Malware Report

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:

MD5 =da927c2fc684de8a1ab21e7d3e9f4293

File MD5Sum	SHA1SUM	SHA256SUM	FUZZY HASH	File Size
da927c2fc684de8a1ab21e7d3e9f4293	368fb74cbc1344ded7b1c5006f858b3270e68642	af5cc0bbcf429b8906c4231d8b5b741f669a1526ec76224b03398ce8dabfbd37	1536:nqWg3vozye5s4m+V9UDfODtkidwEU1TgyYzYffsqQcPKOeV2qdGzUx932CJYCfug:zg3wzye5s4	98328

File Name
Postales.exe

Snort Class	Snort Alert	Count
N/A	No snort alerts generated	0

Path	Folder Name

Path	File Name
c:/Documents and Settings/dmc73144/Local Settings/Temp	~DF9377.tmp
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:/WINDOWS/system32	winlogin.exe
c:/WINDOWS	winrun.exe
c:	netstat_post.txt
c:	taskv_post.txt

Action	Path	File Name

Action	Path	File Name
modified	c:/Documents and Settings/dmc73144/Cookies	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/History/History.IE5	index.dat
modified	c:/Documents and Settings/dmc73144/Local Settings/Temporary Internet Files/Content.IE5	index.dat
modified	c:/Documents and Settings/dmc73144	ntuser.dat.LOG
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Logs	wmiprov.log
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING2.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP

Action	Path

Action	Path	Val_Name	Val_Data

Action	Path	Val_Name	Val_Type	Mod_Val_Type	Val_Data	Mod_Val_Data

Action	Path	Val_Name	Val_Data	Mod_Val_Data
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	01 E1 F3 58 12 C6 AB 72 AD FD FA F3 77 06 E3 F9 EE 12 BA 8D FA E2 7D C7 60 4D 95	CD 6C 12 B4 73 52 CB 39 0A 99 2D 06 19 06 D1 F0 80 FE 0E B0 21 4C 16 0A BE C6 4
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows/CurrentVersion/Internet Settings/Connections	SavedLegacySettings	3C 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00	3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/Software/Microsoft/Windows NT/CurrentVersion/Windows	load	""	"C

DNS	DNS Response

DstIP	HTTP_HOST	HTTP_REQUEST_URI	HTTP_USER_AGENT	PROTOCOL
72.29.93.12	72.29.93.12	/~gesmopol/components/banner/htdacess	vb wininet	0x06
239.255.255.250	239.255.255.250:1900	*	--blank--	0x11

PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
6	95	76	7467	9785
17	2	0	350	0

DPORT	PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
80	6	95	76	7467	9785
1900	17	2	0	350	0

Time	Date	Protocol	SrcIP	DstIP	Dir	Flags	Sport	Dport	Pkts	Bytes
12:37:27	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	225	80	9	908
12:37:39	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	142	80	9	908
12:37:50	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	285	80	9	908
12:38:02	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	317	80	9	908
12:38:14	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	530	80	9	908
12:38:26	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	192	80	9	908
12:38:38	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	569	80	9	908
12:38:50	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	570	80	9	908
12:39:01	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	390	80	9	908
12:39:13	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	160	80	9	908
12:39:25	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	624	80	9	908
12:39:37	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	162	80	9	908
12:39:49	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	262	80	9	908
12:40:01	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	723	80	9	908
12:40:13	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	724	80	9	908
12:40:25	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	770	80	9	908
12:40:36	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	771	80	9	908
12:40:48	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	814	80	9	908
12:41:00	2011-06-21	6	10.10.10.7	72.29.93.12	->	e	815	80	9	908
12:42:44	2011-06-21	17	10.10.10.7	239.255.255.250	->	e	8	1900	2	350

Packer Name

Honey Trap Log File Location

PTFB Log File Location