Submission Summary:

What's been foundSeverity Level
Downloads/requests other files from Internet.

 

Technical Details:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

 

File System Modifications

#Filename(s)File SizeFile HashAlias
1 %Temp%\AnvirHook61.dll 102,112 bytes MD5: 0x745F345E4AEC8A1C7ABC109C2B4910B4
SHA-1: 0x3BEC4BC0457A6BC95030D235095F8DD1A55FD3A6
(not available)
2 %Temp%\AnVirSet.exe 3,102,944 bytes MD5: 0xC9856A7FA939F253DB6572239FD878A6
SHA-1: 0x68B31E4451E1DA1778787DD0E196F72F5110B11A
packed with PE_Patch [Kaspersky Lab]
3 %Temp%\anvir_en.txt 40,285 bytes MD5: 0x3BB0C3D96716BCAD417CC086A8866A91
SHA-1: 0xA0E13C93FEDED2353DE94936FAA9E14AAEA9556A
(not available)
4 %Temp%\DealioToolbar-stub-1.exe 381,892 bytes MD5: 0x2853EEF5151FC42EFF1C6303EF14AE33
SHA-1: 0x23C15C61EBAC5159854C0E2FD2F25B5699BA49DE
(not available)
5 %Temp%\portable.txt 3,856 bytes MD5: 0xCBE3D467506691F319D7C1964C2AB7D5
SHA-1: 0xE6D6DE32C17FB85B1A9979C90108CF8FDEA837F6
(not available)
6 %Temp%\tweaker.exe 746,720 bytes MD5: 0x29E9C9F647D69845C70625F20B760B75
SHA-1: 0xFCB56682EC78856882A9D5F9489869F675AF5172
packed with PE_Patch.UPX [Kaspersky Lab]
7 %Temp%\tweaker.log 110 bytes MD5: 0xA16C5F0B04EAE76CD7A48BE4D590ACF2
SHA-1: 0x2FB045B8097910CBFDF624D89C6A856C5B83B1E3
(not available)
8 %Temp%\tweaker_en.lng 32,636 bytes MD5: 0x9E2C1405280817F750B1DCBD02AD14A6
SHA-1: 0x05BF9495E4B337BD9E753FAD20A9A57E6C5FEC0C
(not available)
9 %Temp%\tweaker_it.lng 36,020 bytes MD5: 0xC76315D23C69F6B5A6BAA5712FA68A47
SHA-1: 0x5BFACE695D57B7C2DCBF58977933869F970C45D5
(not available)
10 %Temp%\tweaker_ja.lng 32,650 bytes MD5: 0x9D9C124A0F3BCD3229B99932B373B830
SHA-1: 0x9A94BAE7E33BDF74A91D5AF819AB1C76A4AD3B69
(not available)
11 %Temp%\tweaker_ko.lng 31,283 bytes MD5: 0x20615D3D5CA1FC230FD7160BBB2AEED3
SHA-1: 0x17F45851EA50F6437260E36A80D813868CAE97F8
(not available)
12 %Temp%\tweaker_license.txt 18,349 bytes MD5: 0xFDAFC691AA5FB7F8E2A9E9521FEF771B
SHA-1: 0x1E492D0D7C3EA5C426D38EF46715FB6E30F9988E
(not available)
13 %Temp%\tweaker_pl.lng 33,404 bytes MD5: 0xBBD46D6005EC5B6F46A0BB2D2ECC7EDB
SHA-1: 0x8FD7DF54B4A46EAA9C236993156232B1BFCF9E01
(not available)
14 %Temp%\VirusTotalUpload.exe 69,632 bytes MD5: 0x913AD8736920259A14A4A6FE43F19824
SHA-1: 0xB19BFBDDA5542A710936675E13DEDDE02F613E82
(not available)
15 %Temp%\{5F9ADBE0-0AD2-41B1-995B-8FF45D7E6399}\0x0409.ini 6,187 bytes MD5: 0x26A9B54F250E00693773481B837E03CC
SHA-1: 0x554A407BF23984026785430E3BBDFFDD1285BE06
(not available)
16 %Temp%\{5F9ADBE0-0AD2-41B1-995B-8FF45D7E6399}\0x0809.ini 6,129 bytes MD5: 0x8DCF70A87218342DB9114FFA9392463B
SHA-1: 0xDE4B009966D3DA29E19CFECCFEA1ED4C0243CD09
(not available)
17 %Temp%\{5F9ADBE0-0AD2-41B1-995B-8FF45D7E6399}\1033.MST 3,584 bytes MD5: 0x9A42714E617D956C0F8B2C4619EE97E8
SHA-1: 0x6541AABE485322E2AD3BE665C28F3C88566D6161
(not available)
18 %Temp%\{5F9ADBE0-0AD2-41B1-995B-8FF45D7E6399}\Setup.INI 2,871 bytes MD5: 0x708130745FF84D7FCDEBECAFBB9910E5
SHA-1: 0x6EF3A8BFBD27D3365FD7A32D2FCE80ECA9040BE0
(not available)
19 %Temp%\{5F9ADBE0-0AD2-41B1-995B-8FF45D7E6399}\_ISMSIDEL.INI 393 bytes MD5: 0x77E55E4DDF1C738A3ADCFFAE2D40071A
SHA-1: 0x4F387DE9EAE55CD71B75ED4E3131BB804A0B4790
(not available)
20 [file and pathname of the sample #1] 3,397,512 bytes MD5: 0xC7573658EB7BA865E43A1B389D752139
SHA-1: 0xF2DA53DFE7A313C81E83BC87F660EB3DFCD0018D
(not available)

 

Memory Modifications

Process NameProcess FilenameMain Module Size
AnVirSet.exe%Temp%\anvirset.exe6,569,984 bytes
DealioToolbar-stub-1.exe%Temp%\dealiotoolbar-stub-1.exe372,736 bytes
tweaker.exe%Temp%\tweaker.exe2,170,880 bytes
VirusTotalUpload.exe%Temp%\virustotalupload.exe77,824 bytes

 

Registry Modifications

 

Other details

PortProtocolProcess
1051UDPdealiotoolbar-stub-1.exe (%Temp%\dealiotoolbar-stub-1.exe)
1053TCPdealiotoolbar-stub-1.exe (%Temp%\dealiotoolbar-stub-1.exe)

Remote HostPort Number
174.36.215.2080

 

 

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Copyright © 2014 ThreatExpert. All rights reserved.