Antivirus scan for 95d22c9d3cdbb61618af861a869d3ba8209877c4db1e0e0fef70a20884556d45 at 2015-11-04 15:18:52 UTC

Antivirus	Result	Update
Avira (no cloud)	TR/AD.DridexDownloader.Y.42	20151104
ESET-NOD32	Win32/Dridex.P	20151104
Kaspersky	Trojan-Downloader.Win32.Agent.hghj	20151104
TrendMicro	TSPY_DRIDEX.SOU	20151104
TrendMicro-HouseCall	TSPY_DRIDEX.SOU	20151104
Ad-Aware		20151104
AegisLab		20151104
Yandex		20151104
AhnLab-V3		20151104
Alibaba		20151104
ALYac		20151104
Antiy-AVL		20151104
Arcabit		20151104
Avast		20151104
AVG		20151104
AVware		20151104
Baidu-International		20151104
BitDefender		20151104
Bkav		20151104
ByteHero		20151104
CAT-QuickHeal		20151103
ClamAV		20151103
CMC		20151102
Comodo		20151104
Cyren		20151104
DrWeb		20151104
Emsisoft		20151104
F-Prot		20151104
F-Secure		20151104
Fortinet		20151104
GData		20151104
Ikarus		20151104
Jiangmin		20151104
K7AntiVirus		20151104
K7GW		20151104
Malwarebytes		20151104
McAfee		20151104
McAfee-GW-Edition		20151104
Microsoft		20151104
eScan		20151104
NANO-Antivirus		20151104
nProtect		20151104
Panda		20151104
Rising		20151103
Sophos AV		20151104
SUPERAntiSpyware		20151104
Symantec		20151103
Tencent		20151104
TheHacker		20151103
VBA32		20151104
VIPRE		20151104
ViRobot		20151104
Zillya		20151104
Zoner		20151104

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows command line subsystem.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2008-03-19 10:34:40

Entry Point 0x00046438

Number of sections 4

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 284132 286720 6.12 8ed22e5cfc7f05e1a02f54530630d4d0

.rdata 290816 3950 4096 5.31 8ec6be4a52552793dc9fe863aa40c370

.data 294912 131968 20480 4.12 c8794331e64b096faf45f65adeadb40f

.rsrc 430080 37944 40960 4.21 6ce3da43b75e3fb66679212112681efb

PE imports

Number of PE resources by type

RT_ICON 3

RT_ACCELERATOR 3

RT_GROUP_ICON 3

pB030I0T8e 1

RT_BITMAP 1

RT_VERSION 1

Number of PE resources by language

BASQUE DEFAULT 6

ENGLISH AUS 6

PE resources

0acc93896c4af2d0794e9414af9bb65b948a9e0dd892df4fe3922117188fd7f1 data

2ca9385f66e4ce8301ae3806cbb38bfdedea94f3611d14eec7fb40c99b1824ce data

30e4347b4bf139f7982e5e633f34efba38dc912159112e942c9c16c9bd1a4496 data

3a66c4a5d81faf0a727627d58c3f4e84d81d560e51581220d2f9c6185645bdee data

3d01c2162b89b7f9fae50ca047a6418e15d9176297739ca208a417c4e4417c35 data

43e26c811e0e09ba007bab87910a221aea3535e27b33832e2c923763e89e88b1 data

4b747b1c3418c3ab72d0a4a87670621a75e5aa8ff7913ac894482f06c9061292 data

833b914b90f9ffa630ead0e1a336208214b52457736f66cf8516a498093016b0 data

c1513a9f66d071ab0ab6ff4c882d46707eafe0c552c260f90f163183f6fa7ad8 data

d1b2d766c2edbbe1ed3a80ce16f4be041c98e205e13098b53872fb077d200485 data

ExifTool file metadata

SubsystemVersion

4.0

LinkerVersion

8.0

ImageVersion

0.0

FileVersionNumber

0.132.160.72

UninitializedDataSize

LanguageCode

Neutral

FileFlagsMask

0x003f

CharacterSet

Unicode

InitializedDataSize

180224

EntryPoint

0x46438

OriginalFileName

Contraction.exe

MIMEType

application/octet-stream

LegalCopyright

FileVersion

3, 224, 126, 5

TimeStamp

2008:03:19 11:34:40+01:00

FileType

Win32 EXE

PEType

PE32

InternalName

Cruises

FileDescription

Determines

OSVersion

4.0

FileOS

Windows NT 32-bit

Subsystem

Windows command line

MachineType

Intel 386 or later, and compatibles

CompanyName

CompuServe Interactive Services, Inc.

CodeSize

286720

FileSubtype

ProductVersionNumber

0.63.253.109

FileTypeExtension

exe

ObjectFileType

Executable application

File identification

MD5 497a261a91be31fce655c8df2ccaf7ee

SHA1 0962aa0294c91826a02d39011b870add94c232bd

SHA256 95d22c9d3cdbb61618af861a869d3ba8209877c4db1e0e0fef70a20884556d45

ssdeep

6144:RDgiJbMt8bFoc6XVdQNmq8amC2VXkyQq0wDAlBmJIpFBg28zE+QsL:JlbQ8qc6MNmuu5OE4BmaoB

authentihash 8ce17c7eaf6db3510d88f17f05ca64d98346a79615222a3d76dcd001f398827f

imphash 1d57fda61113c0c7b7caa9a1070a37a7

File size 348.0 KB ( 356352 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (console) Intel 80386 32-bit

TrID	Win32 Executable MS Visual C++ (generic) (42.2%) Win64 Executable (generic) (37.3%) Win32 Dynamic Link Library (generic) (8.8%) Win32 Executable (generic) (6.0%) Generic Win/DOS Executable (2.7%)

VirusTotal metadata

First submission 2015-11-04 07:33:29 UTC ( 2 years, 5 months ago )

Last submission 2015-11-05 19:16:40 UTC ( 2 years, 5 months ago )

File names

117.239.73.244_8880_ClientAccess_owaauth.php
owaauth.php
mal.exe
berlinetta.exe

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\WINDOWS\system32\rsaenh.dll (successful)

C:\WINDOWS\system32\userenv.dll (successful)

\\.\PIPE\lsarpc (successful)

c:\autoexec.bat (successful)

C:\WINDOWS\system32\dssenh.dll (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

Read files

C:\WINDOWS\system32\rsaenh.dll (successful)

c:\autoexec.bat (successful)

C:\WINDOWS\system32\dssenh.dll (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar4.tmp (successful)

Written files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar4.tmp (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab5.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar6.tmp (successful)

Deleted files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar4.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab5.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar6.tmp (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1275210071-920026266-1060284298-1003\8c8436195f6e0875edb85e34665c32ec_fabbc6a1-c573-4ea0-9ca1-50004b35a440 (failed)

C:\Documents and Settings\<USER>\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1275210071-920026266-1060284298-1003\8c8436195f6e0875edb85e34665c32ec_fabbc6a1-c573-4ea0-9ca1-50004b35a440 (successful)

C:\95d22c9d3cdbb61618af861a869d3ba8209877c4db1e0e0fef70a20884556d45 (successful)

Code injections in the following processes

explorer.exe (successful)

python.exe (successful)

Created mutexes

RasPbFile (failed)

Global\1f10459db5389f8802f700a15d8586f7 (successful)

Global\b55b03790ca5051551b1e6f8add6e540 (successful)

Global\6e47ffd3fe1c6f1d51c066bfc16264c9 (successful)

Global\4098509693640518d94a78f350fe9111 (successful)

Global\ffc0b2e50bdd4bdbf804a517bb62a8b4 (successful)

Global\99daee270656b977863d28a53559b2bb (successful)

Global\998e80094d6403d020fdcbaaec77f6fd (successful)

Global\14e1dd347f791ae9eec77ddc718bf46d (successful)

Global\4c68036784d8c3eb5079cc812854f4d3 (successful)

Opened mutexes

RasPbFile (successful)

Opened service managers

MACHINE: localhost
DATABASE: SERVICES_ACTIVE_DATABASE (successful)

Opened services

RASMAN (successful)

CryptSvc (successful)

TermService (successful)

Runtime DLLs

secur32.dll (successful)

rpcrt4.dll (successful)

shell32.dll (successful)

ntdll.dll (successful)

user32.dll (successful)

advapi32.dll (successful)

shlwapi.dll (successful)

wininet.dll (successful)

wsock32 (successful)

ws2_32 (successful)

HTTP requests

URL: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
TYPE: GET
USER AGENT: Microsoft-CryptoAPI/5.131.2600.5512

URL: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
TYPE: GET
USER AGENT: Microsoft-CryptoAPI/5.131.2600.5512

DNS requests

www.download.windowsupdate.com (88.221.14.130)

TCP connections

5.187.4.183:473

88.221.14.163:80

SHA256:	95d22c9d3cdbb61618af861a869d3ba8209877c4db1e0e0fef70a20884556d45
File name:	berlinetta.exe
Detection ratio:	5 / 54
Analysis date:	2015-11-04 15:18:52 UTC ( 2 years, 5 months ago ) View latest

Ciphered bundle

PE header basic information

PE sections

PE imports

Number of PE resources by type

Number of PE resources by language

PE resources

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Opened files

Read files

Written files

Deleted files

Code injections in the following processes

Created mutexes

Opened mutexes

Opened service managers

Opened services

Runtime DLLs

HTTP requests

DNS requests

TCP connections

Recover your password

Join VirusTotal Community

Sign in