Malware Report

This report shows all the different areas TAZER analyzes for the sample: Host, Network Activity, and Detection.

Malware Search Criteria:

MD5 =e648c168ba4b90e01ad88044e247a639

File MD5Sum	SHA1SUM	SHA256SUM	FUZZY HASH	File Size
e648c168ba4b90e01ad88044e247a639	44436d9d0ea99751373103620eb6e9cab98c1938	2b813f09dafa55bfdd98d592531c48be9b7f1e6a2b6e44f6a349fc53cdcc6ea2	1536:7UfaiKLsLcLZcP59LuEN3pLMJA99LSulRlSvvMPCIiuAMJuB77hnlF:o+sIUL75a8+uV+GLilM8	67584

File Name
172990124.gif.exe

Snort Class	Snort Alert	Count
N/A	No snort alerts generated	0

AV Alert	AV Vendor
Trojan.Gen	Symantec
Artemis!E648C168BA4B	McAfee
Trojan-Ransom.Win32.PornoBlocker.vor	Kaspersky
Trojan.ADH.2	Symantec
Artemis!E1326D81D257	McAfee
not-a-virus:AdWare.Win32.HotBar.dh	Kaspersky
N/A	Symantec
N/A	McAfee
Backdoor.Win32.Delf.zfk	Kaspersky

Path	Folder Name

Path	File Name
c:/Documents and Settings/All Users/Documents	19792079
c:/Documents and Settings/All Users/Documents	dll
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:/WINDOWS/system32	dll
c:/WINDOWS/system32	w.dll
c:/WINDOWS/Temp	explorer.dat
c:/WINDOWS/Temp	winlogon.dat
c:	netstat_post.txt
c:	taskv_post.txt
c:/Documents and Settings/All Users/Documents	19792079
c:/Documents and Settings/All Users/Documents	dll
c:/WINDOWS/Prefetch	SANDNET.EXE-2012C478.pf
c:/WINDOWS/system32	dll
c:/WINDOWS/system32	w.dll
c:/WINDOWS/Temp	explorer.dat
c:/WINDOWS/Temp	winlogon.dat
c:	netstat_post.txt
c:	taskv_post.txt

Action	Path	File Name

Action	Path	File Name
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/system32/config	system.LOG
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Logs	wmiprov.log
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING2.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP
modified	c:/WINDOWS/Prefetch	CMD.EXE-087B4001.pf
modified	c:/WINDOWS/Prefetch	HSTART.EXE-221D72BF.pf
modified	c:/WINDOWS/Prefetch	NETSTAT.EXE-2B2B4428.pf
modified	c:/WINDOWS/Prefetch	SH.EXE-00254D2B.pf
modified	c:/WINDOWS/Prefetch	SLEEP.EXE-094A3D2A.pf
modified	c:/WINDOWS/Prefetch	SSHD.EXE-298CA236.pf
modified	c:/WINDOWS/Prefetch	SWITCH.EXE-0496EC21.pf
modified	c:/WINDOWS/system32/config	system.LOG
modified	c:/WINDOWS/system32/drivers/etc	hosts
modified	c:/WINDOWS/system32/wbem/Logs	wmiprov.log
modified	c:/WINDOWS/system32/wbem/Repository/FS	INDEX.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING.VER
modified	c:/WINDOWS/system32/wbem/Repository/FS	MAPPING2.MAP
modified	c:/WINDOWS/system32/wbem/Repository/FS	OBJECTS.MAP

Action	Path

Action	Path	Val_Name	Val_Data

Action	Path	Val_Name	Val_Type	Mod_Val_Type	Val_Data	Mod_Val_Data

Action	Path	Val_Name	Val_Data	Mod_Val_Data
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	25 21 D4 93 BE 01 4C 59 50 ED E9 BF CD 17 63 8E BF 09 0E 47 A4 23 D7 7F AB D9 A0	25 BC E9 2E 49 69 0D E4 D9 EE B8 D6 7D CB 38 BD 44 DB B9 08 9D DB ED 25 78 B9 9
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation	ProgramCount	0x00000002	0x00000001
modified	HKLM/SOFTWARE/Microsoft/Cryptography/RNG	Seed	88 D2 F7 0F F1 2C 67 97 A0 69 C5 E3 80 74 C6 41 CB E3 15 2A DD 5B 26 AC 2C 86 C4	4A 1D DA B4 B0 1E 71 7C D9 EC 1B F5 FC F7 94 8E B2 27 84 9F 29 4B 72 88 24 E7 E
modified	HKU/S-1-5-21-1844237615-562591055-839522115-1004/SessionInformation	ProgramCount	0x00000002	0x00000001

DNS	DNS Response

DstIP	HTTP_HOST	HTTP_REQUEST_URI	HTTP_USER_AGENT	PROTOCOL
239.255.255.250	239.255.255.250:1900	*	--blank--	0x11

PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
17	2	0	350	0

DPORT	PROTOCOL	SRC_PKTS	DST_PKTS	SRC_BYTES	DST_BYTES
1900	17	2	0	350	0

Time	Date	Protocol	SrcIP	DstIP	Dir	Flags	Sport	Dport	Pkts	Bytes
15:55:42	2011-04-28	17	10.10.10.7	239.255.255.250	->	e	8	1900	2	350

Packer Name

Honey Trap Log File Location

PTFB Log File Location