ThreatExpert Report

Technical Details:

File System Modifications

The following files were created in the system:

Filename(s)

File Size

File Hash

%Temp%\background.html

7,371 bytes

MD5: 0x0B21B30F0D1B0CA61450242FECF388F9
SHA-1: 0x00658E8A1ADA5D2C8650CC697B7343A8D782D812

%Temp%\gmail_tools.zip

15,251 bytes

MD5: 0xE669909FB03830A36408B78AE4C8C4B5
SHA-1: 0xA265AA320307A032E2A270D998EDE6E01B8387AD

%Temp%\images\gmail-extension-128.png

5,735 bytes

MD5: 0xFAD8D5E5A10B47E163A44D5A457BD8CB
SHA-1: 0xD1428B8B1E60DE39A07A2F5DA5A22B4A90D1E54F

%Temp%\images\gmail-extension-16.png

640 bytes

MD5: 0x5E64EAE46D949DB1FA53B30B01E852BD
SHA-1: 0x2C2A46D217B988A409D27340353692BE35C18238

%Temp%\images\gmail-extension-19.png

810 bytes

MD5: 0x5D35DEFC5D661B5E9C330291EFE97A91
SHA-1: 0xEF653679849400C273630EA3465F692450E3F776

%Temp%\images\gmail-extension-32.png

1,458 bytes

MD5: 0x7CC9ED34A1430A18BE262FBA86EA5C7F
SHA-1: 0x89D582D212740E9BFD9D20AB6F4D2856CDE339E7

%Temp%\images\gmail-extension-64.png

3,256 bytes

MD5: 0xD00307D82AD9F04145215DED7DDBFD13
SHA-1: 0x4FAACFF3D8B5C1A6415BE8AF7B7EF6E421B26BE8

%Temp%\infopasser.js

391 bytes

MD5: 0x8373FE54B48FC924FE53C9FD74A56481
SHA-1: 0x027EE618F1F7961B6B739E3973CFF5A0AEE7BEA3

%Temp%\mailto.js

1,987 bytes

MD5: 0x83093D2C3B50CAFC4E27B17FF400A104
SHA-1: 0xFD4B1EBDA60EF9BAAB42EC534051147DEF001145

%Temp%\manifest.json

1,294 bytes

MD5: 0x3D121DE0F9A7003578A499E52CC5CC4E
SHA-1: 0x98F8F2287C857E14FC73488CA93D8CA6D59BCAA1

%Temp%\options.html

2,644 bytes

MD5: 0xFAADB0C9E1BCC636147AD8EBBBD56C76
SHA-1: 0x041B9675F9361B33E561971EB3DB71EA620B99B6

[file and pathname of the sample #1]

34,138 bytes

MD5: 0xDD864CABA98DAFB220C8F15734663005
SHA-1: 0xC72FAB4344BDE89AD1ADAD2731838FD39D7A7D4A

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

The following directory was created:

%Temp%\images

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Submission Summary:

Technical Details: