Analysis Date2015-10-12 20:00:21
MD5d0de4dcc4e0a86762db11d0bddd28a89
SHA1cd58defe025a8daae1659a3c61b91ae6b0199404

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 631253d018acd2222d8bcb2fc18c2118 sha1: 1ca2bc58783f7e285d47bb15a2da747df48db0e3 size: 334848
Section.rdata md5: bbb9fd7f0b67eb864b4103fcbe4599f6 sha1: 0e0e334dfc3349321f5d081a17775e641ec1f9c8 size: 153088
Section.data md5: e9be03a140a03270da5106c4e4147877 sha1: 68e4809a0bda37995b93ca150b962ed608074475 size: 26624
Section.rsrc md5: b51af0ce974c673f88a5dd52e8165dac sha1: 6a5b6763648da765477ca9ea10e10c36b11f9133 size: 2239488
Timestamp1970-01-01 04:58:20
Pdb pathC:\Bin\setup.pdb
VersionLegalCopyright: Copyright ? 2013
FileVersion: 3, 15, 9, 1412
CompanyName: MICROSOFT
ProductName: sunshine
ProductVersion: 1, 0, 0, 2
OriginalFilename: tomgo
PackerMicrosoft Visual C++ ?.?
PEhash77a6086c237c4a1d70035b8423d7a57e3ce1edfb
IMPhash5f183cf8d571f9e14eed0cddfa97d0e0
AVVirusBlokAda (vba32)BScope.Malware-Cryptor.NSAnti.Gen.1
AVK7no_virus
AVMalwareBytesno_virus
AVAlwil (avast)Malware-gen:GenMaliciousA-NAP [Trj]:Trojan-gen:Rofin-A [Trj]:Win32:Malware-gen:Win32:Trojan-gen
AVMicrosoft Security EssentialsTrojan:Win32/Skeeyah.A!rfn
AVCA (E-Trust Ino)no_virus
AVMicroWorld (escan)Gen:Variant.Zusy.118140
AVFrisk (f-prot)W32/SYStroj.N.gen!Eldorado
AVAuthentiumW32/Trojan.XRIC-1106
AVTwisterno_virus
AVArcabit (arcavir)Gen:Variant.Zusy.118140:Gen:Variant.Mikey.25218:DeepScan:Generic.Malware.P!Pk!.B27A4187:Trojan.Generic.14936877:Trojan.Generic.11782610:Gen:Trojan.Heur.LP.du4@aaYL6Cpi:Trojan.Generic.14934268
AVIkarusPUA.Zzinfor
AVFortinetW32/Daws.DTDJ!tr
AVEset (nod32)no_virus
AVBullGuardGen:Variant.Zusy.118140
AVBitDefenderGen:Variant.Zusy.118140
AVDr. WebTrojan.DownLoader16.40181:DLOADER.Trojan - infected container
AVAvira (antivir)TR/Rogue.27840:TR/Spy.Agent.58880.2:TR/Downloader.Gen7
AVGrisoft (avg)Hider.ADZR.dropper
AVMcafeeRDN/Generic Dropper:RDN/Generic.bfr
AVTrend MicroBKDR_IXESHE.SML
AVSymantecno_virus
AVF-SecureGen:Variant.Zusy.118140
AVAd-AwareGen:Variant.Zusy.118140
AVClamAVWin.Trojan.Ascii.115_238_251_56-1
AVRisingTrojan.Win32.Zzinfor.d:Trojan.Win32.Zzinfor.f
AVPadvishno_virus
AVKasperskyTrojan.Win32.Generic:Trojan-Dropper.Win32.Daws.dtdj
AVEmsisoftGen:Variant.Zusy.118140
AVZillya!Trojan.Zzinfor.Win32.130
AVCAT (quickheal)Backdoor.Dusenr.08124

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_LOCAL_MACHINE\SOFTWARE\123\AddShExe ➝
NULL
RegistryHKEY_CLASSES_ROOT\Microsoft.IE\ ➝
C:\exit.exe
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnonZoneCrossing ➝
NULL
Creates FileC:\DProEx.sys
Creates FileC:\configWord.cf
Creates FileC:\reTcp.sys
Creates FileDProEx
Creates FileC:\exit.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\config.ini
Creates FileC:\Windows\System32\clk.ini
Creates FileC:\WINDOWS\he1p
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FileFixTool
Creates FileC:\Windows\System32\cBLK.dll
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates ServiceDProEx.sys - C:\DProEx.sys
Creates ServicereTcp.sys - C:\reTcp.sys
Starts ServiceDProEx
Starts ServiceFixTool
Winsock URLhttp://ad.zzinfor.cn/static/hotkey.txt

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 852

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates FileC:\WINDOWS\Prefetch\monitor.exe-1949D260.pf
Creates FileC:\WINDOWS\Prefetch\READER_SL.EXE-3614FA6E.pf
Creates FileC:\WINDOWS\Prefetch\CD58DEFE025A8DAAE1659A3C61B91-282CCFEA.pf
Creates FileC:\WINDOWS\Prefetch\svchost.EXE-0C867EC1.pf

Process
↳ Pid 1208

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers\LogonTime ➝
NULL

Process
↳ Pid 1844

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ C:\WINDOWS\Explorer.EXE

Network Details:

DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.20
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.21
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.231.22
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.234.4
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.3
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.5
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.235.6
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.2
DNS1st.ecoma.ourwebpic.com
Type: A
8.37.236.3
DNSad.zzinfor.cn
Type: A
HTTP GEThttp://ad.zzinfor.cn/static/hotkey.txt
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 8.37.236.5:80

Raw Pcap

Strings