Malware Report

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:

MD5 =e275a6c12ff26ee549b2bce352d2c0f1

File MD5Sum	SHA1SUM	SHA256SUM	FUZZY HASH	File Size
e275a6c12ff26ee549b2bce352d2c0f1	135039f579a9c375123904a7ff624b11ac38d5cf	13a66e96bc336f9d0e472dc328af908e7ce21b58666b8f3161e5f910ccf8a768	12288:qBvbOcG0hWgqDMDwsA2yWjXdNGJSQLNfNz:WyMhWrYR9yYNNmVLTz	578048

File Name
comprovante.php.exe

Snort Class	Snort Alert	Count
N/A	No snort alerts generated	0

AV Alert	AV Vendor

Path	Folder Name

Action	Path	File Name

Action	Path	File Name
modified	c:/Documents and Settings/dmc73144	ntuser.dat.LOG
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	NTOSBOOT-B00DFAAD.pf
modified	c:/WINDOWS/Prefetch	SCP.EXE-174845DC.pf
modified	c:/WINDOWS/Prefetch	SENDIT.EXE-34C997E3.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/Prefetch	TASKLIST.EXE-10D94B23.pf
modified	c:/WINDOWS/Prefetch	WMIPRVSE.EXE-28F301A9.pf
modified	c:/WINDOWS/Prefetch	WUAUCLT.EXE-399A8E72.pf
modified	c:/WINDOWS	SchedLgU.Txt
modified	c:/WINDOWS/SoftwareDistribution/DataStore/Logs	edb.chk
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING2.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP

Action	Path

Action	Path	Val_Name	Val_Data

Action	Path	Val_Name	Val_Type	Mod_Val_Type	Val_Data	Mod_Val_Data

Action	Path	Val_Name	Val_Data	Mod_Val_Data
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	A6 13 1E 3F AA 85 9A E1 41 87 17 1A CF BE 1F 5C 37 CD 74 FB C7 66 5D A8 13 03 A8	14 63 AF D1 7E 46 CD 8D 60 D1 9D 14 7C AD 14 74 6C CE 0D D0 E4 E8 34 0F 2E F7 2

DNS	DNS Response

DstIP	HTTP_HOST	HTTP_REQUEST_URI	HTTP_USER_AGENT	PROTOCOL
64.31.58.237	64.31.58.237	/icone.php	Mozilla/3.0 (compatible; Indy Library)	0x06
64.31.58.237	64.31.58.237	/icone.txt	Mozilla/3.0 (compatible; Indy Library)	0x06
239.255.255.250	239.255.255.250:1900	*	--blank--	0x11

PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
6	10	8	888	1030
17	3	0	525	0

DPORT	PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
80	6	10	8	888	1030
1900	17	3	0	525	0

Time	Date	Protocol	SrcIP	DstIP	Dir	Flags	Sport	Dport	Pkts	Bytes
21:05:58	2011-06-11	6	10.10.10.7	64.31.58.237	->	e	33	80	9	959
21:05:59	2011-06-11	6	10.10.10.7	64.31.58.237	->	e	67	80	9	959
21:05:00	2011-06-11	17	10.10.10.7	239.255.255.250	->	e	152	1900	1	175
21:11:29	2011-06-11	17	10.10.10.7	239.255.255.250	->	e	8	1900	2	350

Packer Name

Honey Trap Log File Location

PTFB Log File Location