Antivirus scan for e337f71d42aab3fdddb6e457aa6f376d7c6ce68ebf57059cf78a181be951a597 at 2015-02-10 02:55:13 UTC

Антивирус	Результат	Дата обновления
Ad-Aware	Gen:Variant.Graftor.104539	20150210
Yandex	Trojan.Chydo!zqLlA9gnGqU	20150208
AhnLab-V3	Trojan/Win32.Chydo	20150209
ALYac	Gen:Variant.Graftor.104539	20150210
Antiy-AVL	Trojan/Win32.Chydo	20150209
Avast	Win32:Chydo [Drp]	20150210
AVG	Generic_r.TT	20150210
Avira (no cloud)	TR/Drop.Agen.757760	20150210
AVware	Trojan.Win32.Pykspa.a (v)	20150210
BitDefender	Gen:Variant.Graftor.104539	20150210
Bkav	W32.JapiletG.Worm	20150209
CAT-QuickHeal	Trojan.KillAv.DR	20150205
CMC	Trojan.Win32.Chydo!O	20150209
Comodo	Worm.Win32.Autorun.Agent_TV4	20150210
Cyren	W32/KillAV.M.gen!Eldorado	20150210
DrWeb	Trojan.MulDrop.64839	20150210
Emsisoft	Gen:Variant.Graftor.104539 (B)	20150210
ESET-NOD32	Win32/AutoRun.Agent.TV	20150210
F-Prot	W32/Chydo.A	20150210
F-Secure	Trojan:W32/Chydo.gen!A	20150210
Fortinet	W32/Agent.LGB!tr	20150210
GData	Gen:Variant.Graftor.104539	20150210
Ikarus	Trojan.Win32.Chydo	20150210
Jiangmin	Trojan/Generic.bopyl	20150209
K7AntiVirus	Trojan ( 001d712b1 )	20150210
K7GW	Trojan ( 001d712b1 )	20150210
Kaspersky	Trojan.Win32.Agentb.adkr	20150210
Kingsoft	Win32.Troj.Chydo.r.(kcloud)	20150210
Malwarebytes	Trojan.Chydo	20150210
McAfee	BackDoor-EJG	20150210
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.hc	20150209
Microsoft	TrojanDropper:Win32/Pykspa.A	20150210
eScan	Gen:Variant.Graftor.104539	20150210
NANO-Antivirus	Trojan.Win32.Chydo.bjpmd	20150209
Norman	AutoRun.BPRM	20150209
nProtect	Trojan/W32.Chydo.557056	20150209
Panda	Generic Malware	20150209
Rising	PE:Trojan.Win32.FakeAlert.ok!1075350358	20150209
Sophos AV	Troj/Bckdr-RAK	20150210
SUPERAntiSpyware	Trojan.Agent/Gen-KillAV	20150210
Symantec	W32.Pykspa!gen1	20150210
Tencent	Trojan.Win32.FakeAlert.ate	20150210
TotalDefense	Win32/SillyAutorun.CKL	20150210
TrendMicro	WORM_MESSEN.SMF	20150210
TrendMicro-HouseCall	WORM_MESSEN.SMF	20150210
VBA32	BScope.Dropper.gen	20150209
VIPRE	Trojan.Win32.Pykspa.a (v)	20150210
ViRobot	Trojan.Win32.Chydo.516096.B[h]	20150209
Zillya	Trojan.Chydo.Win32.133	20150209
AegisLab		20150210
Alibaba		20150210
Baidu-International		20150209
ByteHero		20150210
ClamAV		20150209
Qihoo-360		20150210
TheHacker		20150209
Zoner		20150209

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2008-12-20 22:48:46

Entry Point 0x00002715

Number of sections 4

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 21166 24576 6.02 f8a46a59c978cfa6c123e2a8e9e54a50

.rdata 28672 5002 8192 3.40 b4872ec3f03f6b7464e7110c33a60c08

.data 36864 420152 421888 7.99 554f0bde7fd1b415d4b543cac97e42ac

.rsrc 458752 97480 98304 5.97 6d536f3c0bf3fd82299bed4d341e584a

PE imports

[+] KERNEL32.dll

[+] SHELL32.dll

Number of PE resources by type

RT_ICON 20

RT_GROUP_ICON 1

Number of PE resources by language

ENGLISH US 21

PE resources

0308d9360e3c1d4c3223f9ba48b94ba12c3dd9b6a625089af4454df4f601cc9f data

14be8b36764fb2f85532ffd60bb479a21b94fc20d90b68dfc5d66e347f22e25c data

251fa3aa0fd020fd6453064218e43a8f90553db177440009f2abe0628becd1ac image/x-png

363027b53d102377a8531f81dd06f7ddb5ced68d88500a49007a06d97c87b59b data

378df4d4ba0959ffff9d6a7fe1bd84a2bc3386ffe57bfa4dffe2ea4939c0d08f data

412dff040616142bd73327b7de7058c8eb0732659d97fda47c8acb21a8663351 data

422802be2fade80e10811c197a28a0a26b1d638e6eb25897231b285c63d13353 data

4d83b160e5b22fce3b5f792796a358330561432dc2d819af1c1f6d8a1da65f8e data

59a4d2d6c5c2e4479879688213e9427fb066421584a21d5e27f0499cf2e53413 data

5d7176a2329a25ebe0e499e7f5e797404bd53d7c30c9a7c16588adca71feb1b4 data

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

TimeStamp

2008:12:20 23:48:46+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

24576

LinkerVersion

7.1

FileAccessDate

2015:02:17 03:55:57+01:00

EntryPoint

0x2715

InitializedDataSize

528384

SubsystemVersion

4.0

ImageVersion

0.0

OSVersion

4.0

FileCreateDate

2015:02:17 03:55:57+01:00

UninitializedDataSize

File identification

MD5 8a43719f9e3e4d80523f50c103a14c5f

SHA1 1cfbd1b01ee2c423b0f95cf80b940c55a2e4e61f

SHA256 e337f71d42aab3fdddb6e457aa6f376d7c6ce68ebf57059cf78a181be951a597

ssdeep

12288:66onxOp8FySpE5zvIdtU+YmefT9Prn3Mp:+wp8DozAdO9B2

authentihash 38bc8d6a6df8e54c69254abea136d2b5801931f9367f3181e3d5cc1a58bd566d

imphash fb815acbc7109e8c83537d7d9c7020be

Размер файла 544.0 KБ ( 557056 bytes )

Тип файла Win32 EXE

Описание

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Executable MS Visual C++ (generic) (67.3%) Win32 Dynamic Link Library (generic) (14.2%) Win32 Executable (generic) (9.7%) Generic Win/DOS Executable (4.3%) DOS Executable Generic (4.3%)

VirusTotal metadata

First submission 2015-02-10 02:55:13 UTC (4 лет, 2 месяцев назад)

Last submission 2015-02-10 02:55:13 UTC (4 лет, 2 месяцев назад)

Имена файлов

17 (2) (1).exe

Advanced heuristic and reputation engines

ClamAV

Possibly Unwanted Application. While not necessarily malicious, the scanned file presents certain characteristics which depending on the user policies and environment may or may not represent a threat. For full details see: https://www.clamav.net/documents/potentially-unwanted-applications-pua .

Вы не выполнили вход. Только зарегистрированные пользователи могут оставлять комментарии. Выполните вход и получите право голоса!

Вход Вступить в сообщество

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\\qdomivgeoks.exe (successful)

\\.\PIPE\wkssvc (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

\\.\PIPE\lsarpc (successful)

\\.\MountPointManager (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\qdomivgeoks.exe (successful)

\\.\Ip (successful)

C:\WINDOWS\system32\\zizvictbyhzrhkld.exe (failed)

C:\WINDOWS\system32\\gqiftogpnxqjaegzq.exe (failed)

C:\WINDOWS\system32\\patrgcvfepjdvadxpu.exe (failed)

Read files

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\qdomivgeoks.exe (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\cagrt.exe (successful)

Written files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\\qdomivgeoks.exe (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\cagrt.exe (successful)

Copied files

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\qdomivgeoks.exe
DST: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\cagrt.exe (successful)

Created processes

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\qdomivgeoks.exe C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\qdomivgeoks.exe" "c:\e337f71d42aab3fdddb6e457aa6f376d7c6ce68ebf57059cf78a181be951a597*"" (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\cagrt.exe C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\cagrt.exe" "-"" (successful)

Shell commands

((null)) C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\\qdomivgeoks.exec:\e337f71d42aab3fdddb6e457aa6f376d7c6ce68ebf57059cf78a181be951a597*"" [(null)] (successful)

((null)) C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\cagrt.exe-"" [C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\] (successful)

Created mutexes

zbbozbbonyvhdrgzbbozbbonyv (successful)

mcadxywlpfedaksroyucwfy (successful)

Opened mutexes

zbbozbbonyvhdrgzbbozbbonyv (failed)

ShimCacheMutex (successful)

mcadxywlpfedaksroyucwfy (failed)

cqmnfeanpdaxsagdygagy (failed)

tifhaaxlodbzveljfojqjr (failed)

zbbozbbonyvhdrgzbbozbbonyv (successful)

mcadxywlpfedaksroyucwfy (successful)

Runtime DLLs

ole32.dll (successful)

netapi32 (successful)

rpcrt4.dll (successful)

apphelp.dll (successful)

clbcatq.dll (successful)

comctl32.dll (successful)

riched20.dll (successful)

shell32.dll (successful)

setupapi.dll (successful)

secur32.dll (successful)

Additional details

The file sends control codes directly to certain device drivers making use of the DeviceIoControl Windows API function.

UDP communications

134.170.185.211:123

SHA256:	e337f71d42aab3fdddb6e457aa6f376d7c6ce68ebf57059cf78a181be951a597
Имя файла:	17 (2) (1).exe
Показатель выявления:	49 / 57
Дата анализа:	2015-02-10 02:55:13 UTC (4 лет, 2 месяцев назад) Показать последний анализ

Ciphered bundle