Analysis Date2014-07-10 05:49:58
MD5b063bede591d8d669e28ec22308af981
SHA1dd68e8e3f75ce2dff7e84a369a031308ee940241

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 92d3b1133c1ff4f998ea708ad88438b0 sha1: 46654eb727e5049fe3d97ba7dd627fc909c084dc size: 4096
Section.rdata md5: 775b1b9b7de082046e13db8348304075 sha1: 423c94d9a5dedd8064c739cbd3413c7f4cb01440 size: 1024
Section.data md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rsrc md5: b1ec7f9e5052a1e34b1b1929a18284e3 sha1: 61c84655759a32ec0b17296d19abddcb3b6d3f12 size: 59392
Timestamp2014-07-01 17:46:59
VersionLegalCopyright: Copyright (C) 2007
InternalName: tendency
FileVersion: 8,4,4,26
ProductName: tendency Application
ProductVersion: 3,3,1,45
FileDescription: tendency Application
OriginalFilename: tendency.exe
PEhash5d6b51049c2846e84fc46d037a1604fef747a084
IMPhash5fb1dc1346b88e9086c0c7d29c6f059c
AV360 SafeGen:Trojan.Heur.Zbot.eq0@bqxcDlji
AVAd-AwareGen:Trojan.Heur.Zbot.eq0@bqxcDlji
AVAlwil (avast)no_virus
AVArcabit (arcavir)no_virus
AVAuthentiumno_virus
AVAvira (antivir)TR/Dropper.Gen
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftGen:Trojan.Heur.Zbot.eq0@bqxcDlji
AVEset (nod32)no_virus
AVFortinetno_virus
AVFrisk (f-prot)no_virus
AVF-SecureGen:Trojan.Heur.Zbot.eq0@bqxcDlji
AVGrisoft (avg)Agent
AVIkarusno_virus
AVK7no_virus
AVKasperskyno_virus
AVMalwareBytesno_virus
AVMcafeeno_virus
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Gen:Trojan.Heur.Zbot.eq0@bqxcDlji
AVNormanno_virus
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\nidzuhigzulv ➝
C:\Documents and Settings\Administrator\nidzuhigzulv.exe
RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\AppManagement ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\tasteofcharlotte[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\noetzel[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\mpccontainment[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\eddyhost[1].htm
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\Crypto\RSA\S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-500\a18ca4003deb042bbee7a40f15e1970b_666939c9-243b-475e-9504-51724db22670
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\nidzuhigzulv.exe
Creates File\Device\Afd\Endpoint
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\eddyhost[1].htm
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\tasteofcharlotte[1].htm
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\noetzel[1].htm
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutexnidzuhigzulv
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSellislawpc.com
Winsock DNSal-mas.org
Winsock DNSaxisdanceshoes.com
Winsock DNSroytechind.com
Winsock DNSurivit.com
Winsock DNSteamco.com.tw
Winsock DNShareed.com.au
Winsock DNSnoetzel.net
Winsock DNSpcmoddingmy.com
Winsock DNSbouchon.de
Winsock DNSmpccontainment.com
Winsock DNSatis-sk.ca
Winsock DNSsamcons.com
Winsock DNSquintesis.com
Winsock DNShoteljoyfull.com
Winsock DNSsormpack.com
Winsock DNStasteofcharlotte.com
Winsock DNSbutteri-altamaremma.com
Winsock DNSeddyhost.com
Winsock DNSbookfinder4u.com

Network Details:

DNSsmtp.glbdns2.microsoft.com
Type: A
65.55.176.126
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
63.250.193.228
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
98.138.105.21
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
98.139.211.125
DNSsmtp.live.com
Type: A
DNSsmtp.mail.yahoo.com
Type: A
Flows TCP192.168.1.1:1031 ➝ 65.55.176.126:25
Flows TCP192.168.1.1:1032 ➝ 63.250.193.228:25

Raw Pcap

Strings
Q..
j*....

041904b0
3,3,1,45
8,4,4,26
across
&acting; embarrassed
&actress regardless
added addressed
addition rather
Admirable everything+appealing father himself Cousine perceptive*approaching moments illustration creatures4contradicted brushed taking something daresay seemed!guessed continued Julia important8produced rural opined impression sauntered Dormer seemed8almost though conveniences considering slowly imperative
&advised
affairs
again
&Against been--and
&already
&already C??lie
altogether subjects
always position
&always Sherringham
amiable wouldnt specimens
&another direct
&another estate
&anybody reply
&anything careful
&anythings Paradise
applied arrange
&apprehension smiling
:artless spoken affairs words infatuation adoption national0tolerate insatiate chosen Bohemian besides Tiens
ashamed'evening elapsed better wonderful judged.Carr?? critics Dashwood invite rather position/articles herself future; commercial corner--the
&asked figures
assumption
&attached
&augmented
bargain accommodate
beauty
&beauty
become
&before enamels
Before to-day examples
behind
&bending nearest
between
&between mortal
&Biddys
&blessed
&blossom
bowled
brocanteur
&broken before
&burning
&business agency
business riddle Gardens
called
cannon noble?--how keeping friendly
&canvas
captured
carefully do--you
Carterets
central
&centurys pretty
charity--without exactly
&Chayter
chill then--youve)English lodgings circled continuity brain-taught associated returned taste faith people
&choose induced
&clapped
clear
clever
&clever
clever sentiments
&clever unchallenged
&Clorinde
closed
&comedy
&coming
company blinds Miriam faith
&complimentary
composing
&conceal excuse
&conduct giving
&confidence terrible
considering
&continued Tories
Copyright (C) 2007
&course
course embark development to-day
&courses
course seemingly
&creatures exactly
cried
critic
critical$diversion affection himself possibly
&curtains become
customary really little evening
&Dallows undertaking
decision
&declaration
declared little
&degree
&delightful
&derivative
different
&dinner-party--he question
&discussion almost
&divine telling
&doesnt
&Dormer it--without
&Dormer performing
dragged us--each tended paint
droll against ten-shilling
&dropped Madame
eating
&effort
&elapsed
&eloquence tongue
embassy it--had appearance
&encounter appeared
&enemies
engaged dropped
&engagement
&enlightened
&espousing moneys
everything
everything delays surprise!--for
evidently
exaggerate
exclaimed wondrous
&exclamation clever
&explanation impose
&exponent quieter
express manner
extinguished ordeal
&families centuries
&fathers
&figure
FileDescription
FileVersion
&flashed
&flocking
follow express--I
friend magnificent
&friend without
(frugality constituted certain capricious;personally school baignoire should Madame continuity theres
future
&future candour
Gabriel
Gabriel received Lovick perhaps
&gained
&gallantry
&general
gentleman forbore represents
getting
giving
graced like--paint
&grateful woman
Gutenberg enough about
&handling because
hansom wouldnt
&happened
hateful
havent people variety
having
&having miracles
herself
&hesitated
&higher everything
&highly styles
&himself
&himself later
himself opinions
&honest something
&horrid
hospitable
&hostess
house
&house little
&howling
&ignorance
immense galleries
impenetrable inspired
impulse greater training
incident validity points element
&inclined
&indication;
&infatuation
&inferior Fran?ais
information
informing explanatory little
infringement remarked
&injury
innocent--thousands
instance--from
interest
interested waived
InternalName
;I&Q
&it--Im
&itself qualities
Julia1indiscreet Carteret sense placidly Peter precious!distinction cathedral information+father refuse completed added to-day fallen0really something Rooth Miriams surprise question
&Julia mother
&kinsmans Peter
&knocked
knowing
&lady--to centre
&language
LegalCopyright
&lightly yourself
&likely
limbs it--sometimes
&limits therefore
literally ready
&little
Little
little better appeals reflexion
little responsibility
little theres fraternising
&London--go
&looked
&looked patience
losing
Madame
Madame imploringly
manner
&manner repeated
&married--these little
&martyr
&matter without
&meaning
&me--not conception
&mentioned
&mercy better
&might--I
&mingled
Miriam
mirror desire There
mirrors usually
missed
moment; freedom
moment magnified
&moments
moreover
morning
mother necessity
mother retention
MS Shell Dlg
&narrated allude
nature speaking equally doctrines
&nearer
&Neither different
&Never mistook
&night
&nineteenth months
nothing
nothing exposure; confidence whatever
noting Miriam alone
now--something should
&objection
&object replied
obligations silence
&occupied half-hour
&official
OriginalFilename
&others
others--a Nicholas7benefactor something carpet always--not unholy listened)friend finding thought foreigners glanced(richest simplicity direction Sherringham*Julias attending expectations distributing>Dormer affectionate seemed proposition feeling solitude please almost contentedly richly stayedEspeech believing beautiful lady--sometimes impatient matter answering
&painted
painting
&Palais said--not
&Parliament amusement
passion
pencil--the
&performance
Perhaps Julia--nothing entreat
&perversity importance
Peter
pieces--is
&placed
&placed hundred
playing advertisement-sheet
please learned thinks
&plenty ball-room
poetry
point!--and
&portals
&portrait experience
&possible
&possible afraid
&postern
&practical corner
&practice anomalous
&presence
&presently remembered
previous crack
&private
&probation spirit
problems
ProductName
ProductVersion
&professing become
profession--Biddys rubbish3listened attitude--the dreariness Hawthorne without.leaving quavered simple putting opened visitor-analogy serious Macgeorge--what strong Madame
proportion
&propriety Foundation
&providing
&question
&questionable
&questions
&Rachel prolongation
really
&really
&reasonable
&reason resorted
&received
&received interpreter
REFUND reminded
&relation
&relent own--those
relevant
&remark hostesss
&remember States
&resented
resource disturb
&resource mother
responses
&rested
result expression
&retorted theatre
&retreat insist
&returned scarcely
RichEdit20A
richness
right
&right duties
romantic call--he Signor
&Rooth
ruffled immense
sacrifices
&sapient
&satiric reason
&scattered nature
sc??ne friend
&seated
&Sections called
seeing
seeing impatient
&seemed
&serenity
&serious
&seriously usage
&Sherringham
&Sherringham pretty
&should
should effort
should matter
silence
simple
&simple cousin;
&sketch
&something
&sometimes
sometimes daughter
&speak neither
&splendid friend
&spontaneous
s??tait canvas dependent others
startled
stayed
stockbroker
&strange
stress;
StringFileInfo
studio remoter
studying actresss
&style course
&suburban altogether
suffers disconcerted
&superficial
&supposed
&surprise
surprised always portraits#herself towering reinstated finding
&sweetness
sympathy little
SysListView32
Tahoma
talent
talked others
tendency
tendency Application
tendency.exe
that--and Miriam
&themes
them--scarce
&there
there affection irregular compliance
&therefore darkened
things
&thinking other
&thinks professions
though replied
&thought
&thought constituted
&Thoughtfully family
&through Chayter
tinsel sometimes
to-morrow
to-morrow pudding good-natured
&touched
&trained actors
&training
Translation
tremendously piously;
triumph
&trust continued
&turned
VarFileInfo
variety-show
&veritable Constantinople;
&visitor grandly
VS_VERSION_INFO
&vulgar sometimes
&wage-earning servants--she
&want--to
warmth inspired supper
&waters actress--you
what--a
where another
&which
&which affairs
windows
windows soreness
&wished before
wished other
wonder anything
Wonderful Michael
&worlds;
&wouldnt promptly
wretchedly second
&writing station
yesterday
you--I
1qC\2Hy
20%98BKK^Tq}tVW
5FG!%2`C
5!y0+s
6Lo'j]
8IXk`m
aCI4ce
~aLU8;
c;J)1Oqw
CreateWindowExA
d4d%rg
d8\w2i
@.data
DefWindowProcA
DispatchMessageA
e0$0TL
e7\YB^
explorer
F;5qBR
F7=gD`
FindResourceA
g[594hb~OM
 gABp[/
g=Cx}q
GetCurrentProcess
GetExitCodeProcess
GetMessageA
GetModuleHandleA
GetProcessHeap
H@'\!?5UOV
HeapAlloc
 =IdnWO
]IH"eu
IQPg881
iW\\z[6
J`!wZ)
jX=Apj
Kep$\!
kernel32.dll
kF#[i[
KillTimer
l#1e`/L
-L82f)O
#LhR\U
:LJzYxPf
LoadCursorA
LoadIconA
LoadResource
lQrIjU
[L`xb^+
M3GBA&Ew
Mal^O?6,9
MKJuoiu9867_965iygfhj
nfbXz/VQ
%|OEH{{
_+OG~34
|O<~J"
p"H3s"
p![Jzd
\p*-lg
PostQuitMessage
pry,Lj|c
pwMiq1
q=5bgQQ&>eEi
qbCzdF
_Q{^c/
`.rdata
RegisterClassExA
rpuytvww~DA]P
S(7B6K=~
SetTimer
ShowWindow
SxG:Wk
T1[k5Zg 
tdw+#Y
!This program cannot be run in DOS mode.
TlT-Hu
TranslateMessage
[T)Y%`
:ufraB
UpdateWindow
up|uov~sAthi
user32.dll
(V`l<D~
vTRAR 
VZ=#|EPe
whqxgV
: wx:b&O
)(xjQ[E
XT]g~6;9<
y|pegvvG}xdq
|yq`nwsvH]MD
YSOSfm
Z3h"{W
ZcqJ[c