Antivirus scan for 97e5cd34203297b9c455db0a17d2715d18b30506a65a7d3f571947e190bdccf1 at 2015-04-26 21:52:26 UTC

Antivirus	Result	Update
Ad-Aware	Gen:Variant.Kazy.602232	20150426
ALYac	Gen:Variant.Kazy.602232	20150426
AVG	Generic6.AKOZ	20150426
AVware	Win32.Malware!Drop	20150426
BitDefender	Gen:Variant.Kazy.602232	20150426
DrWeb	Trojan.Fakealert.48543	20150426
Emsisoft	Gen:Variant.Kazy.602232 (B)	20150426
ESET-NOD32	Win32/Adware.FakeAV.T	20150426
F-Secure	Gen:Variant.Kazy.602232	20150426
GData	Gen:Variant.Kazy.602232	20150426
Malwarebytes	Trojan.Agent.ED	20150426
Microsoft	Rogue:Win32/Trapwot	20150426
eScan	Gen:Variant.Kazy.602232	20150426
Tencent	Trojan.Win32.Qudamah.Gen.0	20150426
VIPRE	Win32.Malware!Drop	20150426
AegisLab		20150426
Yandex		20150426
AhnLab-V3		20150426
Alibaba		20150426
Antiy-AVL		20150426
Avast		20150426
Avira (no cloud)		20150427
Baidu-International		20150426
Bkav		20150425
ByteHero		20150426
CAT-QuickHeal		20150425
ClamAV		20150426
CMC		20150423
Comodo		20150426
Cyren		20150426
F-Prot		20150426
Fortinet		20150426
Ikarus		20150426
Jiangmin		20150426
K7AntiVirus		20150426
K7GW		20150426
Kaspersky		20150426
Kingsoft		20150427
McAfee		20150426
McAfee-GW-Edition		20150426
NANO-Antivirus		20150426
Norman		20150426
nProtect		20150424
Panda		20150424
Qihoo-360		20150427
Rising		20150426
Sophos AV		20150427
SUPERAntiSpyware		20150425
Symantec		20150426
TheHacker		20150426
TotalDefense		20150426
TrendMicro		20150426
TrendMicro-HouseCall		20150426
VBA32		20150426
ViRobot		20150426
Zillya		20150426
Zoner		20150424

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2013-01-24 11:54:51

Entry Point 0x000036C8

Number of sections 4

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 23325 24576 4.69 80df36ca91bf90e23220b11293c96b35

.rdata 28672 2515 4096 3.56 d80fd312938870dde4493c3e5f2bcee8

.data 32768 4096 4096 3.34 fe0bfd3035ca2ae968261904ce5811bf

.rsrc 36864 33886 36864 6.31 56b4d0e1e0725f712d5eea14b0e88ca7

PE imports

Number of PE resources by type

RT_MESSAGETABLE 2

RT_ICON 1

RT_GROUP_ICON 1

Number of PE resources by language

ENGLISH US 4

PE resources

28cd5c41e21e9230a814626204000846cbab1445cf224e6e319360cd524cf08a data

3b628fecece8197f561fb51e00f8fb1ad33c4e4bc3ff7b0a5d8ba1eb9ed8cb49 ASCII text

9e310e6eb088609d1ab74a0eb57038b526ca7736f30a66631d31e63ed8acb006 data

a185012574b465b2ffe29f14de54d978f9741811e545a7150dd3dd7f18534e38 data

Debug information

Type Timestamp Offset Size

IMAGE_DEBUG_TYPE_UNKNOWN (0) Thu Jan 01 00:00:00 1970 29056 33 Bytes

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

FileTypeExtension

exe

TimeStamp

2013:01:24 12:54:51+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

24576

LinkerVersion

6.0

EntryPoint

0x36c8

InitializedDataSize

45056

SubsystemVersion

4.0

ImageVersion

0.0

OSVersion

4.0

UninitializedDataSize

File identification

MD5 1d9ab563bc26a626fc7d43e98eb6461f

SHA1 ad2d513e37ba7941f4b16cf97ceb19dde693be29

SHA256 97e5cd34203297b9c455db0a17d2715d18b30506a65a7d3f571947e190bdccf1

ssdeep

1536:klRXnhiHmi7RItwM6RwN3VP6xPFqRC/Yc4q9m:klRXnhiHmi7RItwM6RwVV+FkYYc/

authentihash e2e65386ceccc8bf5bffdb28831ff06a880b06c22ad5273afb7cb520b27e5383

imphash 1dcf0189da3f2b37898529598e5d14d1

File size 72.0 KB ( 73728 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Windows screen saver (46.4%) Win32 Dynamic Link Library (generic) (23.3%) Win32 Executable (generic) (15.9%) Generic Win/DOS Executable (7.1%) DOS Executable Generic (7.0%)

VirusTotal metadata

First submission 2015-04-26 21:49:47 UTC ( 3 years ago )

Last submission 2015-04-26 21:52:26 UTC ( 3 years ago )

File names

2015-04-25-Nuclear-EK-Payload.exe
97e5cd34203297b9c455db0a17d2715d18b30506a65a7d3f571947e190bdccf1.bin

Advanced heuristic and reputation engines

TrendMicro-HouseCall

TrendMicro's heuristic engine has flagged this file as: TROJ_GEN.R047C0CE315.

Symantec reputation Suspicious.Insight

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\97e5cd34203297b9c455db0a17d2715d18b30506a65a7d3f571947e190bdccf1 (successful)

C:\Documents and Settings\<USER>\Local Settings\Application Data\xneadmaxga.png (successful)

\\.\PIPE\lsarpc (successful)

c:\autoexec.bat (successful)

C:\Documents and Settings\<USER>\Local Settings\Application Data\mponarzqbh.dat (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\WINDOWS\system32\srvdev\x06 (failed)

C:\WINDOWS\system32\srvdev5 (failed)

C:\WINDOWS\system32\xpsp3res.dll (successful)

C:\WINDOWS\WindowsShell.manifest (successful)

Read files

C:\97e5cd34203297b9c455db0a17d2715d18b30506a65a7d3f571947e190bdccf1 (successful)

c:\autoexec.bat (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

Written files

C:\Documents and Settings\<USER>\Local Settings\Application Data\xneadmaxga.png (successful)

C:\Documents and Settings\<USER>\Local Settings\Application Data\mponarzqbh.dat (successful)

Copied files

SRC: C:\97e5cd34203297b9c455db0a17d2715d18b30506a65a7d3f571947e190bdccf1
DST: C:\Documents and Settings\<USER>\My Documents\audiosrvv2.exe (successful)

Deleted files

C:\Documents and Settings\<USER>\My Documents\audiosrvv2.exe:Zone.Identifier (failed)

Created processes

C:\97e5cd34203297b9c455db0a17d2715d18b30506a65a7d3f571947e190bdccf1 (successful)

Code injections in the following processes

97e5cd34203297b9c455db0a17d2715d18b30506a65a7d3f571947e190bdccf1 (successful)

Created mutexes

{AE40071B-7170-46EF-BE83-8B85DF8A69C3} (successful)

RasPbFile (failed)

CTF.LBES.MutexDefaultS-1-5-21-1275210071-920026266-1060284298-1003 (successful)

CTF.Compart.MutexDefaultS-1-5-21-1275210071-920026266-1060284298-1003 (successful)

CTF.Asm.MutexDefaultS-1-5-21-1275210071-920026266-1060284298-1003 (successful)

CTF.Layouts.MutexDefaultS-1-5-21-1275210071-920026266-1060284298-1003 (successful)

CTF.TMD.MutexDefaultS-1-5-21-1275210071-920026266-1060284298-1003 (successful)

_!SHMSFTHISTORY!_ (successful)

MSIMGSIZECacheMutex (successful)

Opened mutexes

RasPbFile (successful)

ShimCacheMutex (successful)

_!SHMSFTHISTORY!_ (failed)

Searched windows

CLASS: MS_AutodialMonitor
NAME: (null)

CLASS: MS_WebcheckMonitor
NAME: (null)

Opened service managers

MACHINE: localhost
DATABASE: SERVICES_ACTIVE_DATABASE (successful)

Opened services

RASMAN (successful)

Hooking activity

TYPE: WH_MOUSE
METHOD: SetWindowsHook (successful)

TYPE: WH_KEYBOARD
METHOD: SetWindowsHook (successful)

Runtime DLLs

kernel32.dll (successful)

-lang.dll (failed)

comctl32.dll (successful)

mlang.dll (successful)

shell32.dll (successful)

ole32.dll (successful)

secur32.dll (successful)

wsock32 (successful)

ws2_32 (successful)

rasapi32.dll (successful)

Additional details

The file sends control codes directly to certain device drivers making use of the DeviceIoControl Windows API function.

The file installs an application-defined hook procedure into a hook chain. You would install a hook procedure to monitor the system for certain types of events. These events are associated either with a specific thread or with all threads in the same desktop as the calling thread. This is done making use of the SetWindowsHook Windows API function.

HTTP requests

URL: http://proupdatesinfo.eu/a/offers?i=0&u=fabbc6a1c5734ea09ca150004b35a440&f=1&v=21&a=42
TYPE: POST
USER AGENT: None

DNS requests

proupdatesinfo.eu (91.213.233.74)

TCP connections

91.213.233.74:80

UDP communications

23.102.23.44:123

SHA256:	97e5cd34203297b9c455db0a17d2715d18b30506a65a7d3f571947e190bdccf1
File name:	2015-04-25-Nuclear-EK-Payload.exe
Detection ratio:	15 / 57
Analysis date:	2015-04-26 21:52:26 UTC ( 3 years ago ) View latest

Ciphered bundle

PE header basic information

PE sections

PE imports

Number of PE resources by type

Number of PE resources by language

PE resources

Debug information

ExifTool file metadata

File identification

VirusTotal metadata

Advanced heuristic and reputation engines

Leave your comment...

Opened files

Read files

Written files

Copied files

Deleted files

Created processes

Code injections in the following processes

Created mutexes

Opened mutexes

Searched windows

Opened service managers

Opened services

Hooking activity

Runtime DLLs

Additional details

HTTP requests

DNS requests

TCP connections

UDP communications

Recover your password

Join VirusTotal Community

Sign in