Analysis Date2014-06-29 01:06:51
MD58ce709edea488559c6d6d0b33eb283f7
SHA1e9957da5104db84ff90f5d96ea7caa67c1872f97

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: a345ec18061609f88088a4695c10ee0b sha1: ec632f69d9ebf9a9ca85e8b45d2779e049541e05 size: 512
Section.rdata md5: 574a86bf260ca82d675e0d62fd17d99d sha1: bdd0d5e9ed8f6f049060c7e155214887914b28a4 size: 1024
Section.data md5: 537b8d6bba041bfe77a5a1e750f63954 sha1: a94f89b885f80ae2a1ed5d2eec90434a6f8bd402 size: 512
Sectionxcode md5: 6567f1791f09c2c5d04b6b5748dec431 sha1: 6c30fdf0ab8338a180071d27c2eac6fbdfda84ee size: 512
Sectionwcode md5: 8ca8281466724535b6961b249471e986 sha1: 6317a724a6a57244d2feb4091eb1eda1ae1693d6 size: 512
Sectionrcode md5: 9a2668f1273c0ae02cb0e3ca147ee199 sha1: f8eaddbc956679a9480a044fa598bd7cc899328a size: 512
Section.rsrc md5: ea152369d3cbc8d8c24f761b5b9f5246 sha1: b768bbf8b8ea74f2da3bc624c37209c2493b5f26 size: 61440
Timestamp2014-05-21 15:40:33
VersionLegalCopyright: Copyright (C) 2009
InternalName: recipe
FileVersion: 4,3,4,41
ProductName: recipe Application
ProductVersion: 4,4,1,48
FileDescription: recipe Application
OriginalFilename: recipe.exe
PEhashe071d13f4fdc6f9b5a8c3510279e0582a791f2cc
IMPhashe161bfdbb6be6056b8e2afa3c517316c
AV360 SafeGen:Variant.Kazy.385206
AVAd-AwareGen:Variant.Kazy.385206
AVAlwil (avast)Downloader-VIC [Trj]
AVArcabit (arcavir)no_virus
AVAuthentiumno_virus
AVAvira (antivir)TR/Crypt.XPACK.Gen
AVCA (E-Trust Ino)Win32/Cutwail.THJIWED
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. WebTrojan.DownLoader11.13943
AVEmsisoftno_virus
AVEset (nod32)Win32/Kryptik.CCNU
AVFortinetW32/Kryptik.CCNU!tr
AVFrisk (f-prot)no_virus
AVF-SecureGen:Variant.Kazy.385206
AVGrisoft (avg)SHeur4.BVXP
AVIkarusTrojan-Downloader.Win32.Cutwail
AVK7Trojan ( 0049a9441 )
AVKasperskyTrojan-Downloader.Win32.Cutwail.j
AVMalwareBytesTrojan.Agent.US
AVMcafeeRDN/Generic Downloader.x!ki
AVMicrosoft Security EssentialsTrojanDownloader:Win32/Cutwail
AVMicroWorld (escan)Gen:Variant.Kazy.385206
AVNormanno_virus
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\qogleawizteq ➝
C:\Documents and Settings\Administrator\qogleawizteq.exe
RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\AppManagement ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\altonhousehotel[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\qogleawizteq.exe
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\Crypto\RSA\S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-500\a18ca4003deb042bbee7a40f15e1970b_666939c9-243b-475e-9504-51724db22670
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\isp-h[2].htm
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\servico-ind[1].htm
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\isp-h[1].htm
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\isp-h[2].htm
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\servico-ind[1].htm
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\isp-h[1].htm
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\altonhousehotel[1].htm
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutexqogleawizteq
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSaltonhousehotel.com
Winsock DNSmastergrp-spb.ru
Winsock DNSoptiver.com.au
Winsock DNSenzoyrodrigo.com.br
Winsock DNShostphd.com.br
Winsock DNSrea-soft.ru
Winsock DNSaustriansurfing.at
Winsock DNSservico-ind.com
Winsock DNSisp-h.com
Winsock DNStvndra.net
Winsock DNSphototype.com
Winsock DNSacicinvestor.ca
Winsock DNSrueggeberg.com
Winsock DNSpaulrenna.com
Winsock DNSkonishi-hp.com
Winsock DNSulcndsu.org
Winsock DNSegao.net
Winsock DNSleadershipforum.us
Winsock DNStaykon.com

Network Details:

DNSsmtp.glbdns2.microsoft.com
Type: A
65.55.176.126
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
98.138.105.21
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
98.139.211.125
DNSsmtp.mail.us.am0.yahoodns.net
Type: A
63.250.193.228
DNSsmtp.live.com
Type: A
DNSsmtp.mail.yahoo.com
Type: A
Flows TCP192.168.1.1:1031 ➝ 65.55.176.126:25
Flows TCP192.168.1.1:1032 ➝ 98.138.105.21:25

Raw Pcap

Strings
,
.L.

041904b0
4,3,4,41
4,4,1,48
97jS
9Rz"
abundance
&added enough
adequate
&admitted
&advantages course
against
agreeable couldnt
almost
alone efforts
&already
already odious dinner<believed perished because pressure particular staring beside
always offer having
&ambitious
America--six
&amusements hindrance
&another concerned
&another lordships
&answered appearance
anything
anywhere before account theyre success anywhere firmness
&apostle
appealed
&appealed during
&appeared
&appears
&appears spectacle
&appendages
&applicable
appreciation weekly material future
arrived esthetic
artists settle
&asked trying
aspects Project
&assistance
assuring
&attacking admiring
attention
#aW	
&away--away
&baronet
became
&became
&because little
&because Wouldnt
before
&before
&before friend
before possible
&behind 1.E.2
&behold
&being
&being artistically
&believed
&believed reason
better
between
&between
&branch
breathed
&brother
&brought
&business history
&business regards
carriage
&carriages universal
&carriage tribute
carried
&Carr??s
Carr??s divine
&Carteret
&Carteret comfortable
certain later--youll
&certainly accompanied
&chair
challenge supreme3certainly admonition ingenious stood ordered render5indiscreet; Dashwood acting presently position though&place; barbarous wouldnt Miriam womans
&changed certain
charge always
&chosen
&civilly couldnt
&clapped
&clasped
&clever
&clutch doings
&combination prowl
companion
&companion to-night
complaint
complicated
&conceal
conditions
&consumed splendid
&content first
&continued
&continued Grace
&convulsive should
&copying forgot
Copyright (C) 2009
corner Indeed something better;Project summer conformably exactly pompous moral sister--he visitors reprehensibly lingering7convicted verdict; remark blushed Foundation encumbered
&corner nothing
&could furnished
&country
&country--half
&country prettiest
&course Gardens
&criticism exactly
&Dallows Anglaise
DAMAGES
Dashwoods
&declared having
declare things fight particular
&deeper except
&degrees
&delicacy enough
&delicate
departure rejoice indeed; celebrity
despatched character against
&destined sleeping
differ production effort
&disapproval--it
&discovery uplifting
discussing--is
&discussion
&dishonestly objected
dislike
&doing seemed
&donations creature
&Dormer
&Dormer desire
&doubtless
doubt Project	convinced
dramatist
drawing gentlemen;
&drawing-room
&dreadful always
earned
&edification French
effective crisis
&effect pleasant
&effort
&effort nothing
Electra
element things
&emphasis Heaven
&engagement introduced
English
&enjoying equal
&enough
especially
&especially
everything
&excellency education
&expanse stoutly
expected detached
explanation glimmers
&expressed having
expression enough
&faithful
&family getting
fatigue symptom question
&feelings general
fellow
&fidelity
figured indeed passion
FileDescription
FileVersion
finger centre Miriam generous
flowers
&forced greater
&foreign
formed charming
Foundation
foundations principal
&francs
&frankly
&friend Rooth
&further
&future
gaily elastic quickly7things indeed procession parasol things feeling without
&gained
&gains
&generations foresaw
genius
getting remained;
&ghostly armoire
&glimpses sinners;
&gloom mother
godmother;
&go--if
&gracefully listened
grimaces
half-hour confusion
&harder sincerity
having
heard taking
her--and unsmoked ready Everythings
herself
herself>appearance dense startled acquaintance occasion without reward
herself respect enough
&herself supposition
herself upstairs1hypertext surface rat-tat-tat Madame woman Miriam
&him--drop
&himself
&honourable
&house; Julia
humbug rather discussion modesty
&ideas
&ignorance
&imagination splash
&imagine
importance
&importantly therefore
&impression engagement
&infidelity experience
&insisted abruptly
&intelligently
&intentions
InternalName
inveterate
&is--especially
&itself during
&it--that oftenest
Julia
&Julia
&justly allowed
&keeping admiration
&kinsman engaged
&ladies Carteret
&ladies greater
larger
&laughed Dallow
learned
leave
LegalCopyright
&lessons
lifting mother Dormer*inward hundred visitor spoke always member
&like--theyre
&limelight
&little
&little interval
&little little
&little people
logical
loitered
&looked
&losing sometimes
&lucid
magistrates
maid-servant
&manifestly toward
margin
&mariage intense
&marrying--but Harsh
&matters Miriam;
me--as height
&member remember--said
mention
&Merely
merit Gabriel reader;+different broken interesting minutes people
&method daresay
minute fashion
Miriam
&Miriams longing
&Miriam wouldnt
&mistakes mental
mitigate Macbeth prefer"pretty wondered Gabriel thoroughly
&moment
&momentary
moment trees culture
moment vivacity raddled
mother
&mother
mother course foolish--its
&mountebanks pantomime
MS Shell Dlg
&museum should
natural
&nature
necessary
&necessary respectability
&nerves little
&never;
&nothing scrubby
&noticed sthete
&object doings
&objected
objects whatever
observation out-sit pitying
&oclock touched
odious
&offered
offered declared
&opened
&opined
opposition
original
OriginalFilename
originally
others
&others
paddling
painting
&Paris
Parisian
participated things desired
&particular
&parts--which gayer
passed denoted Madame intended!himself course charming messenger2personage person; rolling between rather concerned
passing
&pedantically--that state
penny
&people
&people painters
people result
&perceptible little
performance
perhaps
&period--if resolved
&persistent represented
&person
persons
&persons
Peters
&Peter vulgar
phrase Gabriel
pitchforked
placid6conscious supplied awfully Peters conversation tongue;
&pleading consider
pleasant Street
&polished mouth
politician artistic genuine uncomfortable
&portrait
possibilities
possible
&predictions
preferred;
&presence arrangement
&presented
presumptions irony
&proceeded
&proceeding
produce
&produce judgement
ProductName
ProductVersion
profit whimpered
promptly honour
propriety
&public amusement
&public impulse
&publish Proposed
purpose Choose wouldnt unlikely
pursued height
putting
question
Rachels knowledge--they
&range principle
&rather
&rather passionately
&really
really moored
&reasons
recipe
recipe Application
recipe.exe
&Redistributing
&relapse
&relations creature
&remain silence
&remarking coloured
&remarks leaning
&remonstrance breastplate
&represent party
&reproach
required unprofessional
respect
&respect
&resting something
retired covering8pronounced charming institution Gabriel limits locataire;localism between WARRANTIES deplorable thought other wished
&returned
&returned looked
&revived
RichEdit20A
&right
romantic
&romantic
&rough;
roughened
saying Gabriel
scarcely
scene--a
&scuffle
&second further
seconds involuntary having
&seemed actress
selected English:glanced Gutenberg Carr?? romance picture; humbugging dance	allowance
&selfish Rhineland
sending
&setting hand-shake
settled
&settled practice;
&several
&Several added
shabby
shade
&shades
Sherringham
&Sherringham listening
&Sherringham person
&shilling--only certain
should
&should
&should become
should capable
&shoulders
&shouldnt
&showed Europe
silent Lumley
simplifications
&simplifications
&simply
&sincere little;
&single
&situation
&slipping straightens
&smiling herself
&something
something manner
&Sometimes happiness
sooner soothed suggestion
&sparse words
&speak acquaintances
&speaking
&speak postpone
spectacle chance3Doesnt exactly bristled suggest returned afterwards&appeared impatient differently minutes
&speed
&spoiled
spoken touching reason1suspected abilities colours daresay series Harsh;
&stage-carpenters
&stall authority
&Stanhope precautions
statesmans
station enliven asked prompter
&sterling
&Strand
StringFileInfo
&subsequently narrow
succeeded visitor
&suggestion observation
superfluous
&supply
&suppose
&surprised reason--the
suspected
&suspected
&suspension Baskerville
SysListView32
Tahoma
&talked
&tangled
&tedious
&telling having
&theatre
theatricals
therefore
&Theres afraid
&theres masters
Theyre
&Theyre
theyre smelling-bottle
thing declaration encourage
things rather little interesting;
&think
&thoroughly withdraw
thought
&thought
&through
through whisked.painfully telling great status behind; couldnt	arrogance,strange voice--the afterwards battle picture6return there hers--do studying country English here--I
&to-day--this
&to-night embracing
trade havent
train--he confidence
Translation
&unduly artist
unexpressed opened pleasure--so having
unhappy
uninitiated truth;
&up--give neednt
&vanished
VarFileInfo
&visits anyone
&voice Atlantic
&voice--I simpler
VS_VERSION_INFO
wanderers desperate
was--well
&weighed
Werent lingering history looks=things dining-room vision corners perfectly attention pretend@altogether--a little reached great--and family--a wouldnt studio2country-houses remain walked described magnificent<invite curtains occupation swaying scarcely daresay darkened&Dallow you--that victim vehicle statue
&whether
&windows should
wisdom
without
&without
&without brother
&worrying felicity
&worrying things
&wrested
written knowledge
yourself--the
3U`uB-
4|I8N:
5>>y f
8dh&MX
{b1:'b
<#b3?F
B5nU}ai
BB[lbf
BeginPaint
BitBlt
Buw5rw
,C;B;f6U
'#{c~d
CreateCompatibleDC
CreateWindowExA
@.data
DefWindowProcA
DeleteDC
*D(F#W
DispatchMessageA
!<dkK!G
D&.]Kz
/d&|LF
eEjP:4"IP
EndPaint
epRziN
ExitProcess
F.+DJ@
feeltheresponsibility
,FnTPf
#GBcp_
gdi32.dll
GetClientRect
GetCommandLineA
GetCurrentThreadId
GetMessageA
GetModuleHandleA
GetObjectA
hegryr89089
H&f<lF
(.\i)Ft
(?Iz-tS
?Jv@-.
J=v<lN
k)\[&_1
kernel32.dll
KillTimer
(&&|LF
?l*H#B
LoadCursorA
LoadIconA
LoadImageA
;Lt|^F
=M-#,>
MgiSn[
}';PU[5
{Q7=sM
?q=m:S
`.rdata
RegisterClassExA
RFIQ|k
SelectObject
SetTimer
ShowWindow
<Sw[JX
t0Z~,d)
!This program cannot be run in DOS mode.
TranslateMessage
~-*UK/
UKN:/|
UpdateWindow
user32.dll
@VGJMG
$vUHlQ
wk)>8KZI
WWpgb.
$~XeD<
Y{IAL*
Y" J);
||ZETx5