Analysis Date2015-08-19 09:45:16
MD5665ede07d224b984e673e3239f95b7f8
SHA1f71ad0162ab1da9e630d10aaad9aad4ae8f33e2b

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 289f8b053d4e61b477dfd4344d5aaad7 sha1: 2fcb63e5e4009e60e0d041e0325940ce66dbf233 size: 466944
Section.rdata md5: c7369604bd96b7932c1423a8d4c8c307 sha1: 559365dbbe367140e6d1815eea9d2e949056c6ff size: 75776
Section.data md5: 73f23790e23b7a0b480b132329250f64 sha1: e4bce2da28729fb4f4d4494c71ca600de5bdcb60 size: 7168
Section.reloc md5: bf686c7f103115bdd37e1f0d52228253 sha1: 70037577e5188d408644a00e0ca6f185ab587aea size: 45568
Timestamp2015-05-08 07:04:32
PackerMicrosoft Visual C++ 8
PEhashf07f45438de8d898b8fef156ecd99c31df8754b4
IMPhash1e3cc7db01a8fa9676373837f106e3c6
AVRisingTrojan.Win32.Bayrod.a
AVCA (E-Trust Ino)no_virus
AVF-SecureGen:Variant.Kazy.609631
AVDr. WebTrojan.Bayrob.1
AVClamAVno_virus
AVArcabit (arcavir)Gen:Variant.Kazy.609631
AVBullGuardGen:Variant.Kazy.609631
AVPadvishno_virus
AVVirusBlokAda (vba32)no_virus
AVCAT (quickheal)TrojanSpy.Nivdort.OD4
AVTrend MicroTROJ_BAYROB.SM0
AVKasperskyTrojan.Win32.Agent.nervjw
AVZillya!no_virus
AVEmsisoftGen:Variant.Kazy.609631
AVIkarusTrojan.Win32.Bayrob
AVFrisk (f-prot)no_virus
AVAuthentiumW32/Scar.R.gen!Eldorado
AVMalwareBytesTrojan.Agent.KVTGen
AVMicroWorld (escan)Gen:Variant.Kazy.609631
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.BG
AVK7Trojan ( 004c77f41 )
AVBitDefenderGen:Variant.Kazy.609631
AVFortinetW32/Generic.AC.215362
AVSymantecDownloader.Upatre!g15
AVGrisoft (avg)Win32/Cryptor
AVEset (nod32)Win32/Bayrob.T
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVAd-AwareGen:Variant.Kazy.609631
AVTwisterW32.Toolbar.CrossRider.AE.lfcr.mg
AVAvira (antivir)TR/Crypt.Xpack.254163
AVMcafeeTrojan-FGIJ!665EDE07D224

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\oidcnyqifqm\lsjdvlv
Creates FileC:\oidcnyqifqm\lp1m5rl6wgjvphfox.exe
Creates FileC:\WINDOWS\oidcnyqifqm\lsjdvlv
Deletes FileC:\WINDOWS\oidcnyqifqm\lsjdvlv
Creates ProcessC:\oidcnyqifqm\lp1m5rl6wgjvphfox.exe

Process
↳ C:\oidcnyqifqm\lp1m5rl6wgjvphfox.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Credential Update Font ➝
C:\oidcnyqifqm\adpcjfei.exe
Creates FileC:\oidcnyqifqm\nr9gcllgwg
Creates FilePIPE\lsarpc
Creates FileC:\oidcnyqifqm\lsjdvlv
Creates FileC:\oidcnyqifqm\adpcjfei.exe
Creates FileC:\WINDOWS\oidcnyqifqm\lsjdvlv
Deletes FileC:\WINDOWS\oidcnyqifqm\lsjdvlv
Creates ProcessC:\oidcnyqifqm\adpcjfei.exe
Creates ServiceModules Error Host Collector Audio Link - C:\oidcnyqifqm\adpcjfei.exe

Process
↳ Pid 800

Process
↳ Pid 852

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1112

Process
↳ Pid 1208

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00
Creates FileWMIDataDevice

Process
↳ Pid 1876

Process
↳ Pid 1160

Process
↳ C:\oidcnyqifqm\adpcjfei.exe

Creates FileC:\oidcnyqifqm\nr9gcllgwg
Creates Filepipe\net\NtControlPipe10
Creates FileC:\oidcnyqifqm\eunvuxng
Creates FileC:\oidcnyqifqm\qiengvfyhqso.exe
Creates FileC:\oidcnyqifqm\lsjdvlv
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\oidcnyqifqm\lsjdvlv
Deletes FileC:\WINDOWS\oidcnyqifqm\lsjdvlv
Creates Processwvw5tgybyyew "c:\oidcnyqifqm\adpcjfei.exe"

Process
↳ C:\oidcnyqifqm\adpcjfei.exe

Process
↳ wvw5tgybyyew "c:\oidcnyqifqm\adpcjfei.exe"

Creates FileC:\oidcnyqifqm\lsjdvlv
Creates FileC:\WINDOWS\oidcnyqifqm\lsjdvlv
Deletes FileC:\WINDOWS\oidcnyqifqm\lsjdvlv

Network Details:

DNSsimpleoffice.net
Type: A
50.63.202.104
DNSmountainsupply.net
Type: A
67.18.199.2
DNSwindowsupply.net
Type: A
173.236.172.44
DNSsweetoffice.net
Type: A
162.213.251.173
DNSmaterialsupply.net
Type: A
184.168.221.36
DNSlaughstrong.net
Type: A
50.21.189.209
DNSsimpledistance.net
Type: A
DNSmotherdistance.net
Type: A
DNSmotheroffice.net
Type: A
DNSsimplearrive.net
Type: A
DNSmotherarrive.net
Type: A
DNSpossiblesupply.net
Type: A
DNSmountaindistance.net
Type: A
DNSpossibledistance.net
Type: A
DNSmountainoffice.net
Type: A
DNSpossibleoffice.net
Type: A
DNSmountainarrive.net
Type: A
DNSpossiblearrive.net
Type: A
DNSperhapssupply.net
Type: A
DNSperhapsdistance.net
Type: A
DNSwindowdistance.net
Type: A
DNSperhapsoffice.net
Type: A
DNSwindowoffice.net
Type: A
DNSperhapsarrive.net
Type: A
DNSwindowarrive.net
Type: A
DNSwintersupply.net
Type: A
DNSsubjectsupply.net
Type: A
DNSwinterdistance.net
Type: A
DNSsubjectdistance.net
Type: A
DNSwinteroffice.net
Type: A
DNSsubjectoffice.net
Type: A
DNSwinterarrive.net
Type: A
DNSsubjectarrive.net
Type: A
DNSfinishsupply.net
Type: A
DNSleavesupply.net
Type: A
DNSfinishdistance.net
Type: A
DNSleavedistance.net
Type: A
DNSfinishoffice.net
Type: A
DNSleaveoffice.net
Type: A
DNSfinisharrive.net
Type: A
DNSleavearrive.net
Type: A
DNSsweetsupply.net
Type: A
DNSprobablysupply.net
Type: A
DNSsweetdistance.net
Type: A
DNSprobablydistance.net
Type: A
DNSprobablyoffice.net
Type: A
DNSsweetarrive.net
Type: A
DNSprobablyarrive.net
Type: A
DNSseveralsupply.net
Type: A
DNSseveraldistance.net
Type: A
DNSmaterialdistance.net
Type: A
DNSseveraloffice.net
Type: A
DNSmaterialoffice.net
Type: A
DNSseveralarrive.net
Type: A
DNSmaterialarrive.net
Type: A
DNSseverastrong.net
Type: A
DNSseveratrouble.net
Type: A
DNSlaughtrouble.net
Type: A
DNSseverapresident.net
Type: A
DNSlaughpresident.net
Type: A
DNSseveracaught.net
Type: A
DNSlaughcaught.net
Type: A
DNSsimplestrong.net
Type: A
DNSmotherstrong.net
Type: A
DNSsimpletrouble.net
Type: A
DNSmothertrouble.net
Type: A
DNSsimplepresident.net
Type: A
DNSmotherpresident.net
Type: A
DNSsimplecaught.net
Type: A
DNSmothercaught.net
Type: A
DNSmountainstrong.net
Type: A
DNSpossiblestrong.net
Type: A
DNSmountaintrouble.net
Type: A
DNSpossibletrouble.net
Type: A
DNSmountainpresident.net
Type: A
DNSpossiblepresident.net
Type: A
DNSmountaincaught.net
Type: A
DNSpossiblecaught.net
Type: A
DNSperhapsstrong.net
Type: A
DNSwindowstrong.net
Type: A
DNSperhapstrouble.net
Type: A
DNSwindowtrouble.net
Type: A
DNSperhapspresident.net
Type: A
DNSwindowpresident.net
Type: A
DNSperhapscaught.net
Type: A
HTTP GEThttp://simpleoffice.net/index.php
User-Agent:
HTTP GEThttp://mountainsupply.net/index.php
User-Agent:
HTTP GEThttp://windowsupply.net/index.php
User-Agent:
HTTP GEThttp://sweetoffice.net/index.php
User-Agent:
HTTP GEThttp://materialsupply.net/index.php
User-Agent:
HTTP GEThttp://laughstrong.net/index.php
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 50.63.202.104:80
Flows TCP192.168.1.1:1032 ➝ 67.18.199.2:80
Flows TCP192.168.1.1:1033 ➝ 173.236.172.44:80
Flows TCP192.168.1.1:1034 ➝ 162.213.251.173:80
Flows TCP192.168.1.1:1035 ➝ 184.168.221.36:80
Flows TCP192.168.1.1:1036 ➝ 50.21.189.209:80

Raw Pcap
0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   696d706c 656f6666 6963652e 6e65740d   impleoffice.net.
0x00000050 (00080)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206d   : close..Host: m
0x00000040 (00064)   6f756e74 61696e73 7570706c 792e6e65   ountainsupply.ne
0x00000050 (00080)   740d0a0d 0a                           t....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2077   : close..Host: w
0x00000040 (00064)   696e646f 77737570 706c792e 6e65740d   indowsupply.net.
0x00000050 (00080)   0a0d0a0d 0a                           .....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   77656574 6f666669 63652e6e 65740d0a   weetoffice.net..
0x00000050 (00080)   0d0a0a0d 0a                           .....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206d   : close..Host: m
0x00000040 (00064)   61746572 69616c73 7570706c 792e6e65   aterialsupply.ne
0x00000050 (00080)   740d0a0d 0a                           t....

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206c   : close..Host: l
0x00000040 (00064)   61756768 7374726f 6e672e6e 65740d0a   aughstrong.net..
0x00000050 (00080)   0d0a0a0d 0a                           .....


Strings