Malware Report

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:

MD5 =811a6c66f510b4b22c10706b4e5c91b9

File MD5Sum	SHA1SUM	SHA256SUM	FUZZY HASH	File Size
811a6c66f510b4b22c10706b4e5c91b9	4e72f6206adcd4c7afb5692f093a19d7792f1893	e697d7a7febc54461351c53d72baf90e07ce14bb885244fa8a9e74ae0098d126	12288:vZoe0wVY0DJeQkbtde8yQXhgC9AEeUaSsc09JGg0c8c:hoe0whD0Hve8/qIAPU+/uZcF	457863

File Name
Ver%5FMensaje.php.exe

Snort Class	Snort Alert	Count
N/A	No snort alerts generated	0

AV Alert	AV Vendor

Path	Folder Name

Path	File Name
c:/Documents and Settings/dmc73144/Local Settings/Temp	~DFACA8.tmp
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:/WINDOWS/system32	winlogin.exe
c:/WINDOWS	winrun.exe
c:	netstat_post.txt
c:	taskv_post.txt

Action	Path	File Name

Action	Path	File Name
modified	c:/Documents and Settings/dmc73144/Cookies	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	index.dat
modified	c:/Documents and Settings/dmc73144	ntuser.dat.LOG
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING2.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP

Action	Path

Action	Path	Val_Name	Val_Data

Action	Path	Val_Name	Val_Type	Mod_Val_Type	Val_Data	Mod_Val_Data

Action	Path	Val_Name	Val_Data	Mod_Val_Data
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	61 F5 94 2F DE 33 C9 23 1B E8 95 26 37 CD 23 B1 5C 14 44 76 8B CF 85 B7 6E 8F C1	9F C4 04 B1 99 A8 0D 2F 42 9A B6 96 BF 7D 01 C8 5D D6 CD 94 CA 16 43 DE 6A D7 1
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet Settings/Connections	SavedLegacySettings	3C 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00	3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows NT/CurrentVersion/Windows	load	""	"C

DNS	DNS Response
cruzrojayumbo.org	Standard query response A 66.197.162.117

DstIP	HTTP_HOST	HTTP_REQUEST_URI	HTTP_USER_AGENT	PROTOCOL
66.197.162.117	cruzrojayumbo.org	/accesos.jpg	vb wininet	0x06
239.255.255.250	239.255.255.250:1900	*	--blank--	0x11

PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
6	100	80	7480	10300
17	2	0	350	0

DPORT	PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
80	6	100	80	7480	10300
1900	17	2	0	350	0

Time	Date	Protocol	SrcIP	DstIP	Dir	Flags	Sport	Dport	Pkts	Bytes
17:49:38	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	108	80	9	889
17:49:50	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	316	80	9	889
17:50:01	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	21	80	9	889
17:50:13	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	379	80	9	889
17:50:25	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	536	80	9	889
17:50:37	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	212	80	9	889
17:50:49	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	129	80	9	889
17:51:01	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	577	80	9	889
17:51:13	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	323	80	9	889
17:51:24	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	609	80	9	889
17:51:36	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	627	80	9	889
17:51:48	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	325	80	9	889
17:52:00	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	628	80	9	889
17:52:12	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	729	80	9	889
17:52:24	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	730	80	9	889
17:52:36	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	772	80	9	889
17:52:48	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	773	80	9	889
17:52:59	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	820	80	9	889
17:53:11	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	821	80	9	889
17:53:23	2011-07-02	6	10.10.10.7	66.197.162.117	->	e	822	80	9	889
17:54:58	2011-07-02	17	10.10.10.7	239.255.255.250	->	e	8	1900	2	350

Packer Name

Honey Trap Log File Location

PTFB Log File Location