ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 24 August 2011, 07:56:30
Processing time: 9 min 43 sec
Submitted sample:

File MD5: 0x30CA6F27989FC9C453C4131ACA265A20
File SHA-1: 0x9D82CB39E6219586995CB07E99E1125C32D2EB34
Filesize: 1,970,208 bytes

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%AppData%\Agence-Exclusive\Agence-Exclusive\autoupdater.exe	671,360 bytes	MD5: 0x628989FE4B0C7CC2B4E07713BAB51254 SHA-1: 0x8D099F4ECF9C92F6D1E756A0CB99A9E65FF5404E
2	[pathname with a string SHARE]\shared.cyp	32 bytes	MD5: 0x7A517AB5D08884657CEAAC8E43F25577 SHA-1: 0x60A0E9221B2068EC05A266E0449208B4467407AD
3	%AppData%\Agence-Exclusive\Agence-Exclusive\UpdatePCTuto.exe	777,856 bytes	MD5: 0x204C972DA412789C97A2188B045F6162 SHA-1: 0x8C053A359B519748CAB81E4D0E1BAD2340C4B653
4	%AppData%\Agence-Exclusive\Agence-Exclusive\user_config.cyp	216 bytes	MD5: 0x78F91799E3ADCA1E8F8CBE877F39462F SHA-1: 0x6D4DBB538E4C55D346519E325C31E908844AA581
5	%AppData%\Agence-Exclusive\Agence-Exclusive\user_profil.cyp	844 bytes	MD5: 0x55AD8C2558D7CB3636A9EEDF895897A9 SHA-1: 0x2D5C6F931835F958CF75E122800E0A04607BCE67
6	%AppData%\Agence-Exclusive\Agence-Exclusive\EoStats\eoStats.txt %Temp%\ins2.tmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709
7	%AppData%\Agence-Exclusive\Agence-Exclusive\pctuto_confMedia.cyp	2,840 bytes	MD5: 0x0249B362331B6847F0AE95D095C929CF SHA-1: 0x11DA8BAEEE7BB51AF41712BB353BFE6B2D7B4953
8	%AppData%\Agence-Exclusive\Agence-Exclusive\user.cyp	152 bytes	MD5: 0x74897A50452F596D0081E04B24A5D9EA SHA-1: 0xFC47ABAE1FCEB5A3AA058B21C31548454385E6FD
9	%ProgramFiles%\Agence-Exclusive\ConfMedia.cyp	2,712 bytes	MD5: 0x60E9F80E46832C92E348637401C04ECA SHA-1: 0xEBB640B779A5AF293E6FDD7736F89DEF64FAB347
10	%ProgramFiles%\Agence-Exclusive\pctuto.exe	1,035,904 bytes	MD5: 0x38957E987A4A565D984AE19B315173D1 SHA-1: 0xC25FFAEFEC08367099CF8B4CA6DEC866AC9CC53F
11	%ProgramFiles%\Agence-Exclusive\pctutoBHO.dll	228,992 bytes	MD5: 0x9BF10EF23CED422F7C7DB2EDE5BFAA99 SHA-1: 0x0B75B217B6075F093DC711903250458E37375EBD
12	%ProgramFiles%\Agence-Exclusive\unins000.dat	9,030 bytes	MD5: 0x7B1FE8937FA2633443BE58F035208128 SHA-1: 0x4DCF062F3D28B1B5B79D62D696B64CFBDDC7C915
13	%ProgramFiles%\Agence-Exclusive\unins000.exe	1,180,645 bytes	MD5: 0x407B22D7FB7925E6F8510FAF2FD97A11 SHA-1: 0xBA14519DACDE01D41801F48F491119A970C90B8F
14	[file and pathname of the sample #1]	1,970,208 bytes	MD5: 0x30CA6F27989FC9C453C4131ACA265A20 SHA-1: 0x9D82CB39E6219586995CB07E99E1125C32D2EB34

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%AppData%\Agence-Exclusive
%AppData%\Agence-Exclusive\Agence-Exclusive
%AppData%\Agence-Exclusive\Agence-Exclusive\EoStats
%ProgramFiles%\Agence-Exclusive

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1 without extension].tmp	%Temp%\is-95LL0.tmp\[filename of the sample #1 without extension].tmp	1,269,760 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\PCTutoBHO.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{759F1421-4D31-4c1f-8C51-E4956A037676}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PcTuto_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Agence-Exclusive
HKEY_CURRENT_USER\Software\Agence-Exclusive
HKEY_CURRENT_USER\Software\Agence-Exclusive\Agence-Exclusive
HKEY_CURRENT_USER\Software\Agence-Exclusive\UpdatePCTuto

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\PCTutoBHO.DLL]

AppID = "{759F1421-4D31-4c1f-8C51-E4956A037676}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{759F1421-4D31-4c1f-8C51-E4956A037676}]

(Default) = "PCTutoBHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\VersionIndependentProgID]

(Default) = "PCTutoBHO.PCTBHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\TypeLib]

(Default) = "{{0BF73E27-2734-4f7b-925A-4BBB1457F5FA}}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\ProgID]

(Default) = "PCTutoBHO.PCTBHO.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\InprocServer32]

(Default) = "%ProgramFiles%\Agence-Exclusive\pctutoBHO.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}]

(Default) = "PCTBHO Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}\TypeLib]

(Default) = "{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}]

(Default) = "IPCTBHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0\0\win32]

(Default) = "%ProgramFiles%\Agence-Exclusive\pctutoBHO.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0\HELPDIR]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0]

(Default) = "PCTEngineBHO 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO\CurVer]

(Default) = "PCTutoBHO.PCTBHO.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO\CLSID]

(Default) = "{293A63F7-C3B6-423a-9845-901AC0A7EE6E}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO]

(Default) = "PCTBHO Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO.1\CLSID]

(Default) = "{293A63F7-C3B6-423a-9845-901AC0A7EE6E}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO.1]

(Default) = "PCTBHO Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}]

(Default) = "PCTBHO"
NoExplorer = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

pctuto = ""%ProgramFiles%\Agence-Exclusive\pctuto.exe""
autoupdater = "%AppData%\Agence-Exclusive\Agence-Exclusive\autoupdater.exe"

so that pctuto.exe runs every time Windows starts

so that autoupdater.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PcTuto_is1]

Inno Setup: Setup Version = "5.4.0 (u)"
Inno Setup: App Path = "%ProgramFiles%\Agence-Exclusive"
InstallLocation = "%ProgramFiles%\Agence-Exclusive\"
Inno Setup: Icon Group = "Agence-Exclusive"
Inno Setup: User = "%UserName%"
Inno Setup: Language = "fr"
DisplayName = "PcTuto 1.1"
UninstallString = ""%ProgramFiles%\Agence-Exclusive\unins000.exe""
QuietUninstallString = ""%ProgramFiles%\Agence-Exclusive\unins000.exe" /SILENT"
Publisher = "Agence-Exclusive"
URLInfoAbout = "http://www.pctuto.com"
HelpLink = "http://www.pctuto.com"
URLUpdateInfo = "http://www.pctuto.com"
NoModify = 0x00000001
NoRepair = 0x00000001
InstallDate = "20110824"

[HKEY_LOCAL_MACHINE\SOFTWARE\Agence-Exclusive]

HostGUID = "42AA1F02-94CD-4101-9443-297A090B1434"

[HKEY_CURRENT_USER\Software\Agence-Exclusive\UpdatePCTuto]

MainDir = "%AppData%\Agence-Exclusive\Agence-Exclusive"
Version = "2.0.0.0"
SoftwareDir = "%AppData%\agence-exclusive\agence-exclusive\Software"

[HKEY_CURRENT_USER\Software\Agence-Exclusive\Agence-Exclusive]

version = "1.1"

[HKEY_CURRENT_USER\Software\Agence-Exclusive]

Url1 = "about:blank"
IETabs = ""
SConf = "config_31"
LCID = 0x00000409

Other details

Analysis of the file resources indicate the following possible countries of origin:

	France
	Netherlands

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
91.121.70.65	80
91.121.8.132	80
94.23.51.185	80

The data identified by the following URLs was then requested from the remote web server:

http://log.pctuto.com/cgi-bin/trace.cgi
http://log.eorezo.com/cgi-bin/trace.cgi
http://ads.regiedepub.com/cgi-bin/advert/getads.cgi?x_dp_id=731%20start
http://prof.pctuto.com/cgi-bin/get_config.cgi
http://prof.pctuto.com/cgi-bin/create_profile.cgi
http://prof.pctuto.com/cgi-bin/get_update.cgi

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.