ThreatExpert Report: P2P-Worm.Win32.Palevo

Technical Details:

File System Modifications

The following files were created in the system:

Filename(s)

File Size

File Hash

Alias

%Temp%\WINDOWS\TEMP\00000000.TXT

631 bytes

MD5: 0x99C59410B60F8710534A4F993500E690
SHA-1: 0xF87379532C242247CC0E5066ABD2875A247B2BCB

(not available)

%Temp%\WINDOWS\TEMP\00000000.ZIP

138,158 bytes

MD5: 0x5587182FFC1C2ADDCEE9DAED89A6C22C
SHA-1: 0xB0BE425A493D0265717397F6749B89106BD223AB

P2P-Worm.Win32.Palevo

[Ikarus]

%Temp%\WINDOWS\TEMP\NSD336.tmp

1,368 bytes

MD5: 0x67C66FA4567FE61CBE39224DF66E91A2
SHA-1: 0x7AED1FD0B1E9A1BD30F75FD4464C59E7E0A532B0

(not available)

[file and pathname of the sample #1]

137,527 bytes

MD5: 0xDBEE5936E24C23D24D9EF69997EA07A4
SHA-1: 0x766B930727D31605EDADD7B4AFC44EB76FF3957C

P2P-Worm.Win32.Palevo

[Ikarus]

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

The following directories were created:

%Temp%\WINDOWS
%Temp%\WINDOWS\TEMP

Other details

The following Host Name was requested from a host database:

192.5.5.241

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Submission Summary:

Technical Details: