ftr|%P
GetCurrentProcess
GetExitCodeProcess
GetMessageA
GetModuleHandleA
GetProcessHeap
g&SK} 
gtS[4k
gu3pV,6^
H@'\!?5UOV
HeapAlloc
;	:h%$R
`+i8oO
jwOITP0
:!`~~K
kb;eic
Kep$\!
kernel32.dll
:khAjS
KillTimer
-KpoN7/
l#1e`/L
LoadCursorA
LoadIconA
LoadResource
LRQ56@sk
[L`xb^+
"miZ'_c
MKJuoiu9867_965iygfhj
 M_^Qt
mRcxz7<
MZy[Jt.
OFXSK)
|O<~J"
p|\GD2
\p*-lg
PostQuitMessage
q2Mz}-#b
q=5bgQQ&>eEi
QD&r*$x
??-qr N
`.rdata
RegisterClassExA
rlY)8.
SetTimer
ShowWindow
^SWZlm]\RWKN@A10
t9A@v`L}f
!This program cannot be run in DOS mode.
TranslateMessage
U?_2@!
(Ue2_J11
UpdateWindow
user32.dll
UXfson
_vC/guR
vTRAR 
WI>d'T/
w(Mpv_
y+Cq	Zl
Y_CT,d	
YI-	}D@
ywxqV3
^:?"'{z
ZqjqIbC