ThreatExpert Report: Mal/JavaGen-F

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 20 September 2012, 21:09:46
Processing time: 10 min 12 sec
Submitted sample:

File MD5: 0x3506B825BDDF4D75C93C8186BE3FEA44
File SHA-1: 0xF5B3D1458C270E62B4F3D5A3C1C2E9B8BA355E88
Filesize: 3,232,641 bytes

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Programs%\JAVSEditor\JAVS editor.lnk	789 bytes	MD5: 0xAAB4137AAFB941C78F94D7A0F4A21295 SHA-1: 0x072143ABC34952FCE22319EEBA1E8FC7CDD8D04A	(not available)
2	%Programs%\JAVSEditor\Uninstall JAVSEditor.lnk	789 bytes	MD5: 0x7A3C0D224EEA16A1000BC79F9C261970 SHA-1: 0xC7DCFCCE9FF70627E82C919BF3772B91B900167A	(not available)
3	%ProgramFiles%\JAVSEditor\avseditor.exe	452,096 bytes	MD5: 0x829BCEBAE26EA8ABC62248E821C9D52D SHA-1: 0x17C1A2F84F0EEDAC43DE9F3349BF153ACE697C9C	(not available)
4	%ProgramFiles%\JAVSEditor\avseditor.jar	233,169 bytes	MD5: 0xA545A72AFC779CF12F8BB66612C7515D SHA-1: 0xC7E55FEE0C97D0079676E5C8DE8F8E7655BC8679	Mal/JavaGen-F [Sophos]
5	%ProgramFiles%\JAVSEditor\avseditor.jpg	1,008 bytes	MD5: 0x7086F48476A959BC4167093322CDA74E SHA-1: 0x2B9CBEA37A3A768813B8C4D964512952EA8A45C7	(not available)
6	%ProgramFiles%\JAVSEditor\avseditor.png	4,091 bytes	MD5: 0xADE52A3656F0860532842CDA6DE9F907 SHA-1: 0x6722C2C91A8D9D2AC501831637E49D287CC90CE6	(not available)
7	%ProgramFiles%\JAVSEditor\config.properties	11 bytes	MD5: 0x1C751029B10EEC9551EAA4D7EA65D721 SHA-1: 0xF17E19BAC24D21D6C02715531301EE8D841A4AC5	(not available)
8	%ProgramFiles%\JAVSEditor\examples\relax25.avs	244 bytes	MD5: 0x79CA9180918099FCFA64EDB94E41A578 SHA-1: 0x5D59107542528DA3DC8BFEA8B6019AA0E8B42E8B	(not available)
9	%ProgramFiles%\JAVSEditor\ftd2xx.dll	202,048 bytes	MD5: 0xCE8CAD19B3052B052FA411936BCC4768 SHA-1: 0xA27879AA61C11B8ACA80DC263D4D9B4D3B8361CA	(not available)
10	%ProgramFiles%\JAVSEditor\HETools-0.0.1.jar %ProgramFiles%\JAVSEditor\lib\HETools-0.0.1.jar	4,593 bytes	MD5: 0x4BD5C5FECFB596AB2EB699BA422048F9 SHA-1: 0xE73BFB588CD7C53B9F070223CE62D63EC5E23CC0	(not available)
11	%ProgramFiles%\JAVSEditor\icons\playico.png	1,159 bytes	MD5: 0x23D71021E3F3A77A9458E34090ADC8B7 SHA-1: 0x6A4750481A1D6A4B698BD3862B428CB88A257094	(not available)
12	%ProgramFiles%\JAVSEditor\javax.comm.properties	467 bytes	MD5: 0xFDC6AED1BF700870C4376F84E58E23A8 SHA-1: 0x9EA27D7C7DBEA013AE210028B449749186CE55E5	(not available)
13	%ProgramFiles%\JAVSEditor\javolution-5.3.1.jar	443,174 bytes	MD5: 0xFF6B09C7B0083CC83910B447DA0E1239 SHA-1: 0x96C910E668A5EC4074881D8C071F32018A0F278C	(not available)
14	%ProgramFiles%\JAVSEditor\jcommon-1.0.16.jar	309,293 bytes	MD5: 0x9B67A2A8BA65BB07611E5732DA60FE0E SHA-1: 0x348F9E02DFD982B105133AEA7F702BACA4427364	(not available)
15	%ProgramFiles%\JAVSEditor\jfreechart-1.0.13.jar	1,425,744 bytes	MD5: 0xDBF0FEB10BDCC245B14E1E48A039B7A5 SHA-1: 0x8CEB15028CF9B99C25C88775AB292FAA27D3030A	(not available)
16	%ProgramFiles%\JAVSEditor\jl1.0.jar	105,446 bytes	MD5: 0xBEB5AF7C8E02649CA6D22514D9ECAB52 SHA-1: 0x2020D545657508BD82BEAB00359DCC50996B875E	(not available)
17	%ProgramFiles%\JAVSEditor\lametritonus.dll	57,344 bytes	MD5: 0xDEA66C9D8893E2129E2BADBF6195C0FF SHA-1: 0x1004FAE01C0779E34899264107A5EBBC0826CB0D	(not available)
18	%ProgramFiles%\JAVSEditor\lame_enc.dll	208,896 bytes	MD5: 0xB21C2AC006B5FCC9A612FA53227D2026 SHA-1: 0xF819868027CE8CC9D3B1E66AFC44515233478FAF	(not available)
19	%ProgramFiles%\JAVSEditor\lib\AbsoluteLayout.jar	2,881 bytes	MD5: 0x9430916E7F4176CB364C822E2E3597FA SHA-1: 0xF6160BF1FC322A646CEA7598A0D5931868888489	(not available)
20	%ProgramFiles%\JAVSEditor\lib\appframework-1.0.3.jar	264,192 bytes	MD5: 0x286F73433EC42C959EA19C2943EFEFF6 SHA-1: 0x8977F2578987E52949DC68CF691BFF03C21AA86A	(not available)
21	%ProgramFiles%\JAVSEditor\lib\swing-worker-1.1.jar	11,007 bytes	MD5: 0x724FC8F630E2B0B44672CAF51D3BE455 SHA-1: 0xFEE02E9E74B07F305472EA7B0A4D02912AAF5FFB	(not available)
22	%ProgramFiles%\JAVSEditor\licence.txt	2,312 bytes	MD5: 0x5320FEE943E7971EB3C9EFE445E18F4D SHA-1: 0x42628A3307A7076CB357EB5E47635989F46DBA06	(not available)
23	%ProgramFiles%\JAVSEditor\menu.properties	3,150 bytes	MD5: 0xA4A50361B9C8C170789834A837DB1CA9 SHA-1: 0xCD2BD2F0F31959B4DC488BE5DCFAB4645CFC1D44	(not available)
24	%ProgramFiles%\JAVSEditor\menu_cs.properties	4,113 bytes	MD5: 0xF2AE66B894A93DD63C57B25CD606D373 SHA-1: 0xDEAA765C0649D7B166A3B2ABA7AB0D0A3E5C383D	(not available)
25	%ProgramFiles%\JAVSEditor\mp3spi1.9.4.jar	24,538 bytes	MD5: 0x09DFEA6A70016B65C29B9DADBF8CAD45 SHA-1: 0xBECCB1A3E766D0BD782A174D7CCA0A47BA3B89D8	(not available)
26	%ProgramFiles%\JAVSEditor\nbdialogs.jar	177,825 bytes	MD5: 0x738A555130ABCFC4A7CFF94D02CA7F74 SHA-1: 0xACC0D70CC4580D6FDEAF5C78CE04BF0E47920346	(not available)
27	%ProgramFiles%\JAVSEditor\RXTXcomm.jar	59,464 bytes	MD5: 0xF94E90A2030310FC882F814B8F7ECCC6 SHA-1: 0xE96C946BE1E6537378FD532D2742B523DF2725A4	(not available)
28	%ProgramFiles%\JAVSEditor\rxtxSerial.dll	77,759 bytes	MD5: 0x485F2DD99BFB2B2FEB36A1A653DEF64B SHA-1: 0x350E839E45A075C2030A7E40D5078F5B9E542FAA	(not available)
29	%ProgramFiles%\JAVSEditor\tritonus_mp3-0.3.6.jar	21,166 bytes	MD5: 0x96C67D535A1C37AF300BA8131EB4B30E SHA-1: 0x9784C42E0071337E89FAEB4432A94A51EAC51B6B	(not available)
30	%ProgramFiles%\JAVSEditor\tritonus_share-0.3.6.jar	105,684 bytes	MD5: 0x63CF87AFA65DAF82ED9473834742BC48 SHA-1: 0x4731C1FC18554318CE1F649AD58909489A89B076	(not available)
31	%ProgramFiles%\JAVSEditor\uninstall.exe	37,764 bytes	MD5: 0x112FA3BBA5BC8E87A52B01D72BD10D0E SHA-1: 0xBE4D1F73194397AD86D65A62CB3228695466A0C2	(not available)
32	%ProgramFiles%\JAVSEditor\win32com.dll	27,648 bytes	MD5: 0x2AD8ACAB7EEE003C3A805D9A5F3E702D SHA-1: 0xFC8F16CC9961864A7C3471DACD721D58B47A57DC	(not available)
33	[file and pathname of the sample #1]	3,232,641 bytes	MD5: 0x3506B825BDDF4D75C93C8186BE3FEA44 SHA-1: 0xF5B3D1458C270E62B4F3D5A3C1C2E9B8BA355E88	(not available)

Notes:

%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%Programs%\JAVSEditor
%ProgramFiles%\JAVSEditor
%ProgramFiles%\JAVSEditor\examples
%ProgramFiles%\JAVSEditor\icons
%ProgramFiles%\JAVSEditor\lib

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	237,568 bytes
avseditor.exe	%ProgramFiles%\javseditor\avseditor.exe	487,324 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JAVSEditor
HKEY_LOCAL_MACHINE\SOFTWARE\JAVSEditor
HKEY_LOCAL_MACHINE\SOFTWARE\JAVSEditor\Components

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JAVSEditor]

DisplayName = "JAVSEditor"
DisplayVersion = "1.06"
Publisher = "Happy Electronics"
URLInfoAbout = "www.happy-electronics.eu"
DisplayIcon = "%ProgramFiles%\JAVSEditor\uninstall.exe"
UninstallString = "%ProgramFiles%\JAVSEditor\uninstall.exe"
NoModify = 0x00000001
NoRepair = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\JAVSEditor\Components]

Main = "1"

[HKEY_LOCAL_MACHINE\SOFTWARE\JAVSEditor]

Path = "%ProgramFiles%\JAVSEditor"
StartMenuGroup = "JAVSEditor"

Other details

To mark the presence in the system, the following Mutex objects were created:

{c::program files:javseditor:::avseditor.exe}
_!SHMSFTHISTORY!_

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
www.java.com	80	(null)	(null)

The following GET requests were made:

index.html
index.jpg

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.