Analysis Date2014-03-20 18:40:07
MD56e9e9d52fbadb26f3ed879efccd6f0fd
SHA1dc346c3e878c0048369dcf780cee6da951b14eed

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section md5: df3c5bb43fd60ec9a0af27ebb69a8acc sha1: ea464a4d4dc0217bac9d4de5027df714951a0a0b size: 77824
Section.rsrc md5: 0adb65f017ea59eab7e33d53e02ef515 sha1: 90a85bad98adcbc4162a9912582b04e6b91cbc36 size: 4096
Section.idata md5: ec962d57b1b25dd1233ccaff39b2b56b sha1: 30eb3417efa5fdb6783c73227c1559172e2263b7 size: 4096
SectionThemida md5: 42b9cb539a8440a00a20c07b0b632d9b sha1: 336ffc40fc4e9d118cee3a7b5bf64e6e31736271 size: 1208320
Timestamp2009-07-19 06:29:57
PackerThemida/WinLicense V1.8.0.2 + -> Oreans Technologies
PEhashc6f28f993bba6532bacc26bf60059657c1cf0722
IMPhashccae7705d3bafed6b8f5ee79b27d03ec
AVavgWin32/Themida
AVaviraTR/Crypt.TPM.Gen

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates MutexDBWinMutex

Network Details:

DNSsmtp1.sbc.mail.am0.yahoodns.net
Type: A
67.195.15.66
DNSsmtp1.sbc.mail.am0.yahoodns.net
Type: A
98.138.31.74
DNSsmtp1.sbc.mail.am0.yahoodns.net
Type: A
98.139.221.42
DNSsmtp.cal.net
Type: A
216.57.71.25
DNSsmtp.mail.eu.am0.yahoodns.net
Type: A
188.125.69.59
DNSsmtp.live.com
Type: A
DNSsmtp.sbcglobal.yahoo.com
Type: A
DNSsmtp.directcon.net
Type: A
DNSsmtp.mail.yahoo.com
Type: A

Raw Pcap

Strings
..
.
.
.
M
in.
d
*
.
d=..R
.Z
..
..
.
.
..^.
..
.t%w.
^^
h.....
x.
.o.
.sj\
{[ }&'
@@|%\[
^@"|)0=
-'\*0,
[01lAX
03(res`O
@	~062^
&09$L#
0(c$SP
(0`DW>\
0){?Eg
[0$=Gi&
{0I[0e@
0i8/YM
0i,X()
0j8KC+
0no/>R 
0<;Nz&
0ORPCXP$
0Oz	M~a
0P^2w(
,;0QiouR
0QN2-@
`>@0-r
0 Rh%	
0{!RY<
0|s`VW
0(,,tF
0uh`aL
0VG4Y]
/ 0WhC
0~'xP8a
 0x]X.
0[X	Z@|:V
{	0YGTX8hO
0ZaHi`
0ZEVQh
0#z[K_
_;1@,.
;#1%-'
&#10K;
12Aa^d
1.2gd,
1/[2@O
1:[;8^
1`AZ\B
~1	EUc&
1&}I%z@bd(
1l9b`M
1QYe>bK
>1wI8;2
1Wx8%w
;>1{x0
	``[_2?
21.5 D
2-87%\
29\q1D
{2a^P@
)/2B`=(
2,c"US
2e#)_n]
*2H	0k:M
|`{2hUQb
2H ve?
>]"2>i
@2}i|'
?~2<mNa
2`O}/:
/&.2pb
2qh	NP
2SUI~x
2U@ED(
2U^Vq 
,2vH9P
2X+4,Rx
2!}yfDh
3*1|!NO%y-.
|32Zw`)
[338x$
38WbNK
}3[/b4
3b9#,S
3!%?BA<F$l*
3`gm&z
3-H+y+;'
3I%\* \
3m9IpQg
3<.nX@%
3&qbT|)
_3,`tOa
	3v)|1
3VWf&F
3+%[XE
,3Yx9V
3*Zn(t
$:>{4']*
4%0<@T}B
 4*`7p3
4~bhaA
~4BQKm
/@4`dL
?4d uh
{4$\\F{
4H9`>R
`4*@izx
!4j=0v
{4]J~N
4/>``t
4_V:9	L
:5	6`A
5|[8o7
58'Q?T:
58Z+wUT
)5A	Jq
/5bJU}w
5`Cqaj
5|<~g>
5gl6!1`
[5G uI
5kL$/`p
5LPf`N
5&Nm	qC&
5nzZ	6
5@OC70
5,_Pp,
5	ps|D
5'?RV(
5	"]vM
5"X>hk
5YHLZ^
60nF v
60T8up
63j 8e
(691<L
6A)E? }
6](A z
=(6f.&
,6	I-&
6J`h$U
6OU	\7
,/\6Q8Ej
6]R1e9J
&6	R@N
6*Yy,u
6&Z -K`
72jN1{`
72qB+"
/72{Xp{
76^dca
7]9Pr-
+7@D1=
7"F_Db
7/'~J]
7mLi@o
7]mn_D
7nOyH6D
7O4!0S
|7r`&z
7uF:`	
 7vjnJ
7WpL9$T
8 	8$@
89@#u;
8A2%KW
{8.A-Z
8D@+Zn
8+E0rP
!8^gJ@
%8>h`0
8H$a&b
8i)p	aU
8`kuyD,
8l=&U'
'8l{Z\!
8;-	`O
8P&`WwZ
8q5Dx(z
8	rHHtO
8vxVM@h
8y<	jI
@8Y<ZP
93[OlX=
9B	(\)_
`9!F'_
9<IIha 
9IkBJG9!
9"?Kx)
<9l,~@
	9mzN'
:9?)os
 9p>;f?@
9\qepiz
 }9RPQ`
9sSDK]
9^vRmL>
 9Yh*M
(9YL;:
^9z2~B
'  ^a=
]A*[	0
a"15k\
A3y?r$
-A"(4@0
a4H$c,
a7Rq_8
)a9AEQ0
AA$,3/
A.cHn0
ADsV)PI
<A/.E|
Ae8gdlk
aF{	H@,
a?%Fu"
A:.?H1
A`[h2U
aI0oiN
aI-N0m
@ai/sTW
aK10VR
aL/`4PO
<alCum
anry)l90
 aonG<
)a) P(
a%P07E
&a>PT(X
%/Aq<:
-\%aQh
ath,)\
a$tj0f
^Au;	p
Av\J?$s
.a<W/v
%A%z)g
|^azGL
b+`@?&
B0`~"a
B3 ,#P
b'a}:a
B}aZgM
bBk)DP
|Bc0cX
BDT]a@4
BDy/LXH
bFc$R)(
 B@<G!
bh2Nc%
b~!H5Z
B[hH	^
BH.QpU
b=ip'/\
b' `K$
;/= BK
BlXFru
\Bn} M
|B&_}P
`Bs]#ei|IPG
BSNmH/
buW\Fi
B",vF#
B&V"|Q
,Bw$Vk
)b:%X9
bXhLEV
BYh&}*
=&{BZL
,{BzVp
[C0kJ-
C0Z;\`
c1 e~g
C/~&A0
	cAjE\y
$CaVvnp
CBO+P#
c"E](8
c{g_'j
  ,C	H
c `h+NU
CI}"=x\.^[
cj@;*J
Clf+V,
COGZv#8
COMCTL32.dll
cP(:CV"]
c;<pD-
(c p#E
=C/`qm
*])CR}
CreateFileA
cRl.`zm
cs9"xpH
cSOwo7l
c[top,vu
+c%@V4
CvNPFA!U2X
CVT"k:
CW/S,z
cx&~,z
'C!Ys=
CyV s}
+cZ=8J
C!zyk]
	+`$d:
#!*D<@
D%;[`:>
%d4=wG
d6*4)X
d8)k!q
D!8?wLY.~
d!9jnLYZ
DA\\.8[t
dA%kwI
Dbv~^T
~D@%_	}C
dc(	4r
>DCA,!
dC	i9/
D.Cq!L
<DDO:GB
D@DY%Q
dEc{B 
DEu$Xm
DGX.fM
 ,dH?(
>&DH%<
;D+hd]
dH,!h<d
dH%tHMPo
DHy{HUC
DHZ:>K
@DI/!A
>di;$-s
dK8 f=
dK`.Lz
d%&,m`
|d-m4g
;dmyrH
DNCt2flB)Q
D\<P%}8
d-~\	Q
|DQjp.
dRO-98
drp/_H!$
<Ds.	Uz
?`$'dU
DvP( w
dWl#p5T:r
D'WOMD(
Dy,$`X
e[04TX
 e&0}q
e`0=u	!
&E|4MX
/E-56Ox 
*/e~7,
)$	e9rA;	1
	ecr%N
Ed_~[:
eddb`{)
e #h4H
e!hBunw
ei8?v9
eIHKSV
;!El;A
eLdkcV
\ Eq>AS
Es(|S(
e}t)NL
\e/W0F)
-eW%Y"X}
ExitProcess
%E/{]y
.EY2>v
ey&|8z$
e,"Y@9
"F	10C
<. /f%2
F^!3^0
F5-bs&
F7-p5&
F7+vAp
f#<+>a8
faChv'
F%aoVuD]
fbxq	]D
F,.CLQ	
f`e3vU
fh:iRM
]F!	hq
^fiTk-
#f/Jgp*
fJ;	}T
Foc@5RZ
/,f*[P
}fp\vP
FQC)_?
Fq {D$9X
fQ]=eh
fRBds@
fs!%e^d
FSmA3DSu
FTp%qD
F@]U	%
]Fuau8w
F-v8|s4
fwdv$-
/fWhQqyI
Fx.{O4
G4df`S-p	
G.6K>_
G]6L<`
g7AKMb
}g7A;l:
[G8w02R
G9Hy 1L,)
g :~A$
)G{b70
.G@bAJ
GBu"Pi
gD{D#~/
-	GeH.
gF?b7TD
@~GH02
Gi_Rae
gM /Ayth
go*Xh(
gpLuH<
gQX\!k_
G&s'0?
gu@_ch
Gu$%pF
	gVrp/F
GYhZj.
/~:GZE
,@%H~&
H+$`""
H2<'Y%4H8
h4@P lS
h,4}z'
h6j0# 
;h%6&v
h#7WTc
h?9|5`
H9tf$K
>h/9Y-
h{aqe,
H)AQI;
hA]SM	
h\	AVo
,%<hB/_
h_bj%H
hB$jQ8
hBL}Wp
H+bN&@`
h)|c?^
h	Co:B
<h'D+{7
hdb`K(l
$h$dlY
H~DtF`
HD);xQ
HFhwSA
h)FH-<Z
< HFip
h#^hxi
@hIw.~
@{hjqL
H%JT@y
h<]`,k
<HKkGo
hk>O=]
h{^LUqw
[H m"J
$`&H`NBCX[
H"Nu=(
ho"@XYj
 hp;\)
hP`+0*
]#'HPHk
HQt#)\
=	hr^9
H[;%rsBq
H(Sq>w
h(T/V7
,.h%u:
h!?u=$
;hU$3e!
|%HUs:
hVF&<:
h%]wFx
_)HWS><
h%w)UW
HXD_Ej
|@`h Y
H#Y({N
,%HYzy
H[z1N~	
h!Zh^ 
Hz\r+N
H@z@vW
/'i0?9?F
I`'%1|	
i2]	J$
,'I-2XY(
i{5?q)
i6[Kfp
i@8Xn.K
i	95Gm
&i9LAN
IA0)n	
iAjXHS
$i-bro
=^I>C%O
.idata  
i$DM]RMZ
	 iDxV_
If6x}``
)IgS3"
$ihFFO
I,>-Jb
\	IM#`<@
<!i'm8k
InitCommonControls
 io/1)^pO
%IOFBW
{IO p~
Ip]FhX"
#i{\p'`k
$}iPqBh,
i%[ptB
IS$>]<:
<i@	sZ
ItkUd2L
ITt!K&
|i'+.v
i%@XHU
i/Xwy$
=i:xx|	
I!'@Y1/
]$j<(:~
J^00q,
	J@<1S$
j3z8&S
{j4<P-
/J~]7{
	<J>8&
JC-\i%];
~')jEH
<J.F3E
"=jg*#
JG0ie 
[j?h2U
JI=y{d
#)j\K0
' jKYv
JO1q927Pt
J>R8)D
J;rWZw
J>t?.mzj 
,j%TrH
Jt"Xd;
JVbBc<
'jvLx4B:
~jx#4%
<jy;,k
JY`!'P\
@&'k~(
K+0rJ{
K0].>Xw8
?"K$4>
k.&`5_
k'7B`Y
^k8B~_
K9-n+\
KAr4yi
k"/^Cq
KERNEL32.dll
 ;kF3X
%Kf?Z|
kh`^'-
K@hqVM
K#&-)I{
`KjScM
k?}jSD
kK2oJ'
k<?KYz&
kL;c	\
-`KmRP
`kn:2I4
k%@=\O
-`	kO.3w
,kOaID
k)p7\0
\kPcr]
K-=	 Q
\KQ'rJ
kt8,5k
kt{R8K
) k,({X
kZ6qoQ
K,@-Z(x
l3-z3U8
) l6,m>
L$]9yN
L,A-Kb,
LcE3 (8
lE;Hb=
Lg}4Me
Lg[Ph,
@l<@H%|
LH64	[
lH Wt 
lj6@DR
l\J N6
L,.>/l
l{?=!la
'L@Lp?
Lm%68U
l|M9g~k
lm$?)T	
%LnMH_,[
lpct *-
L!~<<R
.LrR/0T	
LR^X5D
*?lrz$
;LSw-r
+L&,tF
lT^hPQ
lT'-p*
lT-zZ/
~l}u9(
lu-K]^
Lvqc+0
l!*w:,
l-%[w<p
Lwz56}
L&+X ,
lX)er?
_lY9)A
/.M~>!
M0=yni
M'|1A~>
m2Ht p
M3'&<2 
M'?6p-
]M_7l?V
:Ma,BzW
MAd'u|Y
m_>#B8
m`?|CJ
mG:-`*.
MH&NC\
@mhujy
mH`-X<
mhZ3|~
m^IwL>2x5v.
	M{.J)
mLDc`#
$M\LMU
Mo	1SD
 ?mp&P
 $M+Ps
mQ4XX#>L
M`r4~f
ms>t&wq
MTztz%
MVvaZ{
M{WzpF
|\My1`XEd
[`MyPDi
#m\/~z
MZuyKR
.=;=]N
N0&"bcn
.N8-Zk
ncf(RQ
n`c=Hd9
N#C@Tt
NcwOH)
%[n]f-u
nJdu=)
)N=`KH
NKX\R(`
+@NLaP
NL%kC*
n>	Ll2d
Nnz%R;
+nQ`x-W
n:S"xR
]_nU'1
nU*:Q0
nx,0m)
nx("6|
)n	@}Yh
N;$YKMM
ny'YK)
N~Z2}`e=
Nz9:uI
@$o]\_
o0>R|w}
o0'w4j
o2%7Jg{
O2zR .
^O4<nJ
O7cU}N
o7Vd*(]
/!<$o8
(	O9hU
oaA	Hj
oamuT0
@o	a!O
`Oc$?v4$
 oFT,u}=
o$G,uL
>,	OHfP
OHLh):
oH"SA@
o	Ig0m
oj#8Xz
OK`g|L$
)o {KN
{ oLFpG%
[OlX=$
OlX=$<
}oO0ut
_OO]6`
o>OebJ
+O,/P'
o*~(qE
O-^]r/[{@C}]9
o/+sT4
Ot+M-q
o:*uHeK$
O}*-Uq
o~uVO0
o+Z3*m:v
oZVuq?
O`zxb:
P"(@_\
p0?\Z!X
_&%p1P.
P4A#eQ
P5v:[&
p5	vu_
P9}lQ@
PA<cj?F
PB8]gI%D
>|pcD=
./(PCe
PdI0"Y
pd?zcn
(p+^)E!u
PF%@.f
$Pf/U{
{p	&h)
|pH5~a
=P`HF 5
Ph,F	6
P(H.Pu
phs8x.
Phy>= 
pi%Fwx
$P)IvK
@[/p\`j
p.[kVb
P(m0W:
pn(xa!&
"p(]o!
poq5?R%GWZ
PO#)T 
`%pPekT_
 $P*p(F
P'|&rH
p&S*5.
Ps)-BS
P/S@(X>o
$p\t>.	i
`.pU	P
!PWl@z
`[P{X|
P_xHY(
 *P)xj
,)p&X	Y
pZRh	*
PZyiE	H
&p [zZ
(q~*%$
	q-.^`
Q1IAI]
Q6Aslh
 q6Dh,
}Q7(/q
`*Q8m]
Q9ga4M
Q9W9L9K>B
q(aoMSa
QA{Y01
`Q"aYU
&qC Ir
(Qd/Jo
QDLHO9
@qdmEV
@QDT-;&#`B
+\`qGK
|'qGps
<'Q\h!
qh	dK^;
Q}h,j82
Q@h[;'q
q%l9K@M64@
Q]&LMs!
Ql! )t
 ^@QN_
<@QNE:X
q'N#pQ
-]QO,bFv	Ic
	Qp*|(
Q^q/juz9
(qtkr.
(-q*U4$
q{uJ?)
Q]Wf+(
/QX[9l
Q"yWq&
qY<zp5
QZ.[N)
!%;r^-0
'r{3L0!J
R4X>_mK
R-56wKV
R6P<(h
R}8@`pQ
rA[|aX
@	Ra_e
raL&pm
 RApx;0M
re>o~b
RE	p=?x
Restar
r>F7jzQ
R)Flw@
RGN4@T 
Rh@^k/
R|HTgk
RhvbC_
%#rHXawT
^R	h:Z
rj)W{0$
]`rjz$
rL_iRsO
r=Np5?f
Ro'h2$D>
RPu<Y$
RPW=3l
@rpzn:}
rQ(!A!
\Rrpjp
R"SDTU
rt#T/~
r[tu}\+u8?
`rtz8B
R>u[WH
RxM-L'W
rx;&uL`#
`r)`Y!{
@>rY^,
ry'E#vz
RY}TL2
@,"s/	
S0{Xy1
S.1e8I
S/8CX 
"s8z,(
sA.ye}
SD\H_9
SER32.dl
Sgw_K`
SH*j  
'ShzvN[
sIA"xYH
s\lYj8
SN?`AD8\
sn?v1e
s@`,o!>
S,oN`0
SpL5P)J
#>sQ/9
sQ<GVD
sRi}F4
s.'tB}
SwV\I0	~
s*X5Ln
$><s$y
s,YIV8
t$'_:_@
|T!,} 
t$0bxhz6
t0#!IC
-t!0=v
t_^2=Gc
t6*0pC
't/8	E)
%TA`gak
tAyC\S
T)_^}b
tDe;~U
teN$#K
 t;gG!
{THD`d
Themida
Themida 
!This program cannot be run in DOS mode.
T[iu0UQ
@tJvO	}
TN1-?#;$g
TO)f|6
#to/pU
-[TpO^
%),tqA
'T\[\tu
TW q;hN
TXPSi 
+TZaJP
.tzcqM
T'Z:XW
@u1(XZ
( U6iX
U;7v04
u8%7,G
U?8F%%
'UB0<}
uc%h>2Z
`Ucl@6
U	DR33DF
uE=	;*0
UE1BSTu
%]U%eG
ug !9B} 
UGld#p
|UGn4P
u~g>rb
UhQr>Hx
uHu6k5
u/i.}]
:uM;&1
<$um|`G
Uq];v-
URya 	Q~)
u|`*Sv
utGLD]>:
uU{7pI
u~UDJ@"
U&/	V6
U;V7VAV
	uV}QR
uv}t2S(:
>uXx8pR
uYa&xd
%.v@}_
=@"v3;
v;'`'`3
V8q[B`p
- *va1=;
%vcxp.
Vd{,$?
(vdtFm
%v!}Ef
vEp=V0|
VFE'PS
<vFz%3
\\VFz:S
Vg(]'h
V`[hg=3
vI.^t'
,|V:<K
v`"!|n
V{o`x_
V{o)x_
V'=Q.\\$0=
Vqo~K%
<vRL,H
vR%;\W
v:tS@8/
Vu*xLv
Vwb49<
vy@ <#
+Vy=UR
|<vZ19?)[
@[.w~	
'W);<_>
,&W+0`
w0H@Rv
W0Z<$m*
'w4$sYx
w6<=>~
w62=%J
W8.*gG@!
wa=&{O
w^cvU8Y
wDa"}|
W;_D&j-
{ wdp~
w(E)`p
w-g()(
`WhUb%H
w\$IeO
*W[]_ky
WL"6xy
wM{k(z
`;WoB1_8
|&w>'P
?@wp7c
`wpD/XC7r
wp:PL#
w@PsL?
=wqLc-
W`Qw&j7
@W'Sb@
[W)s_Q
:&w$>T
wv|LtFe
W\*`/y
$wy_0:
W;yL`s
{W\Yv,
+	WZ@<}
@W"zz%
 x@070p>
X@1 )2
X2mi^d
~x2%PP,
X_39qP
/@!|X4
x4;Lx\
X\4#Rp
/;<x@5
X-5s:m`
X6-#dtj
#x]7Yw
+%X8`:
X9t@h<
X9w|Z}
x;AJ$8N
X%&A>v
X!b%^j
X\=bZf%
":;X#d
XD3HV 
| XD(b
XDkiFx
X-E[*,
@X|eFP"
}x`EY7
*X'F&&;
?Xfh-oP
@xflW$
X'@?#G
XhfpV.O
[:#XHi
X</	:hXx
XI3}8)
X@J-RO
xl	4!5
^)x`LJ{<
./XLp@
 XmA(x
X*MLL%,
/XoeS(
x&oM5B
x%Oq{N
x+o$`S
`-xO??V
XQh) 	
>Xre`b
\X'SbZ
XSi2]B
XUQL%<j)
)x%,w]v
xX^@`Ar
x^XSdrX
X$xyxe
x."Y}@
XY	fh}
`y&@)%
Y3qJnM
-y3xJ@
)Y}\7p
#Y}Ab2p
>|yAh0
**Yc6Ls
Y%C[u:v
Y|F1T-
_@ &Yh
Yh	?5"
y[hLY(!
Y`Kdpp~
YknuH>
`@ylR#`
Yo9tP8
'Y^p30
YPmU j
YsRd$ 
YSVn7a
YTb&RF
/<{yuLM
&yUP]X
yUx$h02
~?yV@_
y'VXt 
@y_*"w
YWr`G2
:YWz>i
yZESvP
[Z:%^{
Z0Bz$f
Z2[	\$]H^
/[z^4_
z*5V;8B
%[Z8@v
z!%&9B`
zA\_:t
Zb%j6]
~zC+`9
zc=_)Z
zDjZ	R]
Z|DW  W
$z/E*P
Z[@EWR
ZF`91K
zf=%*p
Zh=V'\9
!ZI	6BOvg
Zk`#q_
=Zl,;Lv
*Z^_lP
zN	0h@
`zN3Ko
ZP$5kw
*[zPZaB
^ZQa/T_Q
ZrKQIT
?z[$S=
z'+S7\
z&t|=}+
+ZV0L*
)@zv<W
\@'/ZW
|Z'@WH
ZwX/>G
Z}*,XBi
,ZX}jF
zxXWpY
ZYB8I1/
zY]VG<