Antivirus scan for f2dacd9ac118102a03cca67cff29a8e978b32222671b6143727cec4b98f9188f at 2014-07-16 09:51:08 UTC

Antivirus	Result	Update
AVG		20140716
Ad-Aware		20140716
AegisLab		20140716
Agnitum		20140715
AhnLab-V3		20140715
AntiVir		20140716
Avast		20140716
Baidu-International		20140716
BitDefender		20140716
Bkav		20140715
ByteHero		20140716
CAT-QuickHeal		20140716
CMC		20140714
ClamAV		20140716
Commtouch		20140716
Comodo		20140716
DrWeb		20140716
Emsisoft		20140716
F-Prot		20140716
F-Secure		20140716
Fortinet		20140716
GData		20140716
Ikarus		20140716
Jiangmin		20140716
K7AntiVirus		20140715
K7GW		20140716
Kaspersky		20140716
Kingsoft		20140716
McAfee		20140716
McAfee-GW-Edition		20140715
MicroWorld-eScan		20140716
Microsoft		20140716
NANO-Antivirus		20140716
Norman		20140716
Panda		20140716
Qihoo-360		20140716
Rising		20140715
SUPERAntiSpyware		20140716
Sophos		20140716
Symantec		20140716
Tencent		20140716
TheHacker		20140714
TotalDefense		20140716
TrendMicro		20140716
TrendMicro-HouseCall		20140716
VBA32		20140715
VIPRE		20140716
ViRobot		20140716
Zillya		20140715
Zoner		20140714
nProtect		20140715

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

Authenticode signature block

Publisher BitTorrent Inc

Product µTorrent

Original name uTorrent.exe

Internal name uTorrent.exe

File version 3.4.2.32354

Description µTorrent

Signature verification Signed file, verified signature

Signing date 9:04 PM 7/11/2014

Signers

[+] BitTorrent Inc

[+] VeriSign Class 3 Code Signing 2010 CA

[+] VeriSign

Counter signers

[+] Symantec Time Stamping Services Signer - G4

[+] Symantec Time Stamping Services CA - G2

[+] Thawte Timestamping CA

Packers identified

F-PROT UPX_LZMA, embedded

PEiD UPX 2.93 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2014-07-11 19:34:18

Entry Point 0x0035A4E0

Number of sections 5

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

UPX0 4096 2318336 0 0.00 d41d8cd98f00b204e9800998ecf8427e

UPX1 2322432 1200128 1196544 8.00 1c02d876a2289c9a33065d42fa04f5c4

.rsrc 3522560 126976 123904 7.05 d522c110ec140bad17c2253d5e3444d9

.opcandy 3649536 303104 300032 7.96 7a9bf84ae6f5793548177fb6998ce922

.adknow 3952640 229376 227328 7.80 c650c3612705dfabab086af6eb39e5c7

PE imports

Number of PE resources by type

RT_DIALOG 119

RT_ICON 63

RT_GROUP_ICON 50

PNG 25

JS 5

RT_BITMAP 3

RT_HTML 2

CSS 2

RT_MANIFEST 1

GIF 1

RT_MENU 1

RT_RCDATA 1

RT_VERSION 1

Number of PE resources by language

SWEDISH 187

ENGLISH US 87

ExifTool file metadata

SpecialBuild

stable34 stable

FileDescription

Torrent

InitializedDataSize

126976

ImageVersion

0.0

ProductName

Torrent

FileVersionNumber

3.4.2.32354

LanguageCode

English (U.S.)

FileFlagsMask

0x002b

CharacterSet

Windows, Latin1

LinkerVersion

11.0

OriginalFilename

uTorrent.exe

MIMEType

application/octet-stream

Subsystem

Windows GUI

FileVersion

3.4.2.32354

TimeStamp

2014:07:11 20:34:18+01:00

FileType

Win32 EXE

PEType

PE32

InternalName

uTorrent.exe

SubsystemVersion

5.1

FileAccessDate

2014:08:03 15:32:22+01:00

ProductVersion

3.4.2.32354

UninitializedDataSize

2318336

OSVersion

5.1

FileCreateDate

2014:08:03 15:32:22+01:00

FileOS

Unknown (0)

LegalCopyright

MachineType

Intel 386 or later, and compatibles

CompanyName

BitTorrent Inc.

CodeSize

1200128

FileSubtype

ProductVersionNumber

3.4.2.32354

EntryPoint

0x35a4e0

ObjectFileType

Unknown

Execution parents

This file was created during the sandboxed execution of the following files.

d4278455191682675cfdbe30cd9e836f6e67a64b5e7080969e070a73591163e5

15877e8aa6452f84907c72e3f500bf7eff69192a643b683c1e9d4c848edd2456

File identification

MD5 b36a6795442d6e453d9b7847c035d71d

SHA1 c71633102e745966e9aa5719679ba58ba974e8f7

SHA256 f2dacd9ac118102a03cca67cff29a8e978b32222671b6143727cec4b98f9188f

ssdeep

49152:VjqmocJ9XCKshrsfdneYk/OI9SG7L7SAv3/ZTCSu:97pJxshr8KCGeZ

authentihash b063dea6b1917a60d9e45cf2f19d865239bc69e01586cf0124d5737ee3623992

imphash 2a411f23a213779d14f60be91cd38803

File size 1.8 MB ( 1859152 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	UPX compressed Win32 Executable (46.5%) Win32 EXE Yoda's Crypter (40.4%) Win32 Executable (generic) (6.8%) Generic Win/DOS Executable (3.0%) DOS Executable Generic (3.0%)

VirusTotal metadata

First submission 2014-07-15 17:44:36 UTC ( 3 months, 2 weeks ago )

Last submission 2014-07-27 14:33:15 UTC ( 3 months ago )

File names

uTorrent 3.4.2.32354.exe
uTorrent_v3.4.2_Build_32354.exe
uTorrent (18).exe
uTorrent.exe
uTorrent (1).exe
uTorrent_3.4.2.32354.exe
utorrent.exe
uTorrent(1).exe
file-7270335_exe
uTorrent 3.4.2 (build 32354) Stable.exe
uTorrent.exe
uTorrent.exe
uTorrent.exe
uTorrent.exe
uTorrent.exe

Advanced heuristic and reputation engines

ClamAV PUA

Possibly Unwanted Application. While not necessarily malicious, the scanned file presents certain characteristics which depending on the user policies and environment may or may not represent a threat. For full details see: http://www.clamav.net/doc/pua.html .

Behaviour characterization

Zemana

dll-injection

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

\\?\C:\Documents and Settings\<USER>\Application Data\uTorrent\webui.zip (failed)

\\?\C:\f2dacd9ac118102a03cca67cff29a8e978b32222671b6143727cec4b98f9188f (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt1.tmp (successful)

\\?\C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt1.tmp.new (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt1.tmp.new (successful)

C:\WINDOWS\system32\rsaenh.dll (successful)

\\.\PIPE\lsarpc (successful)

c:\autoexec.bat (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

Read files

\\?\C:\f2dacd9ac118102a03cca67cff29a8e978b32222671b6143727cec4b98f9188f (successful)

C:\WINDOWS\system32\rsaenh.dll (successful)

c:\autoexec.bat (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab4.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar5.tmp (successful)

\\?\C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt1.tmp (successful)

Written files

\\?\C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt1.tmp.new (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar3.tmp (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1275210071-920026266-1060284298-1003\1f91d2d17ea675d4c2c3192e241743f9_fabbc6a1-c573-4ea0-9ca1-50004b35a440 (successful)

\\?\C:\Documents and Settings\<USER>\Application Data\uTorrent\settings.dat.new (successful)

\\?\C:\Documents and Settings\<USER>\Application Data\uTorrent\uTorrent.exe (successful)

\\?\C:\Documents and Settings\<USER>\Application Data\uTorrent\maindoc.ico (successful)

\\?\C:\Documents and Settings\<USER>\Application Data\uTorrent\apps\featuredContent.btapp (successful)

Copied files

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt1.tmp.new
DST: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt1.tmp.new (failed)

SRC: C:\f2dacd9ac118102a03cca67cff29a8e978b32222671b6143727cec4b98f9188f
DST: C:\Documents and Settings\<USER>\Application Data\uTorrent\updates\3.4.2_32354.exe (failed)

SRC: C:\Documents and Settings\<USER>\Application Data\uTorrent\settings.dat
DST: C:\Documents and Settings\<USER>\Application Data\uTorrent\settings.dat (failed)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt6.tmp.new
DST: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt6.tmp.new (failed)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt7.tmp.new
DST: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt7.tmp.new (failed)

SRC: C:\Documents and Settings\<USER>\Application Data\uTorrent\uTorrent.exe
DST: C:\Documents and Settings\<USER>\Application Data\uTorrent\updates\3.4.2_32354.exe (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\uttA.tmp
DST: C:\Documents and Settings\<USER>\Application Data\uTorrent\apps\player.btapp (successful)

SRC: C:\Documents and Settings\<USER>\Application Data\uTorrent\apps\featuredContent.btapp.new
DST: C:\Documents and Settings\<USER>\Application Data\uTorrent\apps\featuredContent.btapp.new (failed)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\uttB.tmp
DST: C:\Documents and Settings\<USER>\Application Data\uTorrent\apps\welcome-upsell.btapp (successful)

SRC: C:\Documents and Settings\<USER>\Application Data\uTorrent\apps\plus.btapp.new
DST: C:\Documents and Settings\<USER>\Application Data\uTorrent\apps\plus.btapp.new (failed)

Moved files

SRC: C:\Documents and Settings\<USER>\Application Data\uTorrent\settings.dat
DST: C:\Documents and Settings\<USER>\Application Data\uTorrent\settings.dat.old (failed)

SRC: C:\Documents and Settings\<USER>\Application Data\uTorrent\settings.dat.new
DST: C:\Documents and Settings\<USER>\Application Data\uTorrent\settings.dat (successful)

SRC: C:\Documents and Settings\<USER>\Application Data\uTorrent\settings.dat
DST: C:\Documents and Settings\<USER>\Application Data\uTorrent\settings.dat.old (successful)

Replaced files

What: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt1.tmp
With: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt1.tmp.new (successful)

What: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt6.tmp
With: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt6.tmp.new (successful)

What: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt7.tmp
With: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt7.tmp.new (successful)

What: C:\Documents and Settings\<USER>\Application Data\uTorrent\apps\featuredContent.btapp
With: C:\Documents and Settings\<USER>\Application Data\uTorrent\apps\featuredContent.btapp.new (successful)

What: C:\Documents and Settings\<USER>\Application Data\uTorrent\apps\plus.btapp
With: C:\Documents and Settings\<USER>\Application Data\uTorrent\apps\plus.btapp.new (successful)

Deleted files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt1.tmp.12577.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab4.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar5.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt6.tmp.12584.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt6.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\utt7.tmp.12580.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab8.tmp (successful)

Created processes

C:\Documents and Settings\<USER>\Application Data\uTorrent\uTorrent.exe uTorrent.exe /NOINSTALL /BRINGTOFRONT (successful)

Created mutexes

RasPbFile (failed)

Local\\xb5Torrent4823DF041B09 (successful)

CTF.LBES.MutexDefaultS-1-5-21-1275210071-920026266-1060284298-1003 (successful)

CTF.Compart.MutexDefaultS-1-5-21-1275210071-920026266-1060284298-1003 (successful)

CTF.Asm.MutexDefaultS-1-5-21-1275210071-920026266-1060284298-1003 (successful)

CTF.Layouts.MutexDefaultS-1-5-21-1275210071-920026266-1060284298-1003 (successful)

CTF.TMD.MutexDefaultS-1-5-21-1275210071-920026266-1060284298-1003 (successful)

MSIMGSIZECacheMutex (successful)

DDrawWindowListMutex (successful)

DDrawDriverObjectListMutex (successful)

Opened mutexes

RasPbFile (successful)

ShimCacheMutex (successful)

_!SHMSFTHISTORY!_ (failed)

Searched windows

CLASS: \xb5Torrent4823DF041B09
NAME: (null)

CLASS: Shell_TrayWnd
NAME: (null)

CLASS: MS_AutodialMonitor
NAME: (null)

CLASS: MS_WebcheckMonitor
NAME: (null)

Opened service managers

MACHINE: localhost
DATABASE: SERVICES_ACTIVE_DATABASE (successful)

Opened services

RASMAN (successful)

CryptSvc (successful)

RemoteAccess (successful)

Router (failed)

Hooking activity

TYPE: WH_MOUSE
METHOD: SetWindowsHook (successful)

TYPE: WH_KEYBOARD
METHOD: SetWindowsHook (successful)

Runtime DLLs

kernel32.dll (successful)

advapi32.dll (successful)

comctl32.dll (successful)

comdlg32.dll (successful)

dnsapi.dll (successful)

gdi32.dll (successful)

gdiplus.dll (successful)

iphlpapi.dll (successful)

msimg32.dll (successful)

ole32.dll (successful)

Additional details

The file sends control codes directly to certain device drivers making use of the DeviceIoControl Windows API function.

The file installs an application-defined hook procedure into a hook chain. You would install a hook procedure to monitor the system for certain types of events. These events are associated either with a specific thread or with all threads in the same desktop as the calling thread. This is done making use of the SetWindowsHook Windows API function.

HTTP requests

URL: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
TYPE: GET
USER AGENT: Microsoft-CryptoAPI/5.131.2600.5512

URL: http://bench.utorrent.com/e?i=50
TYPE: POST
USER AGENT: Hydra HttpRequest

URL: http://bundles.bittorrent.com/onboarding?url=http%3A%2F%2Fbundles.bittorrent.com%2F
TYPE: GET
USER AGENT: BTWebClient/3420(32354)

URL: http://update.utorrent.li/installstats.php?cl=uTorrent&v=109411938&h=ywGq5u8Ydcx7bgXN&w=A280105&bu=0&pr=0&cmp=134&ocmp=134&installresult&pid=1940&cau=0&installresult=0&exit=1&au=0&view=win32
TYPE: GET
USER AGENT: uTorrent(32354)/3.4.2

URL: http://utclient.utorrent.com/plus/utorrent/index.html
TYPE: GET
USER AGENT: BTWebClient/3420(32354)

URL: http://apps.bittorrent.com/utorrent-onboarding/welcome-upsell.btapp
TYPE: GET
USER AGENT: BTWebClient/3420(32354)

URL: http://apps.bittorrent.com/utorrent-onboarding/player.btapp
TYPE: GET
USER AGENT: BTWebClient/3420(32354)

URL: http://bench.utorrent.com/e?i=32
TYPE: POST
USER AGENT: BTWebClient/3420(32354)

URL: http://utorrent.com/download/langpacks/dl.php?build=32354&ref=client&client=utorrent&sys_l=en&sel_l=-1&tk=stable34
TYPE: GET
USER AGENT: BTWebClient/3420(32354)

URL: http://apps.bittorrent.com/utorrent-onboarding/player.btapp?h=ywGq5u8Ydcx7bgXN&v=109411938&ol=en&ul=&tk=stable34&c=uTorrent
TYPE: GET
USER AGENT: BTWebClient/3420(32354)

DNS requests

www.download.windowsupdate.com (23.212.109.152)

router.utorrent.com (82.221.103.244)

router.bittorrent.com (67.215.246.10)

bench.utorrent.com (107.20.166.217)

bundles.bittorrent.com (54.230.185.204)

utclient.utorrent.com (176.32.101.156)

update.utorrent.li (82.221.103.246)

apps.bittorrent.com (87.248.210.254)

utorrent.com (98.143.146.7)

update.bittorrent.com (67.215.246.204)

TCP connections

23.212.109.168:80

107.20.240.14:80

54.230.185.204:80

82.221.103.245:80

205.251.242.244:80

87.248.210.254:80

87.248.210.253:80

23.21.115.217:80

98.143.146.7:80

54.230.185.183:80

UDP communications

82.221.103.244:6881

67.215.246.10:6881

109.29.218.127:38062

90.154.163.160:11113

31.180.123.127:28370

89.17.129.11:62348

185.42.127.49:49536

92.124.32.51:20347

189.25.47.27:63204

24.1.214.191:80

SHA256:	f2dacd9ac118102a03cca67cff29a8e978b32222671b6143727cec4b98f9188f
File name:	uTorrent (18).exe
Detection ratio:	0 / 51
Analysis date:	2014-07-16 09:51:08 UTC ( 3 months, 2 weeks ago ) View latest

Authenticode signature block

Packers identified

PE header basic information

PE sections

PE imports

Number of PE resources by type

Number of PE resources by language

ExifTool file metadata

Execution parents

File identification

VirusTotal metadata

Advanced heuristic and reputation engines

Behaviour characterization

Leave your comment...

Opened files

Read files

Written files

Copied files

Moved files

Replaced files

Deleted files

Created processes

Created mutexes

Opened mutexes

Searched windows

Opened service managers

Opened services

Hooking activity

Runtime DLLs

Additional details

HTTP requests

DNS requests

TCP connections

UDP communications

Recover your password

Join VirusTotal Community

Sign in