ThreatExpert Report

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 7 August 2012, 06:12:59
Processing time: 14 min 10 sec
Submitted sample:

File MD5: 0xE0307F572491EE2D38281EBC80A06921
File SHA-1: 0xCBCA965155837C065E2090EB93CE5601066DA8A3
Filesize: 4,225,446 bytes

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%Temp%\0.ogg	11,158 bytes	MD5: 0x7A559D5D05136555FD0DFC49F53601B7 SHA-1: 0x24F8D63F43335F88E22EB7C2EF5E96D568A65B2F
2	%Temp%\1.ogg	12,145 bytes	MD5: 0x259E9BD77C3AA73FD8F91A38BE44D608 SHA-1: 0x119E20D95CDDF8BD19EB81AF40025DF459C6B736
3	%Temp%\10.exe	2,092,032 bytes	MD5: 0x10D082E15FD27BF943D2E4522FED7B4D SHA-1: 0xFC39090E8B8D00CB4ED594F36A261BF27E53EA88
4	%Temp%\15.exe	251,904 bytes	MD5: 0x3BD8453F34DD439897901094554737CA SHA-1: 0x061F90197EE2AC8D96A51490BCEFAF27576BB68E
5	%Temp%\16.exe	730,624 bytes	MD5: 0x2EC53C62B390523AADE7C5C67C3DBCB2 SHA-1: 0x865B1DBA046E00863EB54A36DCE54569B01D83D7
6	%Temp%\20.exe	730,624 bytes	MD5: 0xAB877E42F09DDBFEA6D7CE24D8E6C1E5 SHA-1: 0x9B36161E30168308652B7A1996C44DBA173DFB20
7	%Temp%\23.exe	730,624 bytes	MD5: 0x87BE1A310D97E7A06B0655BA5DB268DB SHA-1: 0x8383851FB016C436599246907B3AE87F280C7F3E
8	%Temp%\27.exe	764,077 bytes	MD5: 0x6532E75A998BF22683319ABCD7766752 SHA-1: 0x7937E13A40B7A85DB5ED08D571B8B15132809D8F
9	%Temp%\3.ogg	13,877 bytes	MD5: 0x2DDBAEE568E8CF775751E499D707EE51 SHA-1: 0x2E3F4B2C2E7A27C14A79BFCD678604A35532300C
10	%Temp%\4.ogg	18,897 bytes	MD5: 0xA300BE91EFD92C7F9508EE461C9EB6BB SHA-1: 0x4DAE9FAEE2C5556109DACDF9C91F07A37B3E7736
11	[file and pathname of the sample #1]	4,225,446 bytes	MD5: 0xE0307F572491EE2D38281EBC80A06921 SHA-1: 0xCBCA965155837C065E2090EB93CE5601066DA8A3

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
27.exe	%Temp%\27.exe	733,184 bytes
15.exe	%Temp%\15.exe	339,968 bytes
10.exe	%Temp%\10.exe	8,454,144 bytes
20.exe	%Temp%\20.exe	745,472 bytes

Other details

Analysis of the file resources indicate the following possible countries of origin:

	Sweden
	Netherlands

To mark the presence in the system, the following Mutex objects were created:

DirectSound DllMain mutex (0x0000009C)
DirectSound Administrator shared thread array (lock)
DirectSound DllMain mutex (0x000000C8)
DirectSound DllMain mutex (0x000000D4)
DirectSound DllMain mutex (0x0000024C)
DirectSound DllMain mutex (0x000003B4)
DirectSound DllMain mutex (0x000003C0)

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.