Packed MD5 51a03793ab794cee2e8b2398cc63a203 
Priority 3 
First 01/05/2012 
Last 02/09/2012 
Count  
History  
Unpacked MD5 429f7618d3cc2eecbc5a35d1dcdcf4e0  
AV Hits 37 
AV Count 32 
CC Servers  
DNS Lookups :gg.arrancar.org 
Failed Connects  
AV Name AhnLab-V3:Autorun.32256.D, AntiVir:TRCrypt.ULPM.Gen, Authentium:Backdoor2.DSTK, Avast:_Neeris-B, AVG:Generic.XFG, BitDefender:Peed.Gen, CAT-QuickHeal:AutoRun.tet, ClamAV:Crypt-106, DrWeb:IRC.Sdbot.4538, eSafe:MISSED, eTrust-Vet:IRCBot.EH, Ewido:MISSED, FileAdvisor:MISSED, Fortinet:IRCBot.B, F-Prot:Backdoor2.DSTK, F-Secure:SdBot.CNG, Ikarus:Neeris, Kaspersky:AutoRun.acig, McAfee:IRCbot.gen.b, Microsoft:Neeris.AN, NOD32v2:MISSED, Norman:Smalltroj.KANZ, Panda:TrjCI.A, Prevx1:MISSED, Rising:IRCbot.wyd, Sophos:SdBot-DKI, Sunbelt:MISSED, Symantec:Sdbot, TheHacker:MISSED, VBA32:AutoRun.uwt, VirusBuster:RBot.AEKD, Webwasher-Gateway:MISSED  
WinXP Files SVCHOST.EXE  
WinXP Processes CMD.EXE, csrsc.exe, CSRSS.EXE, dwwin.exe, EXPLORER.EXE, LSASS.EXE, MSMSGS.EXE, SERVICES.EXE, SPOOLSV.EXE, SVCHOST.EXE, WINLOGON.EXE  
WinXP Registries  
WinXP Ports 21950, 4500, 4501, 4502, 4503, 4504, 4505, 4506, 4507, 4508, 4509, 4510, 4511, 4512, 4513, 4514, 4515, 4516, 4517, 4518, 4519, 4520, 4521, 4522, 4523, 4524, 4525, 4526, 4527, 4528, 4529, 4530, 4531, 4532, 4533, 4534, 4535, 4536, 4537, 4538, 4539, 4540, 4541, 4542, 4543, 4544, 4545, 4546, 69, 22254, 3932, 3933, 3934, 3935, 3936, 3937, 3938, 3939, 3940, 3941, 3942, 3943, 3944, 3945, 3946, 3947, 3948, 3949, 3950, 3951, 3952, 3953, 3954, 3955, 3956, 3957, 3958, 3959, 3960, 3961, 3962, 3963, 3964, 3965, 3966, 3967, 3968, 3969, 3970, 3971, 3972, 3973, 3974, 3975, 3976, 3977, 3978, 3979, 3980, 3981, 3982, 3983, 3984, 3985, 3986, 3987, 3988, 3989, 3990, 3991, 3992, 3993, 3994, 3995, 3996, 3997, 3998, 3999, 4000, 4001, 4002, 4003, 4004, 4005, 4006, 4007, 4008, 4009, 4010, 4011, 22192, 4420, 4421, 4422, 4423, 4424, 4425, 4426, 4427, 4428, 4429, 4430, 4431, 4432, 4433, 4434, 4435, 4436, 4437, 4438, 4439, 4440, 4441, 4442, 4443, 4444, 4445, 4446, 4447, 4448, 4449, 4450, 4451, 4452, 4453, 4454, 4455, 4456, 4457, 4458, 4459, 4460, 4461, 4462, 4463, 4464, 4465, 4466, 4467, 4468, 4469, 4470, 4471, 4472, 4473, 4474, 4475, 4476, 4477, 4478, 4479, 4480, 4481, 4482, 4483, 4484, 4485, 4486, 4487, 4488, 1181, 1182, 1183, 1184, 1185, 1186, 1187, 1188, 1189, 1190, 1191, 1192, 1193, 1194, 1195, 1196, 1197, 1198, 1199, 1200, 1201, 1202, 1203, 1204, 1205, 1206, 1207, 1208, 1209, 1210, 1211, 22078, 20961, 4287, 4288, 4289, 4290, 4291, 4292, 4293, 4294, 4295, 4296, 4297, 4298, 4299, 4300, 4301, 4302, 4303, 4304, 4305, 4306, 4307, 4308, 4309, 4310, 4311, 4312, 4313, 4314, 4315, 4316, 4317, 4318, 4319, 4320, 4321, 4322, 4323, 4324, 4325, 4326, 4327, 4328, 4329, 4330, 4331  
Win-2Kf Files  
Win-2Kf Processes drwtsn32.exe, explorer.exe  
Win-2Kf Registries HKEY_USERS@...InternetSettings\5.0, HKEY_USERS@...InternetSettings\\5.0  
Win-2Kf Ports  
Create Events  
Create Files  
Create RegKeys  
Open RegKeys  
Service Starts  
Service Deletes  
Service Creates  
Cluster  
Cluster Confidence  
Packer ID1 none 
Packer ID2 none 
Embedded DNS  
String Count 546 
String Link text
String MD5 4a6c9c95f1793b13579d3e021163e795 
Timerange 365 Days 
Unpack Status unknown (unpacked : 0 : Unpacking Provided Binary. (Code,Data) = (63.45%, 12.98%)) 
Countries 2 
Unpacked Link  
Callgraph  
API Resolution  
Comment none