ThreatExpert Report: Packed.Vmpbad!gen1, Generic-FAAF!E42E433C55D8, Mal/Behav-363

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 20 September 2012, 21:43:57
Processing time: 7 min 58 sec
Submitted sample:

File MD5: 0xE42E433C55D8E4FD03405B3300D115D0
File SHA-1: 0x3BA2FCAF5F997203C9531C108FEDA081F253F961
Filesize: 388,026 bytes
Alias & packer info:

Packed.Vmpbad!gen1 [Symantec]
Generic-FAAF!E42E433C55D8 [McAfee]
Mal/Behav-363 [Sophos]
packed with: PE_Patch [Kaspersky Lab]

Technical Details:

File System Modifications

The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	388,026 bytes	MD5: 0xE42E433C55D8E4FD03405B3300D115D0 SHA-1: 0x3BA2FCAF5F997203C9531C108FEDA081F253F961	Packed.Vmpbad!gen1 [Symantec] Generic-FAAF!E42E433C55D8 [McAfee] Mal/Behav-363 [Sophos] packed with PE_Patch [Kaspersky Lab]

The following directory was created:

%System%\WinCmder

Note:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	1,032,192 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
HKEY_CURRENT_USER\NetSubKey

Other details

Analysis of the file resources indicate the following possible country of origin:

China

The following Host Names were requested from a host database:

192.5.5.241
zhanglisheng28.3322.org

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
zhanglisheng28.3322.org	10086

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 10086:

00000000 | 586A 6A68 6A1C 0100 009C 0100 0078 9C4B | Xjjhj........x.K
00000010 | 0B5F 5A38 8781 8181 1588 1981 5883 8B81 | ._Z8........X...
00000020 | 8109 4807 A716 9565 26A7 2A04 2426 672B | ..H....e&.*.$&g+
00000030 | 1831 2040 9C28 4346 9410 9809 52AF A066 | .1 @.(CF....R..f
00000040 | C1F0 91A3 1EC8 B17C 36A1 E6E4 AA86 1A88 | .......|6.......
00000050 | 3281 0821 8619 4075 1C40 F609 D689 3512 | 2..!..@u.@....5.
00000060 | 0744 1938 982D 1802 816C 0DA0 9E5C 20CD | .D.8.-...l...\ .
00000070 | 0694 EB83 8A37 00D9 6742 9716 6E00 B241 | .....7..gB..n..A
00000080 | 8009 6C01 23D0 8EC6 9AED DC10 BB40 B638 | ..l.#........@.8
00000090 | FBFB 0684 86B8 06F9 39FA BA32 1007 6A14 | ........9..2..j.
000000A0 | 80C4 8EE7 3A87 0F1C 5D77 E8F1 C63D 074F | ....:...]w...=.O
000000B0 | 2B32 3044 F82E 2D3C 0396 1685 2BF4 7017 | +20D..-<....+.p.
000000C0 | 65F0 8986 F80D E466 0720 1F24 0B72 33C8 | e......f. .$.r3.
000000D0 | 7D20 3783 E436 A85B 3018 581A 5A32 A85A | } 7..6.[0.X.Z2.Z
000000E0 | 30A4 305A C0F5 5700 F92B 8074 0390 6689 | 0.0Z..W..+.t..f.
000000F0 | 7762 00F9 05C4 FFF9 8F81 4186 C102 EC27 | wb........A....'
00000100 | 5058 1F01 6236 84B5 0C8C 60DF 8180 0503 | PX..b6....`.....
00000110 | 0F23 44CD 0920 0600 97FF 4343           | .#D.. ....CC

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.