Antivirus scan for ea46dcb1aea0a1463a3fd54baa324c28e448235848c061b373ce453f934d40cb at 2016-03-18 10:09:54 UTC

Antivirus	Result	Update
AegisLab	Troj.W32.Gen	20160318
Avast	Win32:Malware-gen	20160318
Baidu	Win32.Trojan.WisdomEyes.151026.9950.9999	20160317
Kaspersky	UDS:DangerousObject.Multi.Generic	20160317
McAfee	Trojan-FIBI!74AFA7F3D846	20160318
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.ch	20160318
Qihoo-360	HEUR/QVM20.1.Malware.Gen	20160318
Rising	PE:Malware.Generic(Thunder)!1.A1C4 [F]	20160318
Ad-Aware		20160318
Yandex		20160316
AhnLab-V3		20160317
Alibaba		20160318
ALYac		20160318
Antiy-AVL		20160318
Arcabit		20160318
AVG		20160318
AVware		20160318
Baidu-International		20160317
BitDefender		20160318
Bkav		20160317
ByteHero		20160318
CAT-QuickHeal		20160318
ClamAV		20160317
CMC		20160316
Comodo		20160318
Cyren		20160318
DrWeb		20160318
Emsisoft		20160318
ESET-NOD32		20160318
F-Prot		20160318
F-Secure		20160318
Fortinet		20160318
GData		20160318
Ikarus		20160318
Jiangmin		20160318
K7AntiVirus		20160318
K7GW		20160318
Malwarebytes		20160318
Microsoft		20160318
eScan		20160318
NANO-Antivirus		20160318
nProtect		20160317
Panda		20160317
Sophos AV		20160318
SUPERAntiSpyware		20160318
Symantec		20160318
Tencent		20160318
TheHacker		20160315
TrendMicro		20160318
TrendMicro-HouseCall		20160318
VBA32		20160317
VIPRE		20160318
ViRobot		20160318
Zillya		20160317
Zoner		20160318

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

Product ???????????? ??????? Microsoft® Windows®

Original name emt7ren.dll

Internal name emt7ren.dll

File version 5.1.2625.5512 (xpsp.080413-0852)

Description Media

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2016-03-18 09:22:52

Entry Point 0x0000105F

Number of sections 8

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 49673 50176 5.02 8e4100ba11addee4b18edf5918eaaad2

.rdata 57344 633 1024 2.03 c67e9a9318e8f3ec068b8be252ad2b6a

.data 61440 20767 5632 1.02 a781fbf53addb8de927f964d669732bb

.idata 86016 647 1024 1.26 c0f1cf25664bb33454cc3e6bf1e6966f

CODE 90112 39176 39424 6.86 9a51a124d78af50da8985c313f9430fc

UNdG 131072 38072 38400 6.94 9458bb11fb9591137e9c38f7af65bff6

yomm2TRS 172032 14732 14848 7.03 672bda901951eff541dddd824f5ef4e5

.rsrc 188416 28920 29184 4.70 410b8e34cec7bfa6557bf228696870a0

PE imports

[+] KERNEL32.dll

[+] ntdll.dll

Number of PE resources by type

TYPELIB 1

RT_STRING 1

REGISTRY 1

RT_VERSION 1

Number of PE resources by language

RUSSIAN 4

PE resources

29dd45287384ad8528b2a892810df3a68732d7b31cdc46146cfd2bc031bf5adc data

32edbd05c3dc4995a6110d93e15542730568edd69feb2dc75fa2e81124e69264 ASCII text

edca5ca06c789a29638a4f84399ce6d96df2eb0d22d752e6398d9ddd224f1959 ASCII text

fb179a3d6c3d9bcd7031385a48e9dae46c0003c5d3be6524e150a4093f5c37a5 data

ExifTool file metadata

SubsystemVersion

5.0

LinkerVersion

8.0

ImageVersion

0.0

FileSubtype

FileVersionNumber

5.1.2605.5512

UninitializedDataSize

LanguageCode

Russian

FileFlagsMask

0x003f

CharacterSet

Unicode

InitializedDataSize

EntryPoint

0x105f

OriginalFileName

emt7ren.dll

MIMEType

application/octet-stream

LegalCopyright

. .

FileVersion

5.1.2625.5512 (xpsp.080413-0852)

TimeStamp

2016:03:18 10:22:52+01:00

FileType

Win32 EXE

PEType

PE32

InternalName

emt7ren.dll

ProductVersion

5.1.2625.5512

FileDescription

Media

OSVersion

4.1

FileOS

Windows NT 32-bit

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

CodeSize

50176

ProductName

Microsoft Windows

ProductVersionNumber

5.1.2605.5512

FileTypeExtension

exe

ObjectFileType

Dynamic link library

PCAP parents

This file was seen in the network flow recorded by the following PCAP files.

839832b917a10acb7589a0675c1c8601e3233309a5ef61bf16fcd1969ce14f67

File identification

MD5 74afa7f3d84647672f0f4b4eec01676e

SHA1 26319909aa2cee4ef748e1d2a0bb8b3ac4312388

SHA256 ea46dcb1aea0a1463a3fd54baa324c28e448235848c061b373ce453f934d40cb

ssdeep

3072:N5mqKIsB0keAoYPOHEfVJEfGpSuusCeeTERpykCbZxb:HmqB7k58wFpSXM2ERpykgZx

authentihash c7ec9c933b415635bb78d3c13e7e768979bcbb36c5b2a349029013847b7dc376

imphash ba466650915b9571c4c951bb260fa94d

File size 176.5 KB ( 180736 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Dynamic Link Library (generic) (43.5%) Win32 Executable (generic) (29.8%) Generic Win/DOS Executable (13.2%) DOS Executable Generic (13.2%)

VirusTotal metadata

First submission 2016-03-18 09:14:50 UTC ( 2 years, 7 months ago )

Last submission 2016-12-15 18:38:03 UTC ( 1 year, 11 months ago )

File names

emt7ren.dll
r34t4g33.exe

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\WINDOWS\system32\rsaenh.dll (successful)

C:\WINDOWS\system32\userenv.dll (successful)

\\.\PIPE\lsarpc (successful)

c:\autoexec.bat (successful)

C:\WINDOWS\system32\dssenh.dll (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

Read files

C:\WINDOWS\system32\rsaenh.dll (successful)

c:\autoexec.bat (successful)

C:\WINDOWS\system32\dssenh.dll (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar4.tmp (successful)

Written files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar4.tmp (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab5.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar6.tmp (successful)

Deleted files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar4.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab5.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar6.tmp (successful)

Created processes

C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe fldrclnr.dll,Wizard_RunDLL (successful)

Code injections in the following processes

explorer.exe (successful)

rundll32.exe (successful)

Terminated processes

ea46dcb1aea0a1463a3fd54baa324c28e448235848c061b373ce453f934d40cb (successful)

Created mutexes

RasPbFile (failed)

{1f10459d-b538-9f88-02f7-00a15d8586f7} (failed)

Global\1f10459db5389f8802f700a15d8586f7 (failed)

{16bf7907-fb70-49fb-d608-4bad10641966} (failed)

Global\16bf7907fb7049fbd6084bad10641966 (failed)

DesktopCleanupMutex (successful)

_SHuassist.mtx (successful)

Opened mutexes

RasPbFile (successful)

{1f10459d-b538-9f88-02f7-00a15d8586f7} (failed)

Global\1f10459db5389f8802f700a15d8586f7 (failed)

{16bf7907-fb70-49fb-d608-4bad10641966} (failed)

Global\16bf7907fb7049fbd6084bad10641966 (failed)

ShimCacheMutex (successful)

Searched windows

CLASS: Shell_TrayWnd
NAME: (null)

CLASS: SystemTray_Main
NAME: (null)

CLASS: CSCHiddenWindow
NAME: (null)

Opened service managers

MACHINE: localhost
DATABASE: SERVICES_ACTIVE_DATABASE (successful)

Opened services

RASMAN (successful)

CryptSvc (successful)

Runtime DLLs

shell32.dll (successful)

user32.dll (successful)

ntdll.dll (successful)

advapi32.dll (successful)

shlwapi.dll (successful)

wininet.dll (successful)

secur32.dll (successful)

wsock32 (successful)

ws2_32 (successful)

rsaenh.dll (successful)

HTTP requests

URL: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
TYPE: GET
USER AGENT: Microsoft-CryptoAPI/5.131.2600.5512

URL: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
TYPE: GET
USER AGENT: Microsoft-CryptoAPI/5.131.2600.5512

DNS requests

www.download.windowsupdate.com (8.253.82.30)

TCP connections

64.147.192.68:4043

8.254.218.126:80

UDP communications

<MACHINE_DNS_SERVER>:53

SHA256:	ea46dcb1aea0a1463a3fd54baa324c28e448235848c061b373ce453f934d40cb
File name:	r34t4g33.exe
Detection ratio:	8 / 55
Analysis date:	2016-03-18 10:09:54 UTC ( 2 years, 7 months ago ) View latest

Ciphered bundle

FileVersionInfo properties

PE header basic information

PE sections

PE imports

Number of PE resources by type

Number of PE resources by language

PE resources

ExifTool file metadata

PCAP parents

File identification

VirusTotal metadata

Leave your comment...

Opened files

Read files

Written files

Deleted files

Created processes

Code injections in the following processes

Terminated processes

Created mutexes

Opened mutexes

Searched windows

Opened service managers

Opened services

Runtime DLLs

HTTP requests

DNS requests

TCP connections

UDP communications

Recover your password

Join VirusTotal Community

Sign in