Malware Report

Malware Report - Results

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:

MD5 =3cdb9e4c12ff9bb76197469bed0aad2f

Malware Report - Results

File MD5Sum	SHA1SUM	SHA256SUM	FUZZY HASH	File Size
3cdb9e4c12ff9bb76197469bed0aad2f	b15c27b7baac2692964ed91b18b196ba3081f56d	81a7cf2d38b08402294c592d3a85b703a753683248ae352141ff5e42943a83f3	49152:P1xY5Fsls3vWRxAMtTbl7LrzIZhmEm16aSJNzadVSsW:flyJMtT9HERfcVB	1624576

File Results

File Name
arraysaw.net.exe

SNORT Results

Snort Class	Snort Alert	Count
A Network Trojan was detected	ET TROJAN LDPinch Checkin (5)	1
A Network Trojan was detected	ET TROJAN LDPinch Checkin (2)	1

AV Results

AV Alert	AV Vendor

Folders (Added) - ICC Results

Path	Folder Name
c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5	MSHist012010042020100421
c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	87IMY4XV
c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	ITB2CJ0C
c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	WO4JPI86

Files (Added) - ICC Results

Path	File Name
c:/DELL/VIDEO/OUTPUT	netstat_base.txt
c:/DELL/VIDEO/OUTPUT	netstat_post.txt
c:/DELL/VIDEO/OUTPUT	tasksvc_base.txt
c:/DELL/VIDEO/OUTPUT	tasksvc_post.txt
c:/DELL/VIDEO/OUTPUT	taskv_base.txt
c:/DELL/VIDEO/OUTPUT	taskv_post.txt
c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5/MSHist012010042020100421	index.dat
c:/Documents and Settings/dmc73144/Local Settings/Temp	1_goo.exe
c:/Documents and Settings/dmc73144/Local Settings/Temp	4_pinnew.exe
c:/Documents and Settings/dmc73144/Local Settings/Temp	5_odbns.exe
c:/Documents and Settings/dmc73144/Local Settings/Temp	60325cahp25ca0.exe
c:/Documents and Settings/dmc73144/Local Settings/Temp	avto.exe
c:/Documents and Settings/dmc73144/Local Settings/Temp	teste1_p.exe
c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/87IMY4XV	desktop.ini
c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/ITB2CJ0C	desktop.ini
c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/ITB2CJ0C	r[1].htm
c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/WO4JPI86	desktop.ini
c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5/WO4JPI86	r[1].htm
c:/WINDOWS/Prefetch	1033X.EXE-20B8AC9E.pf
c:/WINDOWS/Prefetch	1_GOO.EXE-15FE1DEE.pf
c:/WINDOWS/Prefetch	2_LOAD.EXE-35E31D12.pf
c:/WINDOWS/Prefetch	4_PINNEW.EXE-20359EE0.pf
c:/WINDOWS/Prefetch	5_ODBNS.EXE-0A05BF52.pf
c:/WINDOWS/Prefetch	7Z.EXE-1A62CD19.pf
c:/WINDOWS/Prefetch	AUTOIT3.EXE-32361418.pf
c:/WINDOWS/Prefetch	AVTO.EXE-112EBFA8.pf
c:/WINDOWS/Prefetch	DIEP.EXE-0B3E1DC8.pf
c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
c:/WINDOWS/Prefetch	REGSHOT.EXE-010A5EE6.pf
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:/WINDOWS/Prefetch	SVCHOST.EXE-3530F672.pf
c:/WINDOWS/Prefetch	TESTE1_P.EXE-38221047.pf
c:/WINDOWS/system32	1033x.exe
c:/WINDOWS/system32	82799957.dat
c:/WINDOWS	lsass.exe
c:/WINDOWS	odbns.exe
c:/WINDOWS	svc.exe
c:	BoOT.INi

Files (Deleted) - ICC Results

Action	Path	File Name

Files (Changed) - ICC Results

Action	Path	File Name
modified	c:/Documents and Settings/dmc73144/Cookies	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	index.dat
modified	c:/Documents and Settings/dmc73144	ntuser.dat.LOG
modified	c:/Documents and Settings/LocalService	ntuser.dat.LOG
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	NTOSBOOT-B00DFAAD.pf
modified	c:/WINDOWS/Prefetch	SCP.EXE-174845DC.pf
modified	c:/WINDOWS/Prefetch	SENDIT.EXE-34C997E3.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/Prefetch	TASKLIST.EXE-10D94B23.pf
modified	c:/WINDOWS/Prefetch	WMIPRVSE.EXE-28F301A9.pf
modified	c:/WINDOWS/Prefetch	WUAUCLT.EXE-399A8E72.pf
modified	c:/WINDOWS/SoftwareDistribution/DataStore/Logs	edb.chk
modified	c:/WINDOWS/system32/config	software.LOG
modified	c:/WINDOWS/system32/config	system.LOG
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Logs	wbemess.log
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING1.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP

Registry Keys (Added) - ICC Results

Action	Path

Registry Values (Added) - ICC Results

Action	Path	Val_Name	Val_Data

Registry Values (Deleted) - ICC Results

Action	Path	Val_Name	Val_Type	Mod_Val_Type	Val_Data	Mod_Val_Data

Registry Values (Changed) - ICC Results

Action	Path	Val_Name	Val_Data	Mod_Val_Data
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	E1 FC 83 8A 18 DE 96 D3 8E 4C E5 64 20 82 24 9D 84 1E 2C 7D FA 3F 0B 5C AD 8A 23	00 65 AD 8A F0 C4 53 65 E2 20 12 97 CB 3F 80 29 DB 40 E8 34 DA 60 70 25 C1 72 C
modified	HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/ProfileList/S-1-5-19	RefCount	0x00000002	0x00000001
modified	HKLM/SYSTEM/ControlSet001/Services/SharedAccess/Epoch	Epoch	0x00000104	0x00000106
modified	HKLM/SYSTEM/CurrentControlSet/Services/SharedAccess/Epoch	Epoch	0x00000104	0x00000106
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet Settings/Connections	SavedLegacySettings	3C 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00	3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0

DNS Results

DNS	DNS Response
www.edition-wilhelm-rieber.de	Standard query response A 80.67.28.84
supertds.com	Standard query response A 64.74.223.32
moretds.org	Standard query response A 188.124.9.62
saloongins.net	Standard query response A 188.124.9.60
bulkrecord.com	Standard query response A 63.251.179.57 A 64.158.56.57
settopworld.net	Standard query response A 188.124.9.61
greatinstant.net	Standard query response A 188.124.9.61
trenublo.com	Standard query response A 188.124.9.61
bestwebtop.net	Standard query response A 188.124.9.61
greattaby.com	Standard query response A 188.124.9.59
cafebarplaza.cn	Standard query response A 188.124.9.59

URL Results

DstIP	HTTP_HOST	HTTP_REQUEST_URI	HTTP_USER_AGENT	PROTOCOL
80.67.28.84	www.edition-wilhelm-rieber.de	/js/r/r.php?r=1	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
64.74.223.32	supertds.com	/getit.php		0x06
80.67.28.84	www.edition-wilhelm-rieber.de	/js/r/r.php?r=4	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
188.124.9.60	saloongins.net	/nopte/tds2.php	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
63.251.179.57	bulkrecord.com	/scripts/index.php		0x06
188.124.9.61	settopworld.net	/incallspa.php	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
188.124.9.61	greatinstant.net	/yourseekerz.php	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
188.124.9.61	trenublo.com	/estplanete.php	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
188.124.9.61	bestwebtop.net	/estvirtuel.php	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
188.124.9.59	greattaby.com	/addlinkworld.php	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
188.124.9.59	cafebarplaza.cn	/mostextra.php	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
188.124.9.61	settopworld.net	/greattab.php	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
188.124.9.61	greatinstant.net	/therealabc.php	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
188.124.9.61	trenublo.com	/topext.php	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
188.124.9.61	trenublo.com	/yourtopline.php	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
188.124.9.61	trenublo.com	/counterbest.php	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
188.124.9.61	bestwebtop.net	/detectinga.php	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)	0x06
239.255.255.250	239.255.255.250:1900	*	--blank--	0x11

ARGUS PROTOCOL Results

PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
6	161	138	16564	26067
17	434	0	76166	0

ARGUS DPORT Results

DPORT	PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
80	6	161	138	16564	26067
1900	17	434	0	76166	0

ARGUS DATA Results

Time	Date	Protocol	SrcIP	DstIP	Dir	Flags	Sport	Dport	Pkts	Bytes
01:40:54	2010-04-20	6	10.10.10.7	80.67.28.84	->	e	106	80	10	1078
01:40:57	2010-04-20	6	10.10.10.7	64.74.223.32	->	e	180	80	13	1985
01:41:00	2010-04-20	6	10.10.10.7	188.124.9.62	->	e	172	80	10	2939
01:41:00	2010-04-20	6	10.10.10.7	80.67.28.84	->	e	71	80	9	1018
01:41:02	2010-04-20	6	10.10.10.7	64.74.223.32	->	e	180	80	10	1965
01:41:03	2010-04-20	6	10.10.10.7	63.251.179.57	->	e	181	80	22	3653
01:41:07	2010-04-20	6	10.10.10.7	64.74.223.32	->	e	180	80	6	633
01:41:08	2010-04-20	6	10.10.10.7	63.251.179.57	->	e	181	80	10	1965
01:41:09	2010-04-20	6	10.10.10.7	188.124.9.61	->	e	72	80	9	1027
01:41:13	2010-04-20	6	10.10.10.7	63.251.179.57	->	e	181	80	5	300
01:41:28	2010-04-20	6	10.10.10.7	188.124.9.61	->	e	183	80	9	1030
01:41:47	2010-04-20	6	10.10.10.7	188.124.9.61	->	e	186	80	9	1025
01:42:05	2010-04-20	6	10.10.10.7	188.124.9.61	->	e	188	80	9	1027
01:42:08	2010-04-20	6	10.10.10.7	64.74.223.32	->	e	146	80	13	1985
01:42:13	2010-04-20	6	10.10.10.7	64.74.223.32	->	e	146	80	11	2298
01:42:18	2010-04-20	6	10.10.10.7	64.74.223.32	->	e	146	80	5	300
01:42:25	2010-04-20	6	10.10.10.7	188.124.9.59	->	e	40	80	9	1028
01:42:44	2010-04-20	6	10.10.10.7	188.124.9.59	->	e	56	80	9	1027
01:43:02	2010-04-20	6	10.10.10.7	188.124.9.61	->	e	108	80	9	1026
01:43:19	2010-04-20	6	10.10.10.7	64.74.223.32	->	e	190	80	13	1985
01:43:21	2010-04-20	6	10.10.10.7	188.124.9.61	->	e	191	80	9	1029
01:43:24	2010-04-20	6	10.10.10.7	64.74.223.32	->	e	190	80	11	2298
01:43:29	2010-04-20	6	10.10.10.7	64.74.223.32	->	e	190	80	5	300
01:43:40	2010-04-20	6	10.10.10.7	188.124.9.61	->	e	60	80	9	1021
01:43:59	2010-04-20	6	10.10.10.7	188.124.9.61	->	e	195	80	9	1026
01:44:18	2010-04-20	6	10.10.10.7	188.124.9.61	->	e	24	80	9	1026
01:44:30	2010-04-20	6	10.10.10.7	64.74.223.32	->	e	26	80	13	1985
01:44:35	2010-04-20	6	10.10.10.7	64.74.223.32	->	e	26	80	10	1965
01:44:37	2010-04-20	6	10.10.10.7	188.124.9.61	->	e	199	80	9	1027
01:44:40	2010-04-20	6	10.10.10.7	64.74.223.32	->	e	26	80	6	633
01:40:57	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	34	1900	8	1404
01:41:02	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	34	1900	12	2106
01:41:12	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	73	1900	14	2457
01:41:18	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	73	1900	6	1053
01:41:22	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	182	1900	14	2457
01:41:28	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	182	1900	6	1053
01:41:32	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	184	1900	14	2457
01:41:38	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	184	1900	6	1053
01:41:42	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	185	1900	12	2106
01:41:48	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	185	1900	8	1404
01:41:52	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	187	1900	14	2457
01:41:58	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	187	1900	6	1053
01:42:02	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	140	1900	14	2457
01:42:08	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	140	1900	6	1053
01:42:12	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	158	1900	14	2457
01:42:17	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	158	1900	6	1053
01:42:22	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	39	1900	14	2457
01:42:28	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	39	1900	6	1053
01:42:32	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	18	1900	12	2106
01:42:38	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	18	1900	8	1404
01:42:42	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	43	1900	14	2457
01:42:48	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	43	1900	6	1053
01:42:52	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	44	1900	10	1755
01:42:59	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	44	1900	2	351
01:43:05	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	44	1900	4	702
01:43:12	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	44	1900	4	702
01:43:17	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	189	1900	16	2808
01:43:23	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	189	1900	4	702
01:43:27	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	192	1900	12	2106
01:43:32	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	192	1900	8	1404
01:43:37	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	59	1900	16	2808
01:43:43	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	59	1900	4	702
01:43:47	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	193	1900	16	2808
01:43:53	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	193	1900	4	702
01:43:57	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	194	1900	16	2808
01:44:03	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	194	1900	4	702
01:44:07	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	196	1900	16	2808
01:44:13	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	196	1900	4	702
01:44:17	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	197	1900	14	2457
01:44:22	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	197	1900	6	1053
01:44:27	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	25	1900	16	2808
01:44:33	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	25	1900	4	702
01:44:37	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	198	1900	16	2808
01:44:43	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	198	1900	4	702
01:44:47	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	200	1900	12	2106
01:46:26	2010-04-20	17	10.10.10.7	239.255.255.250	->	e	8	1900	2	350

Packer Results

Packer Name

HoneyTrap Results

Honey Trap Log File Location

PTFB Results

PTFB Log File Location