ThreatExpert Report

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 6 May 2013, 16:33:26
Processing time: 3 min 5 sec
Submitted sample:

File MD5: 0x0B6579FBEB72273972629643C645C5A5
File SHA-1: 0x5294856E639C9EFFC0952D13B517092E1847CA43
Filesize: 1,644,136 bytes

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%UserProfile%\PUTTY.RND	600 bytes	MD5: 0xF421D05B9FA80235692EB9755CFF3E9C SHA-1: 0x09A3008118D6E765CC1FC9C4088393E533134BCE
2	[file and pathname of the sample #1]	1,644,136 bytes	MD5: 0x0B6579FBEB72273972629643C645C5A5 SHA-1: 0x5294856E639C9EFFC0952D13B517092E1847CA43
3	%System%\utmp\Bqhfpsptgdtk7q7h	28 bytes	MD5: 0xC55D38250C3D4E148168A55AB8C0E59D SHA-1: 0x7B60C99EFF8F5ABFBD960B373FC32C6635987564
4	%System%\utmp\Jlacnwfjcdjh7x9p	40 bytes	MD5: 0x999BC7CFBE130EF959254428AF990E33 SHA-1: 0x0A857EFC454CFC289DB071181A925A0B3A7E8531
5	%System%\utmp\Niyefjaxbwxm7u0c	16 bytes	MD5: 0xDB85663E4312C6E5805DF9B76A1D65E8 SHA-1: 0xE083EA45F6C8FF4D70F295EF367F24FAC25CF87E
6	%System%\utmp\Tnfnhqzizcih6m5u	30 bytes	MD5: 0xE9F36B459AEB387A0431DEFCD3E39031 SHA-1: 0xF5E0861E83D132E215C51FD34A26D8626A17BBE1
7	%System%\utmp\Xkdpqduwyvwm6r6i	72 bytes	MD5: 0xE6E02FCAA0AD8D7139FFA14A6696127E SHA-1: 0x763F8EBD1EEBF85692EFCA9E0912AFFC1D58DBB9

Notes:

%UserProfile% is a variable that specifies the current user's profile folder. By default, this is C:\Documents and Settings\[UserName] (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directory was created:

%System%\utmp

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	7,340,032 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences\ProxySettings
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences\ProxySettings\HTTP

The newly created Registry Values are:

[HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences]

UseHTTP = 0x00000001
UseTCP = 0x00000000
UseUDP = 0x00000000
UseMulticast = 0x00000000

[HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences\ProxySettings\HTTP]

ProxyBypass = 0x00000000
ProxyStyle = 0x00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]

CurrentLevel = 00 00 00 00
1C00 = 00 00 00 00

The following Registry Value was deleted:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]

CurrentLevel = 0x00000000
1C00 = 0x00010000

Other details

Analysis of the file resources indicate the following possible countries of origin:

	Taiwan
	China

The following ports were open in the system:

Port	Protocol	Process
1039	UDP	[file and pathname of the sample #1]
1049	UDP	[file and pathname of the sample #1]
9666	TCP	[file and pathname of the sample #1]

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.