Malware Report

Malware Report - Results

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:

MD5 =393e480809645881419be8d010b0b0b8

Malware Report - Results

File MD5Sum	SHA1SUM	SHA256SUM	FUZZY HASH	File Size
393e480809645881419be8d010b0b0b8	375aae4b3c881471d9325000e4631307808b5791	64bdc3ee24bbaa0da1338ec54062d50f8f8c7293afaacca2762aa7b27a7ebb1c	768:Tb3HeMuuLr1bM2e+s8uXvDv7M1/fh4qkfaR0cnIgeGJFLAiwR:Tb3eMrLpASs8uXbzMtfhjkiRZn	44250

File Results

File Name
load0x.php%3Fspl%3Djava%5Fgsb%26fh%3B%3D.exe

SNORT Results

Snort Class	Snort Alert	Count
Misc Attack	ET RBN Known Russian Business Network IP TCP (280)	1

AV Results

AV Alert	AV Vendor
N/A	Symantec
Downloader-CKA	McAfee
N/A	Kaspersky
Trojan.Win32.Workir.bn	Kaspersky

Folders (Added) - ICC Results

Path	Folder Name
c:/Documents and Settings/dmc73144/Local Settings/Temp	7394b77a-a5ca-4139-b687-d4a709ad7269
c:/Documents and Settings/dmc73144/Local Settings/Temp	2bd99f17-e342-47f8-9eac-01650b0ebfc0

Files (Added) - ICC Results

Path	File Name
c:/Documents and Settings/dmc73144/Application Data	8fbc0ebc-15d7-4dae-818a-50f3473ae912_44.avi
c:/Documents and Settings/dmc73144/Local Settings/Temp/7394b77a-a5ca-4139-b687-d4a709ad7269	wrk1.tmp_44
c:/WINDOWS/Prefetch	RUNDLL32.EXE-2892C66B.pf
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:	netstat_post.txt
c:	taskv_post.txt
c:/Documents and Settings/dmc73144/Application Data	8fbc0ebc-15d7-4dae-818a-50f3473ae912_44.avi
c:/Documents and Settings/dmc73144/Local Settings/Temp/2bd99f17-e342-47f8-9eac-01650b0ebfc0	wrk1.tmp_44
c:/WINDOWS/Prefetch	RUNDLL32.EXE-1319676B.pf
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:	netstat_post.txt
c:	taskv_post.txt

Files (Deleted) - ICC Results

Action	Path	File Name

Files (Changed) - ICC Results

Action	Path	File Name
modified	c:/Documents and Settings/dmc73144/Cookies	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	index.dat
modified	c:/Documents and Settings/dmc73144	ntuser.dat.LOG
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING2.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP
modified	c:/Documents and Settings/dmc73144/Cookies	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	index.dat
modified	c:/Documents and Settings/dmc73144	ntuser.dat.LOG
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING2.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP

Registry Keys (Added) - ICC Results

Action	Path

Registry Values (Added) - ICC Results

Action	Path	Val_Name	Val_Data

Registry Values (Deleted) - ICC Results

Action	Path	Val_Name	Val_Type	Mod_Val_Type	Val_Data	Mod_Val_Data

Registry Values (Changed) - ICC Results

Action	Path	Val_Name	Val_Data	Mod_Val_Data
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	98 71 44 5F 6A CF A3 D4 AE 72 0A D2 71 6C DD A8 AD 02 0E 38 2C 8C F4 BC 22 D7 AA	E2 CB 6B 91 DA B7 AE 3E 03 DC 12 D9 0D 36 EA B5 49 81 7C 5D 85 7A 3C AB 81 7A 0
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet Settings/Connections	SavedLegacySettings	3C 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00	3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation	ProgramCount	0x00000002	0x00000001
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	81 7E 1C 5A 8D 78 F3 9D 01 DB 8A 20 88 7C C7 5D C5 B4 A8 B6 C0 D2 AA A9 33 E1 E9	5B AF 48 BC 93 30 7C 54 D7 67 57 18 60 D3 9B E3 7B 3B 3A 3F 23 A5 F3 7C A2 8B 1
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet Settings/Connections	SavedLegacySettings	3C 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00	3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation	ProgramCount	0x00000002	0x00000001

DNS Results

DNS	DNS Response

URL Results

DstIP	HTTP_HOST	HTTP_REQUEST_URI	HTTP_USER_AGENT	PROTOCOL
91.188.60.5	91.188.60.5	/hit.php?v=44&app_type_id=1&wm_id=acc0044&u=7394b77a-a5ca-4139-b687-d4a709ad7269&t=2		0x06
91.188.60.5	91.188.60.5	/hit.php?v=44&app_type_id=1&wm_id=acc0044&u=6cd44bb0-4762-497e-b0bf-e08e580d77ae&t=2		0x06
91.188.60.5	91.188.60.5	/hit.php?v=44&app_type_id=1&wm_id=acc0044&u=2bd99f17-e342-47f8-9eac-01650b0ebfc0&t=2		0x06
239.255.255.250	239.255.255.250:1900	*	--blank--	0x11

ARGUS PROTOCOL Results

PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
6	5	4	441	515
17	2	0	350	0

ARGUS DPORT Results

DPORT	PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
80	6	5	4	441	515
1900	17	2	0	350	0

ARGUS DATA Results

Time	Date	Protocol	SrcIP	DstIP	Dir	Flags	Sport	Dport	Pkts	Bytes
13:15:42	2010-07-15	6	10.10.10.7	91.188.60.5	->	e	169	80	9	956
21:01:21	2010-07-15	6	10.10.10.7	91.188.60.5	->	e	52	80	9	956
13:20:58	2010-07-15	17	10.10.10.7	239.255.255.250	->	e	8	1900	2	350
21:06:41	2010-07-15	17	10.10.10.7	239.255.255.250	->	e	8	1900	2	350
05:23:18	2010-07-16	6	10.10.10.7	91.188.60.5	->	e	11	80	9	956
05:28:24	2010-07-16	17	10.10.10.7	239.255.255.250	->	e	4002	1900	2	350
05:28:30	2010-07-16	17	10.10.10.7	239.255.255.250	->	e	4002	1900	1	175
05:28:33	2010-07-16	17	10.10.10.7	239.255.255.250	->	e	413	1900	2	350

Packer Results

Packer Name

HoneyTrap Results

Honey Trap Log File Location

PTFB Results

PTFB Log File Location