ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 21 May 2012, 13:43:53
Processing time: 13 min 41 sec
Submitted sample:

File MD5: 0x64B1D3C83339A0BD2AD7D68C1CA94ED2
File SHA-1: 0x5C7D06C7C756DDE1F72018E52F8A4E739D08544F
Filesize: 2,841,719 bytes

Summary of the findings:

What's been found	Severity Level
Communication with a remote IRC server.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%ProgramFiles%\pIRC team\pIRC script\about.txt	2,078 bytes	MD5: 0x8F327AFC8D3B4E3C4FC05DCCC8946A8D SHA-1: 0xB57D9A8F14DE95CFE259DB03D1A602D54BD79C23
2	%ProgramFiles%\pIRC team\pIRC script\control.ini	42 bytes	MD5: 0x405D882EED0CAB5B915AA470A265DCC5 SHA-1: 0x7ADFA3476BFC1C248619F0F78DA6791FAA7AA360
3	%ProgramFiles%\pIRC team\pIRC script\IRC Intro.GID	8,628 bytes	MD5: 0xE47E581AA93AAF34D766DA955936F2E7 SHA-1: 0x01B83336D9392742669505A220222594D8CCAE69
4	%ProgramFiles%\pIRC team\pIRC script\IRC Intro.hlp	51,445 bytes	MD5: 0xDBE3AF684302CE56B0A6430236B95081 SHA-1: 0xA095643489617ADB3041DE472E26C3D4C8ECC51D
5	%ProgramFiles%\pIRC team\pIRC script\ircintro.GID	8,628 bytes	MD5: 0x2C0F0452DE5424CA4F4FAA86B995BC27 SHA-1: 0x17593F080AEF5A70916887BAC5D629F54229EDEF
6	%ProgramFiles%\pIRC team\pIRC script\ircintro.hlp	68,915 bytes	MD5: 0xADEA2334B00F7F169920305D6CA55F28 SHA-1: 0xA38040F11D6A0595C84E790DF81617F4172AA2E8
7	%ProgramFiles%\pIRC team\pIRC script\mirc.exe	1,957,888 bytes	MD5: 0x8EA0F82B113BE67C08E7549823F24F2D SHA-1: 0xB3751DB7F2ADB38871A1DB78B74CB918BE57B451
8	%ProgramFiles%\pIRC team\pIRC script\mirc.GID	33,234 bytes	MD5: 0xF86FEED28B20B4CE21EEEE3007891374 SHA-1: 0xD9CCD2F264A450A1196133526B47A976455C4061
9	%ProgramFiles%\pIRC team\pIRC script\mirc.hlp	230,920 bytes	MD5: 0x919041625CF70FA639BA04C180B13AB6 SHA-1: 0x9EE10E5762DE37EAE0D5B6F5B97F67F0F19F7F54
10	%ProgramFiles%\pIRC team\pIRC script\mirc.ini	5,596 bytes	MD5: 0x9B17FD4AC1704DB9D80A1260AB9B9D6D SHA-1: 0x522308EE979F054E0BFF7D490A8C40A516EEF241
11	%ProgramFiles%\pIRC team\pIRC script\pirc.chm	23,200 bytes	MD5: 0x7AE9A1D703DB4A1E81A587A2A675CD41 SHA-1: 0x3B71785A0774BE3404AEDAA43F14EB74FC97F5CF
12	%ProgramFiles%\pIRC team\pIRC script\pIRC.hlp	251,975 bytes	MD5: 0x0A1E9691FCC1EA73BE2B9D53217D81A8 SHA-1: 0x9C1CFCB22FE30347DD8A55541D15C0A31999A25E
13	%ProgramFiles%\pIRC team\pIRC script\pirc.ini	141 bytes	MD5: 0xE1EDE5B8EB578876E448016FFBC38CDE SHA-1: 0x2B482B0243457992FA749FF5885145F3B96E1F01
14	%ProgramFiles%\pIRC team\pIRC script\proxy4.txt	6,039 bytes	MD5: 0xF281D0749E8990432EED0D14362F1734 SHA-1: 0x6DDAE02047C6DAC16A67BB265C2A61F9358787C0
15	%ProgramFiles%\pIRC team\pIRC script\proxy5.txt	2,011 bytes	MD5: 0x43D55130A4959AFD216C20BD2047682E SHA-1: 0x2A03BC7A2DFD2DD53F097CF7652157BD5A20C0FF
16	%ProgramFiles%\pIRC team\pIRC script\Readme.txt	5,431 bytes	MD5: 0xD990CDF4D5BBB3FC6383A28A26C123DB SHA-1: 0x6478F2FDE8AD8B77B6FFA5FD827CF6ECCE1B10EA
17	%ProgramFiles%\pIRC team\pIRC script\skins\Boom\C.jpg	29,946 bytes	MD5: 0x6856ED358A3FFD8440C6458A7FCE6557 SHA-1: 0x75009F4C6FA8E6605BCB60473ED4AB01BA19B102
18	%ProgramFiles%\pIRC team\pIRC script\skins\Boom\H1.jpg	51,756 bytes	MD5: 0xE5180F6F6A5D9D23858226BAAE326715 SHA-1: 0xD74EE3E82AA2EB0288DFE25EFEFFB751D04FC23F
19	%ProgramFiles%\pIRC team\pIRC script\skins\Boom\H2.jpg	67,993 bytes	MD5: 0x35BCB9334AB445AEA71E418C05FFB109 SHA-1: 0x025C1352F51330F3C65F9738A01C1293F685B8F9
20	%ProgramFiles%\pIRC team\pIRC script\skins\Boom\H3.jpg	78,801 bytes	MD5: 0xFBC5F1DDC09BDD00B338152524D38083 SHA-1: 0x24668EE0D896385416FB7E256A9F6F6419C6CD04
21	%ProgramFiles%\pIRC team\pIRC script\skins\Boom\info.pts	197 bytes	MD5: 0xE59029DB27E2E193743FF738BAEE55AE SHA-1: 0x75D7F58660AEEB5DAA54F39466AA90CD014DD372
22	%ProgramFiles%\pIRC team\pIRC script\skins\Boom\L1.jpg %ProgramFiles%\pIRC team\pIRC script\skins\Boom\L2.jpg %ProgramFiles%\pIRC team\pIRC script\skins\Boom\L3.jpg	2,336 bytes	MD5: 0x3C19BC4CA0A33C57B8FDAD0AF62CE8D1 SHA-1: 0x7323E9943D36866CE0C571060C34B4305FFC36F5
23	%ProgramFiles%\pIRC team\pIRC script\skins\Boom\M.jpg	59,377 bytes	MD5: 0x67C21C9B450C3F528AB05E225252A0F3 SHA-1: 0xEC20D6CA9EB627BAF9C390F2FA93AFFFF2B100A8
24	%ProgramFiles%\pIRC team\pIRC script\skins\Boom\Thumbs.db	11,776 bytes	MD5: 0x1FE61B2F87AB4099C7E8A726D11F23AF SHA-1: 0x4DBFF3A8ECD03FEF9196C171B0D91E14A3A15E7A
25	%ProgramFiles%\pIRC team\pIRC script\skins\Boom\u.bmp %ProgramFiles%\pIRC team\pIRC script\skins\Default\u.bmp %ProgramFiles%\pIRC team\pIRC script\skins\Kosmos\u.bmp	25,076 bytes	MD5: 0x4CBA34A600E1F9D269FE860C8CEAB74E SHA-1: 0x6AB73C6DFCBA7E164402BFD7779B2F12F8F8B536
26	%ProgramFiles%\pIRC team\pIRC script\skins\Dance Girl\C.jpg	26,912 bytes	MD5: 0xBBA399A9A62FAC79C1EF51835B49CF30 SHA-1: 0xFABC601D16A8AEC4EBC78EDD4A2ADF3C04B5A685
27	%ProgramFiles%\pIRC team\pIRC script\skins\Dance Girl\H1.jpg	19,278 bytes	MD5: 0xEBAA708938B4BD8AA54FBBDA0D01AE00 SHA-1: 0xE05CCBE33BD53D1AA9DF90E835557942C42656EC
28	%ProgramFiles%\pIRC team\pIRC script\skins\Dance Girl\H2.jpg	25,093 bytes	MD5: 0x3F896B75075D7A26CEFBAFFF85B28204 SHA-1: 0xD96B1E18D494E2D8CC4DF07E992CD1A83AB6EC49
29	%ProgramFiles%\pIRC team\pIRC script\skins\Dance Girl\H3.jpg	29,064 bytes	MD5: 0x1AB373C790A0CDCCB5BD1E2C97521E8D SHA-1: 0x4E316D7371EB9C2E9ACC8FE0C751920BE30F6A9E
30	%ProgramFiles%\pIRC team\pIRC script\skins\Dance Girl\info.pts	203 bytes	MD5: 0xFEF580658AA3EE4E786F5C3EAD27EEC5 SHA-1: 0x2DAF9C4D37A9CD97BC3404645F1F82C7397E867E
31	%ProgramFiles%\pIRC team\pIRC script\skins\Dance Girl\L1.jpg	606 bytes	MD5: 0xBA084D42C396C3344672ABE0D5E57267 SHA-1: 0xF2E0BB2D8F4C9255B930BBEE43E5252C8B62B08D
32	%ProgramFiles%\pIRC team\pIRC script\skins\Dance Girl\L2.jpg	690 bytes	MD5: 0x7AF1865D4BB0E8B40C6A0B5630C522F9 SHA-1: 0x425CDA280B9BF9064F4BF4C7A4BE446638CCEFAD
33	%ProgramFiles%\pIRC team\pIRC script\skins\Dance Girl\L3.jpg	741 bytes	MD5: 0xE033D3076670FE0952C74B489EAFF31C SHA-1: 0x40A9FD9AB227B8B19BBA444BEF09D2EE3954FD63
34	%ProgramFiles%\pIRC team\pIRC script\skins\Dance Girl\M.jpg	47,564 bytes	MD5: 0x7A368C3C231FD604185E0CC73CB5BD18 SHA-1: 0xA7189412F487832E2A498848107D83D987CF8BCD
35	%ProgramFiles%\pIRC team\pIRC script\skins\Dance Girl\Thumbs.db	6,656 bytes	MD5: 0xCD1E66C680B4C83B24528D07D2869219 SHA-1: 0xED02785679026AC54CFEA9B9C8F2FBAFA9B9DEFB
36	%ProgramFiles%\pIRC team\pIRC script\skins\Default\C.jpg	29,965 bytes	MD5: 0x42746136A213D58CFC8AA95EB045B07E SHA-1: 0x52FFEFA88CFCEFB835A1CF82659818462C7EF3BB
37	%ProgramFiles%\pIRC team\pIRC script\skins\Default\H1.jpg	13,682 bytes	MD5: 0x85E76F824E64B4D1A0B9EE1C951CF0F0 SHA-1: 0x331BDBA9E6500F1F8B5CBDD32D7754CD2EF32661
38	%ProgramFiles%\pIRC team\pIRC script\skins\Default\H2.jpg	17,727 bytes	MD5: 0x39368DC9AAAF79E1A150AB65B1928D19 SHA-1: 0xBCAE978D09F53F0FB2E74C4267122436AACED341
39	%ProgramFiles%\pIRC team\pIRC script\skins\Default\H3.jpg	20,409 bytes	MD5: 0x782653CA7AAC570C3D883DB0BB973CE9 SHA-1: 0x72E867D86B4974D884797D9E6A36D722CEBF5B5E
40	%ProgramFiles%\pIRC team\pIRC script\skins\Default\info.pts	214 bytes	MD5: 0x4863C7771A37E2D2EE681237787A3804 SHA-1: 0xFC2AF9B31C0E74991CF84923FEE7913FBD18B6FE
41	%ProgramFiles%\pIRC team\pIRC script\skins\Default\L1.jpg	455 bytes	MD5: 0x8FC515228BC2844A38C472F04E25D280 SHA-1: 0x6F7D201D1534508386A25F4DEE389253780AC0B8
42	%ProgramFiles%\pIRC team\pIRC script\skins\Default\L2.jpg	497 bytes	MD5: 0xC001FA963229E2EAEACEA1CF977592C4 SHA-1: 0xF97C15748205B2AA6BB99C5A3F05A5D07FD5B100
43	%ProgramFiles%\pIRC team\pIRC script\skins\Default\L3.jpg	521 bytes	MD5: 0x15048463650B39F6421631699CD2B3BA SHA-1: 0xE316AA8CB6FCF768EBB1BCBA99E2D3ADD2257B25
44	%ProgramFiles%\pIRC team\pIRC script\skins\Default\M.jpg	57,788 bytes	MD5: 0x302F0CEB619F089251B70AFB306676AD SHA-1: 0xC241B8589FC86E9562E82D0C57618A179145C7A3
45	%ProgramFiles%\pIRC team\pIRC script\skins\Default\Thumbs.db	12,288 bytes	MD5: 0x2C594F9351AC942BF69A6AC28F0CE5C9 SHA-1: 0x8CA8FC2DBB0E87F4AB79714029C6FBEEE2C99C95
46	%ProgramFiles%\pIRC team\pIRC script\skins\DolphinInMySoul\C.jpg	107,082 bytes	MD5: 0xD4275250D8E3A5EE8A19D40E6CCD29D8 SHA-1: 0xE1F45CFA60D64F51995A1881D68FA04577E4DB99
47	%ProgramFiles%\pIRC team\pIRC script\skins\DolphinInMySoul\H2.jpg	6,766 bytes	MD5: 0x87F6B34B027EC63CFF7A4C09AAA915D0 SHA-1: 0x29C8791CD74183D36907DC4E55BC9FB48C746FEE
48	%ProgramFiles%\pIRC team\pIRC script\skins\DolphinInMySoul\info.pts	218 bytes	MD5: 0x99C26E9348277192C0D59C5D23263C4C SHA-1: 0xA038E8A1D647B3258A9FF0E77B99451B8233137C
49	%ProgramFiles%\pIRC team\pIRC script\skins\DolphinInMySoul\L2.jpg	5,200 bytes	MD5: 0xB06770002F0D2FCF75FA01BC442EB6C8 SHA-1: 0xA7EEDC1D1A238B8FB77C7B9CAE0582BD509BCD1C
50	%ProgramFiles%\pIRC team\pIRC script\skins\DolphinInMySoul\M.jpg	72,057 bytes	MD5: 0xBE1EE73A782FB6BD2A08805A0BC78B10 SHA-1: 0x17AE13378D19650208A830B69A1A46EE3B5A8E87
51	%ProgramFiles%\pIRC team\pIRC script\skins\Kosmos\C.jpg	18,033 bytes	MD5: 0x6E3D5A2F87BE122B7834364B8A8D65A6 SHA-1: 0xC981D60DD473576FB1194F0DE0561E1343A3DF24
52	%ProgramFiles%\pIRC team\pIRC script\skins\Kosmos\H1.jpg	20,116 bytes	MD5: 0x8B3AB93A29CE8F79626A811352418587 SHA-1: 0x3F0EEA23B60353DD1D69B2C7621C7E26C63C7EFF
53	%ProgramFiles%\pIRC team\pIRC script\skins\Kosmos\H2.jpg	27,633 bytes	MD5: 0x11D44336AF7C87B10F120A6C4E50582C SHA-1: 0x63D0C95AB243007240E369985F350291F627C3EC
54	%ProgramFiles%\pIRC team\pIRC script\skins\Kosmos\H3.jpg	31,855 bytes	MD5: 0xAA0316A2BC843EBD5966F7A69BAF3AF7 SHA-1: 0x419347B1BE3A06B28B3687F517790C86150D7D41
55	%ProgramFiles%\pIRC team\pIRC script\skins\Kosmos\info.pts	201 bytes	MD5: 0x3470347F4199A2150ED3634D9BF467ED SHA-1: 0x250DC890F2828058B45B93A3FE3E51D2190E053C
56	%ProgramFiles%\pIRC team\pIRC script\skins\Kosmos\L1.jpg	1,621 bytes	MD5: 0x844F92168378C8BA190F40B12565719A SHA-1: 0x6DF0C6F593C98F8F233AE7279CB0D32888414C16
57	%ProgramFiles%\pIRC team\pIRC script\skins\Kosmos\L2.jpg	1,979 bytes	MD5: 0x840FB3E2305F28CE35C2F645668D88B9 SHA-1: 0x036AF4B64FD012751753E3C67DCA2137C5CE6C6A
58	%ProgramFiles%\pIRC team\pIRC script\skins\Kosmos\L3.jpg	2,146 bytes	MD5: 0xD36C86779EF62EF7C3EEB865D417771A SHA-1: 0x4B0F73727AA06EC0D7A2FFE80828051D965D3A3E
59	%ProgramFiles%\pIRC team\pIRC script\skins\Kosmos\M.jpg	55,251 bytes	MD5: 0x0332B4FFC815E8C388136C09545A415C SHA-1: 0xAD4C6CFEC68C0E61BF6F0CC1821B85D541296674
60	%ProgramFiles%\pIRC team\pIRC script\skins\Kosmos\Thumbs.db	15,360 bytes	MD5: 0x119D154DA54988B4EB4860B265C759F4 SHA-1: 0x61DA87DFF39A2072649BDB10082F37DE0DE58813
61	%ProgramFiles%\pIRC team\pIRC script\skins\linux\c.jpg	29,002 bytes	MD5: 0x92655B4842EAEC90500914472C29C380 SHA-1: 0x854F6341275E264F1835E95A2B89BEA67BA56033
62	%ProgramFiles%\pIRC team\pIRC script\skins\linux\h2.jpg	33,563 bytes	MD5: 0xFE48C16962278412A191A04B729218A5 SHA-1: 0x32E3C8D56D71D0E42FD5A8A913AA7D268ECB29B9
63	%ProgramFiles%\pIRC team\pIRC script\skins\linux\info.pts	198 bytes	MD5: 0x94417B27361A8B20818C776A10529594 SHA-1: 0x600A419FAFD20C70A38F9007F94CBE1506732BF9
64	%ProgramFiles%\pIRC team\pIRC script\skins\linux\l2.jpg	3,824 bytes	MD5: 0x0250F7C2143DCEA9F1B1461B703EF902 SHA-1: 0xC118FD17420EBDAF801648B4D17F695D65654AC5
65	%ProgramFiles%\pIRC team\pIRC script\skins\linux\m.jpg	24,856 bytes	MD5: 0x2EE7DF10B3744B39EA4BACF85E4CC259 SHA-1: 0x21C31F75A970FBC6A968664D731CCBCF2137E439
66	%ProgramFiles%\pIRC team\pIRC script\skins\linux\Thumbs.db	7,680 bytes	MD5: 0x4DAF6E6F0FD2A8E18249DA3BD8C45E6B SHA-1: 0xEC4038C176E00ACF3071CEC23BC2F6081D72632D
67	%ProgramFiles%\pIRC team\pIRC script\skins\MacOSX\C.jpg	81,070 bytes	MD5: 0x14E4B67FCDA7BB24F010F2567904935E SHA-1: 0xCD4D25D1B1E12B396F594783FF094A03B737386A
68	%ProgramFiles%\pIRC team\pIRC script\skins\MacOSX\H1.jpg	7,015 bytes	MD5: 0xB81B3244DB0899233680A61DFE671B8F SHA-1: 0x8802FFDD5170FD3FA9318E98160309FE42219D7D
69	%ProgramFiles%\pIRC team\pIRC script\skins\MacOSX\H2.jpg	16,699 bytes	MD5: 0x64E7D2C0291E90C20A5B307475A6E59B SHA-1: 0xD0B932BA985DE004F895C8F6FF852E38BAEA70BA
70	%ProgramFiles%\pIRC team\pIRC script\skins\MacOSX\H3.jpg	8,859 bytes	MD5: 0xF5E6C91A1EF008222D8FBD182EC701C5 SHA-1: 0x949CAE627E061C8B2F69E20CB9BE232C93DBBE7B
71	%ProgramFiles%\pIRC team\pIRC script\skins\MacOSX\info.pts	220 bytes	MD5: 0xFD9BFFCA4F81A10A93712910D2CF63B1 SHA-1: 0x25E2D6958DF8E3AD0BC9C6D7B3426A46836250D1
72	%ProgramFiles%\pIRC team\pIRC script\skins\MacOSX\L1.jpg	2,401 bytes	MD5: 0xA0F79641A54B2C8842275D299D83418D SHA-1: 0x87B997A7EFF7D75BE8941EE3F504CA09815C29DA
73	%ProgramFiles%\pIRC team\pIRC script\skins\MacOSX\L2.jpg	2,865 bytes	MD5: 0xA43E71599C357BA3922223850C9FA15C SHA-1: 0x289826F21557D5B3D3B907DCF13620B41FB44149
74	%ProgramFiles%\pIRC team\pIRC script\skins\MacOSX\L3.jpg	3,129 bytes	MD5: 0xBC3CDB1003B2ADE519E77123D8C73F99 SHA-1: 0xB080F1B87FC31623DC2455EE78DE4E8825B91225
75	%ProgramFiles%\pIRC team\pIRC script\skins\MacOSX\M.jpg	81,831 bytes	MD5: 0x7D5F44952DB640697D9A45CDB0421FE5 SHA-1: 0xA001F7E1173AA4E6D13C8C474432999BB55A3940
76	%ProgramFiles%\pIRC team\pIRC script\skins\MacOSX\Thumbs.db	7,168 bytes	MD5: 0x548AC6B6F0E606C20664423AC573F592 SHA-1: 0x7D3D4BD187667892F41FE68910EE9F8A8F12154C
77	%ProgramFiles%\pIRC team\pIRC script\skins\MacOSX\u.bmp	25,074 bytes	MD5: 0xE1162ECF14C2CE3B1590B56D2EA3C87E SHA-1: 0xDC11BB6E73C4EE9A61BED494BDEC2560B0A368C2
78	%ProgramFiles%\pIRC team\pIRC script\skins\Ocean Theme\C.jpg	33,061 bytes	MD5: 0x870C83447068C5892F20F27930864F16 SHA-1: 0x50D4B7D06CC0593722CA721630D86222C44A9FBF
79	%ProgramFiles%\pIRC team\pIRC script\skins\Ocean Theme\H1.jpg	32,390 bytes	MD5: 0x3DFC862E1FB42AE1D8E9256D5C8E2CAF SHA-1: 0xD6AC5C84F96D607B60FFA27AE084BA385AA45168
80	%ProgramFiles%\pIRC team\pIRC script\skins\Ocean Theme\H2.jpg	43,078 bytes	MD5: 0x3D8D55865E39E0CA4DC38016EDB40178 SHA-1: 0x47CFEB9B1D8F5682878C1C08A5C617FF7F4B662F
81	%ProgramFiles%\pIRC team\pIRC script\skins\Ocean Theme\H3.jpg	51,038 bytes	MD5: 0x30EFF988970612F1958A66CC13E0331F SHA-1: 0xAC15EA1045505CB75D72FBA66B8E3D7555ECA74C
82	%ProgramFiles%\pIRC team\pIRC script\skins\Ocean Theme\info.pts	216 bytes	MD5: 0x6DE24A6869C7DE999763D1D32EC12348 SHA-1: 0x5FA3DE8AD8C029FA91FCD81F50017C0D8887CBE1
83	%ProgramFiles%\pIRC team\pIRC script\skins\Ocean Theme\L1.jpg	834 bytes	MD5: 0x18C8BF6B591E9585054BDD4DAEE4E9F9 SHA-1: 0x6FBAF452D51D19ABC0337500E0305FCB3BB2DE58
84	%ProgramFiles%\pIRC team\pIRC script\skins\Ocean Theme\L2.jpg	986 bytes	MD5: 0x1493CE216AEB8E3A6C956DC7F1B4C793 SHA-1: 0x8A8A582F5620F292B7825DDF75F922C38FB76183
85	%ProgramFiles%\pIRC team\pIRC script\skins\Ocean Theme\L3.jpg	1,078 bytes	MD5: 0x2931FC9E46562B3BEEC92598AC6F1ADB SHA-1: 0xA0FBCAEBFBF9D432D804A7FCBA9CD53839989CF2
86	%ProgramFiles%\pIRC team\pIRC script\skins\Ocean Theme\M.jpg	67,069 bytes	MD5: 0xEF2C94B69A4CEE63F4632ED20282CCF0 SHA-1: 0xC76D6896D9639FDE73F533E8262611ABE3B41589
87	%ProgramFiles%\pIRC team\pIRC script\skins\Ocean Theme\Thumbs.db	12,288 bytes	MD5: 0x24859F7297E62CD160133645709A3272 SHA-1: 0x37084B04A7AD7829FC09924936DAA65D4692E72A
88	%ProgramFiles%\pIRC team\pIRC script\skins\Sun Flowers\C.jpg	8,557 bytes	MD5: 0x083E252C11FEED7F071F779CA99415D2 SHA-1: 0x2A8D3067570B692195396C0B4E4AE33DC1C97038
89	%ProgramFiles%\pIRC team\pIRC script\skins\Sun Flowers\H1.jpg	26,012 bytes	MD5: 0x77EE9F5C2DBE6DB1D5F2EB3C0207CB0D SHA-1: 0xB2B0ECF49F5C5DA4B02FCCAD79E7B69E2A7BA046
90	%ProgramFiles%\pIRC team\pIRC script\skins\Sun Flowers\H2.jpg	32,319 bytes	MD5: 0xE9992DD26C82EB150674876B5950C5FD SHA-1: 0x196221340179135847BDDDFDD9672DE512458124
91	%ProgramFiles%\pIRC team\pIRC script\skins\Sun Flowers\H3.jpg	36,821 bytes	MD5: 0x8B4D7A254D21C612EE72D94E1441142A SHA-1: 0x9D6A1BDE0C911AED7285346BE55E72C7EB666688
92	%ProgramFiles%\pIRC team\pIRC script\skins\Sun Flowers\info.pts	204 bytes	MD5: 0x8AB70DC9FCD54243DE8234CCA12F56C5 SHA-1: 0x161D3A758CDC7A09ED87C2DD7F484DAB8887F014
93	%ProgramFiles%\pIRC team\pIRC script\skins\Sun Flowers\L1.jpg	1,648 bytes	MD5: 0xF5BA58AB7E3EB98F4E1BC81DF1ABD060 SHA-1: 0x11677ED98EC0F781C237EB3AD5247167A49D4DA9
94	%ProgramFiles%\pIRC team\pIRC script\skins\Sun Flowers\L2.jpg	1,998 bytes	MD5: 0x30A146BFCEC6DBFF22827F30C125E4EF SHA-1: 0x573197732F3F49D8D8D9E8DE2332F883368C834C
95	%ProgramFiles%\pIRC team\pIRC script\skins\Sun Flowers\L3.jpg	2,198 bytes	MD5: 0x0146AE8DF1E9DD4070E7F34179FA019A SHA-1: 0xB8B5346AA1A6F1C676D4E5528EE1E022BE6F3499
96	%ProgramFiles%\pIRC team\pIRC script\skins\Sun Flowers\M.jpg	20,163 bytes	MD5: 0xD1F8FD10D02CD81DEB2C919F9CF80D0E SHA-1: 0x1D72CF7CD0403FAB6D32DA6A52572AA6756190C9
97	%ProgramFiles%\pIRC team\pIRC script\skins\Sun Flowers\Thumbs.db	7,168 bytes	MD5: 0x5A00EFF533FE06B5CB2DF42BD3E3844F SHA-1: 0x98D32FB84BDBA6B8567EE7A0B55E8AB80160C4F2
98	%ProgramFiles%\pIRC team\pIRC script\skins\u.bmp	9,782 bytes	MD5: 0x733C56FE773CF3D1CAD1F848E6936272 SHA-1: 0x63A857331ACECC78A8A09B6BA5D26DFDCDDBE75E
99	%ProgramFiles%\pIRC team\pIRC script\skins\XPOlive\C.jpg	17,821 bytes	MD5: 0x4AB1D4AC470F36057AFF2FA950DE8F64 SHA-1: 0xDDB4C32B8842CD3113A11527D3B1680259A26C0E
100	%ProgramFiles%\pIRC team\pIRC script\skins\XPOlive\H2.jpg %ProgramFiles%\pIRC team\pIRC script\skins\XPOlive\H3.jpg	26,550 bytes	MD5: 0xE0CAEB47A18293F4484C659A0389D454 SHA-1: 0x55725F00624633D4042A80E9AD38B57897748A6F

Note:

%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%ProgramFiles%\pIRC team
%ProgramFiles%\pIRC team\pIRC script
%ProgramFiles%\pIRC team\pIRC script\channels
%ProgramFiles%\pIRC team\pIRC script\download
%ProgramFiles%\pIRC team\pIRC script\logs
%ProgramFiles%\pIRC team\pIRC script\modes
%ProgramFiles%\pIRC team\pIRC script\skins
%ProgramFiles%\pIRC team\pIRC script\skins\Boom
%ProgramFiles%\pIRC team\pIRC script\skins\Dance Girl
%ProgramFiles%\pIRC team\pIRC script\skins\Default
%ProgramFiles%\pIRC team\pIRC script\skins\DolphinInMySoul
%ProgramFiles%\pIRC team\pIRC script\skins\Kosmos
%ProgramFiles%\pIRC team\pIRC script\skins\linux
%ProgramFiles%\pIRC team\pIRC script\skins\MacOSX
%ProgramFiles%\pIRC team\pIRC script\skins\Ocean Theme
%ProgramFiles%\pIRC team\pIRC script\skins\Sun Flowers
%ProgramFiles%\pIRC team\pIRC script\skins\XPOlive
%ProgramFiles%\pIRC team\pIRC script\skins\XPSilver
%ProgramFiles%\pIRC team\pIRC script\skins\XRLuna
%ProgramFiles%\pIRC team\pIRC script\sounds
%ProgramFiles%\pIRC team\pIRC script\sys
%ProgramFiles%\pIRC team\pIRC script\sys\ico
%ProgramFiles%\pIRC team\pIRC script\sys\img
%ProgramFiles%\pIRC team\pIRC script\sys\slap
%ProgramFiles%\pIRC team\pIRC script\sys\sounds

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	131,072 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cha
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chat
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Application
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ifexec
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Topic
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Application
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\ifexec
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Topic
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pIRC script 2.2
HKEY_CURRENT_USER\Software\Microsoft\Microsoft Agent
HKEY_CURRENT_USER\Software\mIRC
HKEY_CURRENT_USER\Software\mIRC\LastRun

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cha]

(Default) = "ChatFile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chat]

(Default) = "ChatFile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Topic]

(Default) = "Connect"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ifexec]

(Default) = "%1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Application]

(Default) = "mIRC"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec]

(Default) = "%1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\command]

(Default) = ""%ProgramFiles%\pirc team\pirc script\mirc.exe" -noconnect"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\DefaultIcon]

(Default) = ""%ProgramFiles%\pirc team\pirc script\mirc.exe""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile]

(Default) = "Chat File"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Topic]

(Default) = "Connect"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\ifexec]

(Default) = "%1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Application]

(Default) = "mIRC"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec]

(Default) = "%1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\command]

(Default) = ""%ProgramFiles%\pirc team\pirc script\mirc.exe" -noconnect"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\DefaultIcon]

(Default) = ""%ProgramFiles%\pirc team\pirc script\mirc.exe""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc]

(Default) = "URL:IRC Protocol"
EditFlags = 02 00 00 00
URL Protocol = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC]

DisplayName = "mIRC"
UninstallString = ""%ProgramFiles%\pirc team\pirc script\mirc.exe" -uninstall"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pIRC script 2.2]

DisplayName = "pIRC script 2.2"
DisplayIcon = "%ProgramFiles%\pIRC team\pIRC script\Uninstall.exe"
UninstallString = "%ProgramFiles%\pIRC team\pIRC script\Uninstall.exe"
NoModify = 0x00000001
NoRepair = 0x00000001

[HKEY_CURRENT_USER\Software\Microsoft\Microsoft Agent]

VoiceEnabled = 0x00000001
UseVoiceTips = 0x00000001
KeyHoldHotKey = 0x00000091
UseBeepSRPrompt = 0x00000001
SRTimerDelay = 0x000007D0
SRModeID = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
EnableSpeaking = 0x00000001
UseBalloon = 0x00000001
UseCharacterFont = 0x00000001
UseSoundEffects = 0x00000001
SpeakingSpeed = 0x00000005
PropertySheetX = 0x000F423F
PropertySheetY = 0x000F423F
PropertySheetWidth = 0x00000000
PropertySheetHeight = 0x00000000
PropertySheetPage = 0x00000000
CommandsWindowLeft = 0xFFFFFFFF
CommandsWindowTop = 0xFFFFFFFF
CommandsWindowWidth = 0x000000C8
CommandsWindowHeight = 0x000000C8
CommandsWindowLocationSet = 0x00000000

[HKEY_CURRENT_USER\Software\mIRC\LastRun]

(Default) = "1337633143,0"

Other details

Analysis of the file resources indicate the following possible country of origin:

United Kingdom

There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:

%ProgramFiles%\pirc team\pirc script\mirc.exe

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.