Packed MD5 16874933ea3e8939720fd4d16e70c6c4 
Priority
First 06/18/2008 
Last 06/30/2008 
Count 12 
History 12 hits: 06-18 to 06-30 
Unpacked MD5 16874933ea3e8939720fd4d16e70c6c4  
AV Hits 29 33 
AV Count 32 
CC Servers  
DNS Lookups US:microsoft.com US:download.microsoft.com :proxim.ircgalaxy.pl HK:proxim.ircgalaxy.pl 
Failed Connects US:192.221.110.125:80 US:205.128.79.126:80 US:8.12.202.125:80 US:64.62.216.10:80 US:64.62.216.56:80 US:199.93.41.124:80 US:199.93.44.126:80 US:207.123.37.126:80 US:204.160.126.126:80 US:207.123.46.126:80 US:72.247.30.81:80 US:72.247.30.83:80 US:192.221.110.126:80 US:199.93.41.126:80 US:199.93.46.125:80 US:12.190.48.97:80 US:192.221.99.124:80 US:12.190.48.65:80 HK:210.245.211.11:65520 
AV Name AhnLab-V3:Welchia.10240, AntiVir:Nachi.A.1, Authentium:Nachi.A, Avast:_Nachi, AVG:Virut, BitDefender:Welchia.A, CAT-QuickHeal:Nachi, ClamAV:Virut.da, DrWeb:Virut.5, eSafe:Virut.n, eTrust-Vet:Nachi.A, Ewido:Welchia.a, FileAdvisor:MISSED, Fortinet:MetaCrypt.7, F-Prot:Nachi.A, F-Secure:Suspicious_Malware!Gemini, Ikarus:Welchia.A, Kaspersky:Virut.n, McAfee:Nachi.a, Microsoft:Nachi.A, NOD32v2:Nachi.A, Norman:Virut.D, Panda:Virutas.G.dam, Prevx1:Worm, Rising:Welchia, Sophos:Nachi-A, Sunbelt:MISSED, Symantec:Virut.B, TheHacker:Nachi.A, VBA32:Welchia.a, VirusBuster:Virut.Gen, Webwasher-Gateway:Nachi.A.1  
WinXP Files accwiz.exe, actmovie.exe, agentsvr.exe, ahui.exe, alg.exe, arp.exe, asr_fmt.exe, asr_ldm.exe, at.exe, atmadm.exe, attrib.exe, bootcfg.exe, bootok.exe, bootvrfy.exe, cacls.exe, calc.exe, charmap.exe, chkdsk.exe, chkntfs.exe, cidaemon.exe, cipher.exe, cisvc.exe, ckcnv.exe, cleanmgr.exe, cliconfg.exe, clipbrd.exe, clipsrv.exe, cmdl32.exe, cmmon32.exe, cmstp.exe, compact.exe, comp.exe, comrepl.exe, conime.exe, control.exe, convert.exe, cscript.exe, ctfmon.exe, dcomcnfg.exe, ddeshare.exe, defrag.exe, dfrgfat.exe, dfrgntfs.exe, diantz.exe, diskpart.exe, diskperf.exe, dllhost.exe, dllhst3g.exe, dmadmin.exe, dmremote.exe, doskey.exe, dplaysvr.exe, dpnsvr.exe, dpvsetup.exe, driverquery.exe, drwtsn32.exe, dumprep.exe, dvdplay.exe, dvdupgrd.exe, dxdiag.exe, esentutl.exe, eudcedit.exe, eventcreate.exe, eventtriggers.exe, eventvwr.exe, expand.exe, extrac32.exe, fc.exe, find.exe, findstr.exe, finger.exe, fixmapi.exe, fontview.exe, forcedos.exe, freecell.exe, fsutil.exe, ftp.exe, getmac.exe, gpresult.exe, gpupdate.exe, grpconv.exe, HelpCtr.exe, help.exe, HelpHost.exe, HelpSvc.exe, hh.exe, hostname.exe, ie4uinit.exe, iexpress.exe, imapi.exe, ipconfig.exe, ipsec6.exe, ipv6.exe, ipxroute.exe, label.exe, lights.exe, lnkstub.exe, locator.exe, lodctr.exe, logagent.exe, logman.exe, logoff.exe, logon.scr, logonui.exe, lpq.exe, lpr.exe, magnify.exe, makecab.exe, migload.exe, migpwd.exe, migwiz_a.exe, migwiz.exe, mmc.exe, mnmsrvc.exe, mobsync.exe, mofcomp.exe, mountvol.exe, mplay32.exe, mpnotify.exe, mqbkup.exe, mqsvc.exe, mqtgsvc.exe, mrinfo.exe, msconfig.exe, msdtc.exe, msg.exe, mshearts.exe, mshta.exe, msiexec.exe, msoobe.exe, mspaint.exe, msswchx.exe, mstinit.exe, mstsc.exe, narrator.exe, nbtstat.exe, nddeapir.exe, net1.exe, netdde.exe, net.exe, netsetup.exe, netsh.exe, netstat.exe, NOTEPAD.EXE, notiflag.exe, nppagent.exe, nslookup.exe, ntbackup.exe, ntsd.exe, ntvdm.exe, nwscript.exe, odbcad32.exe, odbcconf.exe, oobebaln.exe, openfiles.exe, osk.exe, osuninst.exe, packager.exe, pathping.exe, pentnt.exe, perfmon.exe, ping6.exe, print.exe, progman.exe, proquota.exe, proxycfg.exe, qappsrv.exe, qprocess.exe, qwinsta.exe, rasautou.exe, rasdial.exe, rasphone.exe, rcimlby.exe, rcp.exe, rdpclip.exe, rdsaddin.exe, rdshost.exe, recover.exe, relog.exe, replace.exe, reset.exe, rexec.exe, routemon.exe, rsh.exe, rsm.exe, rsmsink.exe, rsmui.exe, rsnotify.exe, rsopprov.exe, rstrui.exe, rsvp.exe, rtcshare.exe, runas.exe, rundll32.exe, runonce.exe, rwinsta.exe, savedump.exe, scardsvr.exe, schtasks.exe, scrcons.exe, scrnsave.scr, sdbinst.exe, secedit.exe, sessmgr.exe, sethc.exe, sfc.exe, shadow.exe, shmgrate.exe, shrpubw.exe, shutdown.exe, sigverif.exe, skeys.exe, smlogsvc.exe, sndrec32.exe, sndvol32.exe, sol.exe, sort.exe, spider.exe, srdiag.exe, ss3dfo.scr, ssbezier.scr, ssflwbox.scr, ssmarque.scr, ssmypics.scr, ssmyst.scr, sspipes.scr, ssstars.scr, sstext3d.scr, stimon.exe, subst.exe, SVCHOST.EXE, syncapp.exe, syskey.exe, sysocmgr.exe, systeminfo.exe, systray.exe, taskkill.exe, tasklist.exe, taskman.exe, taskmgr.exe, tcmsetup.exe, tcpsvcs.exe, telnet.exe, tftp.exe, tlntadmn.exe, tlntsess.exe, tlntsvr.exe, tourstart.exe, tracerpt.exe, tracert6.exe, tracert.exe, tscon.exe, tscupgrd.exe, tsdiscon.exe, tskill.exe, tsshutdn.exe, twunk_32.exe, typeperf.exe, unlodctr.exe, unsecapp.exe, UploadM.exe, upnpcont.exe, ups.exe, userinit.exe, usrmlnka.exe, usrprbda.exe, usrshuta.exe, utilman.exe, verifier.exe, vssadmin.exe, vssvc.exe, w32tm.exe, wbemtest.exe, wextract.exe, wiaacmgr.exe, winhlp32.exe, winmgmt.exe, winmine.exe, winmsd.exe, winver.exe, wmiadap.exe, wmiapsrv.exe, wmic.exe, wmiprvse.exe, wmpstub.exe, wpabaln.exe, wpnpinst.exe, write.exe, wuauclt.exe, wupdmgr.exe, xcopy.exe  
WinXP Processes CMD.EXE, CSRSS.EXE, DLLHOST.EXE, EXPLORER.EXE, LSASS.EXE, MSMSGS.EXE, SERVICES.EXE, SPOOLSV.EXE, SVCHOST.EXE, WINLOGON.EXE, defrag.exe, DfrgFat.exe  
WinXP Registries HKEY_LOCAL_MACHINE@...Microsoft\\DownloadManager  
WinXP Ports 1031, 707, 1034, 69  
Win-2Kf Files  
Win-2Kf Processes DLLHOST.EXE  
Win-2Kf Registries HKEY_LOCAL_MACHINE@...Filelist\\0, HKEY_LOCAL_MACHINE@...Filelist\\1, HKEY_LOCAL_MACHINE@...Filelist\\2, HKEY_LOCAL_MACHINE@...Filelist\\3, HKEY_LOCAL_MACHINE@...Filelist\\4, HKEY_LOCAL_MACHINE@...Filelist\\5, HKEY_LOCAL_MACHINE@...HotFix\\KB823980, HKEY_LOCAL_MACHINE@...KB823980\\File1, HKEY_LOCAL_MACHINE@...KB823980\\Filelist, HKEY_LOCAL_MACHINE@...Microsoft\\DownloadManager, HKEY_LOCAL_MACHINE@...Microsoft\\Updates, HKEY_LOCAL_MACHINE@...SP5\\KB823980, HKEY_LOCAL_MACHINE@...Updates\\Windows2000, HKEY_LOCAL_MACHINE@...Windows2000\\SP5, HKEY_USERS@...InternetSettings\\5.0, HKEY_USERS@...InternetSettings\\Connections  
Win-2Kf Ports  
Create Events  
Create Files  
Create RegKeys  
Open RegKeys  
Service Starts  
Service Deletes  
Service Creates  
Cluster  
Cluster Confidence  
Packer ID1 PolyEnE 
Packer ID2  
Embedded DNS  
String Count 82 
String Link text
String MD5 55eb271203ac5ba297bc08cd2b494a95 
Timerange 365 Days 
Unpack Status good (unpacked : 1 : Already Unpacked. (Code,Data) = (71.03%, 22.14%)) 
Countries
Unpacked Link 16874933ea [1
Callgraph ASM:Graph 
API Resolution 48% 
Comment none