ThreatExpert Report: Worm.Win32.VBNA

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 28 August 2012, 08:29:05
Processing time: 8 min 23 sec
Submitted sample:

File MD5: 0x2719F4C825D327D83185FF1B39365462
File SHA-1: 0xA749D187C0350398DDC2AFD2BF945A20597A7920
Filesize: 81,920 bytes
Alias: Worm.Win32.VBNA [Ikarus]

Technical Details:

File System Modifications

The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	81,920 bytes	MD5: 0x2719F4C825D327D83185FF1B39365462 SHA-1: 0xA749D187C0350398DDC2AFD2BF945A20597A7920	Worm.Win32.VBNA [Ikarus]

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	94,208 bytes

Other details

The following ports were open in the system:

Port	Protocol	Process
1034	TCP	[file and pathname of the sample #1]
1036	UDP	[file and pathname of the sample #1]

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
speedupdates.dnsd.me	8080	(null)	(null)

There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:

%System%\MSVBVM60.DLL

Note:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 8080:

00000000 | 4745 5420 2F61 2F20 4854 5450 2F31 2E31 | GET /a/ HTTP/1.1
00000010 | 0D0A 4163 6365 7074 3A20 2A2F 2A0D 0A41 | ..Accept: */*..A
00000020 | 6363 6570 742D 456E 636F 6469 6E67 3A20 | ccept-Encoding:
00000030 | 677A 6970 2C20 6465 666C 6174 650D 0A55 | gzip, deflate..U
00000040 | 7365 722D 4167 656E 743A 204D 6F7A 696C | ser-Agent: Mozil
00000050 | 6C61 2F34 2E30 2028 636F 6D70 6174 6962 | la/4.0 (compatib
00000060 | 6C65 3B20 4D53 4945 2036 2E30 3B20 5769 | le; MSIE 6.0; Wi
00000070 | 6E64 6F77 7320 4E54 2035 2E31 3B20 5356 | ndows NT 5.1; SV
00000080 | 313B 202E 4E45 5420 434C 5220 322E 302E | 1; .NET CLR 2.0.
00000090 | 3530 3732 3729 0D0A 486F 7374 3A20 6C6F | 50727)..Host: lo
000000A0 | 6361 6C68 6F73 743A 3830 3830 0D0A 436F | calhost:8080..Co
000000B0 | 6E6E 6563 7469 6F6E 3A20 4B65 6570 2D41 | nnection: Keep-A
000000C0 | 6C69 7665 0D0A 4361 6368 652D 436F 6E74 | live..Cache-Cont
000000D0 | 726F 6C3A 206E 6F2D 6361 6368 650D 0A0D | rol: no-cache...
000000E0 | 0A                                      | .

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.