Malware Report - Results

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:
  • MD5 =99ec16aba3a03ba630fc269eb42c8202

    • Malware Report - Results

    File MD5SumSHA1SUMSHA256SUMFUZZY HASHFile Size
    99ec16aba3a03ba630fc269eb42c820292d88d8c657dd1220ad243403e99d586548bc791f44f466d073d9237146b1c186cd9daf01c5ac49d78e9160a6a8978ab550150041536:Zr3gsY64cUj9JQ23X17jrP4/yrn4ixnYqgHZEfzi4AxIvTduc:ZjXY6ifQQX17jE6r4i9YqisAx72792

    File Results

    File Name
    setup83.exe

    SNORT Results

    Snort ClassSnort AlertCount
    N/ANo snort alerts generated0

    AV Results

    AV AlertAV Vendor
    N/ASymantec
    Artemis!99EC16ABA3A0McAfee
    Trojan-Dropper.Win32.Agent.eqnnKaspersky
    InfostealerSymantec
    BackDoor-ERYMcAfee
    Trojan-PSW.Win32.Dybalom.dhcKaspersky
    W32.Spybot.WormSymantec
    Artemis!52CCB0D593ECMcAfee
    Trojan-Banker.Win32.Banbra.afykKaspersky
    Generic.dx!xnbMcAfee

    Folders (Added) - ICC Results

    PathFolder Name

    Files (Added) - ICC Results

    PathFile Name
    c:/Documents and Settings/All Users/Documents19792079
    c:/WINDOWS/PrefetchSANDNET.EXE-2012C478.pf
    c:/WINDOWS/system32b.dll
    c:/WINDOWS/system32dll
    c:/WINDOWS/Tempexplorer.dat
    c:/WINDOWS/Tempwinlogon.dat
    c:netstat_post.txt
    c:taskv_post.txt

    Files (Deleted) - ICC Results

    ActionPathFile Name

    Files (Changed) - ICC Results

    ActionPathFile Name
    modifiedc:/WINDOWS/PrefetchCMD.EXE-087B4001.pf
    modifiedc:/WINDOWS/PrefetchNETSTAT.EXE-2B2B4428.pf
    modifiedc:/WINDOWS/PrefetchSH.EXE-00254D2B.pf
    modifiedc:/WINDOWS/PrefetchSLEEP.EXE-094A3D2A.pf
    modifiedc:/WINDOWS/PrefetchSSHD.EXE-298CA236.pf
    modifiedc:/WINDOWS/PrefetchSWITCH.EXE-0496EC21.pf
    modifiedc:/WINDOWS/system32/configsystem.LOG
    modifiedc:/WINDOWS/system32/drivers/etchosts
    modifiedc:/WINDOWS/system32/wbem/Logswmiprov.log
    modifiedc:/WINDOWS/system32/wbem/Repository/FSINDEX.MAP
    modifiedc:/WINDOWS/system32/wbem/Repository/FSMAPPING.VER
    modifiedc:/WINDOWS/system32/wbem/Repository/FSMAPPING1.MAP
    modifiedc:/WINDOWS/system32/wbem/Repository/FSOBJECTS.MAP

    Registry Keys (Added) - ICC Results

    ActionPath

    Registry Values (Added) - ICC Results

    ActionPathVal_NameVal_Data

    Registry Values (Deleted) - ICC Results

    ActionPathVal_NameVal_TypeMod_Val_TypeVal_DataMod_Val_Data

    Registry Values (Changed) - ICC Results

    ActionPathVal_NameVal_DataMod_Val_Data
    modifiedHKLM/SOFTWARE/Microsoft/Cryptography/RNGSeedFD 95 AC 5E C6 BD E2 E2 2D 8A A0 F7 4E 42 EC 1A 85 9B 22 2C 74 22 09 E5 4C E3 A1 02 08 33 EB 93 B4 F2 A4 2F E7 ED 36 31 BC 3A 23 FA B1 76 D5 77 30 01 2F 5B DB 4
    modifiedHKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformationProgramCount0x00000002 0x00000001

    DNS Results

    DNSDNS Response

    URL Results

    DstIPHTTP_HOSTHTTP_REQUEST_URIHTTP_USER_AGENTPROTOCOL

    ARGUS PROTOCOL Results

    PROTOCOLSRC_PKTSDST_PKTSSRC_BYTESDST_BYTES

    ARGUS DPORT Results

    DPORTPROTOCOLSRC_PKTSDST_PKTSSRC_BYTESDST_BYTES

    ARGUS DATA Results

    TimeDateProtocolSrcIPDstIPDirFlagsSportDportPktsBytes

    Packer Results

    Packer Name

    HoneyTrap Results

    Honey Trap Log File Location

    PTFB Results

    PTFB Log File Location