Antivirus scan for 329f12d0a5bec827a48c742abd1c87ba1d7be7b1aa16600422b8a1d9cce10c53 at 2014-05-04 10:13:21 UTC

Antivirus	Result	Update
AntiVir	TR/Spy.ZBot.aao.227	20140504
Antiy-AVL	Trojan[Spy]/Win32.Zbot	20140504
AVG	Zbot.ICQ	20140504
Baidu-International	Trojan.Win32.Zbot.AAO	20140504
Bkav	HW32.CDB.Bc4e	20140428
ESET-NOD32	Win32/Spy.Zbot.AAO	20140504
Fortinet	W32/Zbot.AAO!tr	20140504
Kaspersky	Trojan-Spy.Win32.Zbot.shay	20140504
Malwarebytes	Spyware.Zbot.VXGen	20140504
McAfee	Artemis!A944C2D45112	20140504
McAfee-GW-Edition	Artemis!A944C2D45112	20140503
Rising	PE:Malware.XPACK-LNR/Heur!1.5594	20140503
Sophos AV	Mal/Generic-S	20140504
TrendMicro-HouseCall	TROJ_GEN.R02PH07E314	20140504
VIPRE	Trojan.Win32.Generic!BT	20140504
Ad-Aware		20140504
AegisLab		20140504
Yandex		20140503
AhnLab-V3		20140504
Avast		20140504
BitDefender		20140504
ByteHero		20140504
CAT-QuickHeal		20140502
ClamAV		20140504
CMC		20140429
Commtouch		20140504
Comodo		20140504
DrWeb		20140504
Emsisoft		20140504
F-Prot		20140504
F-Secure		20140504
GData		20140504
Ikarus		20140504
Jiangmin		20140504
K7AntiVirus		20140502
K7GW		20140502
Kingsoft		20140504
Microsoft		20140504
eScan		20140504
NANO-Antivirus		20140504
Norman		20140504
nProtect		20140504
Panda		20140504
Qihoo-360		20140504
SUPERAntiSpyware		20140503
Symantec		20140504
TheHacker		20140502
TotalDefense		20140504
TrendMicro		20140504
VBA32		20140503
ViRobot		20140504
Zillya		20140504

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

Publisher Control Break International

Product Opiqogi

Original name Ppiokhrevv.exe

Internal name Zilu

File version 8, 9, 10

Description Icet Okyk Amopi

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2011-03-17 19:01:46

Entry Point 0x00012A6B

Number of sections 4

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 77663 77824 7.51 fb69ae09f9c7d1bc588edff8f1e4cd55

.rdatae 81920 40492 40960 4.59 73825004f1fdd95ccc4e048c27293073

.data[ 122880 152192 82944 7.53 124c81d997481b3ed9ae1107a087917d

.rsrc 278528 61332 61440 7.16 92fdcfaa0ea99a7c07ec8b085f02e002

PE imports

Number of PE resources by type

RT_BITMAP 176

RT_VERSION 1

Number of PE resources by language

ENGLISH AUS 177

PE resources

0042ea066940db7cbcf045ef7a80e914aa37633b20c3b69ddd08e333b722ba39 data

03232581efa2ae07f94d9edd8a4d2b908502b59b28ee4a9cd6bd8bab58ea3c3d data

03245307ad9c11ffe5d8328abb46cbe8d0d0cd7ec3ae7d00855b3fc9c21b1e2e data

077b295229146136b5a4ab2632d43d7fd083759cd7617ba8288bcdd04e56a84b data

07854ba48f3e9858845950010d92a672b49c318f0d27beb52c5268cf51ad9ad7 data

078f02c272d1e0bb8615943c16774cc918b6184615293e0313740f61e8795d19 data

09ba70d34d02fec7d1003b6f4673ddf83b06037d8ff2873a37ae2f1e98173c57 data

0a080ba9a4a4a5eb1847caa3b1622c0dd228c58615d3ab091851acabd3b50354 data

0a18a3a9586a2d01a02abeb8847853a811aefeac5b4a6e78db73c38f083d08c3 data

0a57fa17dba1860101db617ef9baa7c1814b0189fc1678a7972aba493ca5e1c8 data

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

TimeStamp

2011:03:17 20:01:46+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

77824

LinkerVersion

10.0

FileAccessDate

2014:05:04 11:15:04+01:00

EntryPoint

0x12a6b

InitializedDataSize

258048

SubsystemVersion

4.0

ImageVersion

0.0

OSVersion

5.0

FileCreateDate

2014:05:04 11:15:04+01:00

UninitializedDataSize

File identification

MD5 a944c2d4511226f91ae00a76ea64b9c4

SHA1 413f22d857969532a7470e9df7f743de86121e2e

SHA256 329f12d0a5bec827a48c742abd1c87ba1d7be7b1aa16600422b8a1d9cce10c53

ssdeep

6144:kVIk+Pnu74I1/1uOVGdN66D0JPb7t4aLMo:OmP493X6gHttL

imphash 7890ac3ae0c36cfffc48a77463bcccad

File size 258.0 KB ( 264192 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Dynamic Link Library (generic) (43.5%) Win32 Executable (generic) (29.8%) Generic Win/DOS Executable (13.2%) DOS Executable Generic (13.2%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

VirusTotal metadata

First submission 2014-05-04 10:13:21 UTC ( 4 years, 7 months ago )

Last submission 2014-05-04 10:13:21 UTC ( 4 years, 7 months ago )

File names

Zilu
60204b057baa7a44b8d5537f2ccad6b13b93b43f
Ppiokhrevv.exe

Advanced heuristic and reputation engines

Symantec reputation Suspicious.Insight

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

\\.\PIPE\lsarpc (successful)

C:\WINDOWS\ (successful)

\\.\MountPointManager (successful)

C:\329f12d0a5bec827a48c742abd1c87ba1d7be7b1aa16600422b8a1d9cce10c53 (successful)

C:\Documents and Settings\<USER>\Application Data\Elraic\qipe.exe (successful)

C:\Documents and Settings\<USER>\Application Data\Ibalac\ozax.lia (successful)

C:\Documents and Settings\<USER>\Application Data\Hugyx\teep.wul (successful)

C:\Documents and Settings\<USER>\Application Data (successful)

C:\Documents and Settings\<USER>\Application Data\Elraic (failed)

C:\Documents and Settings\<USER>\Application Data\Ibalac (failed)

Read files

C:\329f12d0a5bec827a48c742abd1c87ba1d7be7b1aa16600422b8a1d9cce10c53 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\tmpd410a91f.bat (successful)

C:\Documents and Settings\<USER>\Application Data\Elraic\qipe.exe (successful)

C:\WINDOWS\system32\rsaenh.dll (successful)

C:\Documents and Settings\<USER>\Application Data\Hugyx\teep.wul (successful)

c:\autoexec.bat (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\Address Book\<USER>.wab (successful)

C:\Documents and Settings\<USER>\Application Data\Ibalac\ozax.tmp (successful)

Written files

C:\Documents and Settings\<USER>\Application Data\Elraic\qipe.exe (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\tmpd410a91f.bat (successful)

C:\Documents and Settings\<USER>\Application Data\Ibalac\ozax.lia (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\Address Book\<USER>.wab (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\MPS1.tmp (successful)

C:\Documents and Settings\<USER>\Application Data\Hugyx\teep.wul (successful)

Copied files

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\MPS1.tmp
DST: C:\Documents and Settings\<USER>\Application Data\Microsoft\Address Book\<USER>.wab~ (successful)

Moved files

SRC: C:\Documents and Settings\<USER>\Application Data\Ibalac\ozax.lia
DST: C:\Documents and Settings\<USER>\Application Data\Ibalac\ozax.tmp (successful)

Deleted files

C:\329f12d0a5bec827a48c742abd1c87ba1d7be7b1aa16600422b8a1d9cce10c53 (failed)

C:\329F12~1 (failed)

C:\329f12d0a5bec827a48c742abd1c87ba1d7be7b1aa16600422b8a1d9cce10c53 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\tmpd410a91f.bat (successful)

C:\Documents and Settings\<USER>\Local Settings\Application Data\Identities\{B0BB3B42-3666-47AA-8D85-B94B99DB4C9B}\Microsoft\Outlook Express\Inbox.dbx (successful)

C:\Documents and Settings\<USER>\Local Settings\Application Data\Identities\{B0BB3B42-3666-47AA-8D85-B94B99DB4C9B}\Microsoft\Outlook Express\Sent Items.dbx (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\MPS1.tmp (successful)

C:\Documents and Settings\<USER>\Application Data\Ibalac\ozax.tmp (successful)

Created processes

C:\Documents and Settings\<USER>\Application Data\Elraic\qipe.exe"" (successful)

C:\WINDOWS\system32\cmd.exe" /c "C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\tmpd410a91f.bat"" (successful)

cmd.exe (failed)

Code injections in the following processes

explorer.exe (successful)

wscntfy.exe (successful)

VBoxTray.exe (successful)

python.exe (successful)

cmd.exe (successful)

qipe.exe (successful)

Created mutexes

Global\{9A6BB4EF-6B71-2290-5F3A-4BE31434B082} (successful)

Local\{207291A4-4E3A-9889-5F3A-4BE31434B082} (successful)

Global\{7507F340-2CDE-CDFC-D5A0-9A729EAE6113} (successful)

Global\{7507F340-2CDE-CDFC-A1A1-9A72EAAF6113} (successful)

Global\{7507F340-2CDE-CDFC-99A2-9A72D2AC6113} (successful)

Global\{7507F340-2CDE-CDFC-B1A2-9A72FAAC6113} (successful)

Global\{7507F340-2CDE-CDFC-5DA2-9A7216AC6113} (successful)

Global\{7507F340-2CDE-CDFC-49A2-9A7202AC6113} (successful)

Global\{7507F340-2CDE-CDFC-E5A3-9A72AEAD6113} (successful)

Global\{7507F340-2CDE-CDFC-B1A3-9A72FAAD6113} (successful)

Opened mutexes

Local\{0BD4F495-2B0B-B32F-5F3A-4BE31434B082} (failed)

ShimCacheMutex (successful)

RasPbFile (successful)

Searched windows

CLASS: Shell_TrayWnd
NAME: (null)

CLASS: MS_AutodialMonitor
NAME: (null)

CLASS: MS_WebcheckMonitor
NAME: (null)

Opened service managers

MACHINE: localhost
DATABASE: SERVICES_ACTIVE_DATABASE (successful)

Opened services

ProtectedStorage (successful)

RASMAN (successful)

Runtime DLLs

advapi32.dll (successful)

version.dll (successful)

rsaenh.dll (successful)

urlmon.dll (successful)

c:\windows\system32\mswsock.dll (successful)

hnetcfg.dll (successful)

c:\windows\system32\wshtcpip.dll (successful)

ws2_32.dll (successful)

shell32.dll (successful)

userenv.dll (successful)

Additional details

The file sends control codes directly to certain device drivers making use of the DeviceIoControl Windows API function.

HTTP requests

URL: http://lurik777.net/1/tt/file.php
TYPE: POST
USER AGENT: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

URL: http://www.google.com/webhp
TYPE: GET
USER AGENT: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

URL: http://www.google.fr/webhp?gfe_rd=cr&ei=9hNmU8nUN-fX8gf-3oBA
TYPE: GET
USER AGENT: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

URL: http://lurik777.net/1/tt/gate.php
TYPE: POST
USER AGENT: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

DNS requests

lurik777.net (195.160.220.153)

www.google.com (173.194.41.113)

www.google.fr (173.194.41.119)

TCP connections

195.160.220.153:80

173.194.41.116:80

173.194.41.120:80

UDP communications

64.4.10.33:123

<MACHINE_DNS_SERVER>:53

SHA256:	329f12d0a5bec827a48c742abd1c87ba1d7be7b1aa16600422b8a1d9cce10c53
File name:	60204b057baa7a44b8d5537f2ccad6b13b93b43f
Detection ratio:	15 / 52
Analysis date:	2014-05-04 10:13:21 UTC ( 4 years, 7 months ago )

Ciphered bundle

FileVersionInfo properties

PE header basic information

PE sections

PE imports

Number of PE resources by type

Number of PE resources by language

PE resources

ExifTool file metadata

File identification

VirusTotal metadata

Advanced heuristic and reputation engines

Leave your comment...

Opened files

Read files

Written files

Copied files

Moved files

Deleted files

Created processes

Code injections in the following processes

Created mutexes

Opened mutexes

Searched windows

Opened service managers

Opened services

Runtime DLLs

Additional details

HTTP requests

DNS requests

TCP connections

UDP communications

Recover your password

Join VirusTotal Community

Sign in