Packed MD5 22999be88c94259fbcd612d71053b337 
Priority
First 04/05/2008 
Last 08/27/2008 
Count 15 
History 15 hits: 04-05 to 08-27 
Unpacked MD5 eda205697139d0a006a66d099efc2034  
AV Hits 31 
AV Count 32 
CC Servers 85.114.143.208:65520 210.245.211.11:65520 
DNS Lookups HK:proxim.ircgalaxy.pl RU:moscow-advokat.ru DE:proxim.ircgalaxy.pl :dl2.teenpassage.com SE:ced.dal.net :lulea.se.eu.undernet.org :washington.dc.us.undernet.org NL:london.uk.eu.undernet.org NL:diemen.nl.eu.undernet.org :flanders.be.eu.undernet.org :caen.fr.eu.undernet.org SE:broadway.ny.us.dal.net SE:ozbytes.dal.net :los-angeles.ca.us.undernet.org SE:qis.md.us.dal.net SE:vancouver.dal.net :brussels.be.eu.undernet.org :gaspode.zanet.org.za SE:viking.dal.net US:lia.zanet.net SE:coins.dal.net 
Failed Connects RU:194.6.222.11:6667 HK:210.245.211.11:65520 DE:85.114.143.208:65520 DE:85.114.137.60:65520 
AV Name AhnLab-V3:Virut.D, AntiVir:Virut.Gen, Authentium:Korgo.S, Avast:_Korgo-S, AVG:Virut, BitDefender:Padobot.N, CAT-QuickHeal:Virut.D, ClamAV:Virut.ii, DrWeb:Virut.5, eSafe:Virut.gen, eTrust-Vet:Virut.9276, Ewido:Padobot.n, FileAdvisor:MISSED, Fortinet:Virut.E, F-Prot:Korgo.S, F-Secure:Horst.gen33, Ikarus:Korgo.N, Kaspersky:Virut.n, McAfee:Virut.gen, Microsoft:Virut.AK, NOD32v2:Virut.E, Norman:Korgo.U, Panda:Virutas.G, Prevx1:MISSED, Rising:Virut.GEN, Sophos:Vetor-A, Sunbelt:MISSED, Symantec:Virut.B, TheHacker:Virut.F, VBA32:Virut.3, VirusBuster:Korgo.U, Webwasher-Gateway:Virut.Gen  
WinXP Files accwiz.exe, actmovie.exe, agentsvr.exe, ahui.exe, alg.exe, arp.exe, asr_fmt.exe, asr_ldm.exe, at.exe, atmadm.exe, attrib.exe, bootcfg.exe, bootok.exe, bootvrfy.exe, cacls.exe, calc.exe, charmap.exe, chkdsk.exe, chkntfs.exe, cidaemon.exe, cipher.exe, cisvc.exe, ckcnv.exe, cleanmgr.exe, cliconfg.exe, clipbrd.exe, clipsrv.exe, cmd.exe, cmdl32.exe, cmmon32.exe, cmstp.exe, compact.exe, comp.exe, comrepl.exe, conime.exe, control.exe, convert.exe, cscript.exe, ctfmon.exe, dcomcnfg.exe, ddeshare.exe, defrag.exe, dfrgfat.exe, dfrgntfs.exe, diantz.exe, diskpart.exe, diskperf.exe, dllhost.exe, dllhst3g.exe, dmadmin.exe, dmremote.exe, doskey.exe, dplaysvr.exe, dpnsvr.exe, dpvsetup.exe, driverquery.exe, drwtsn32.exe, dumprep.exe, dvdplay.exe, dvdupgrd.exe, dxdiag.exe, esentutl.exe, eudcedit.exe, eventcreate.exe, eventtriggers.exe, eventvwr.exe, expand.exe, extrac32.exe, fc.exe, find.exe, findstr.exe, finger.exe, fixmapi.exe, fontview.exe, forcedos.exe, freecell.exe, fsutil.exe, ftp.exe, ftpupd.exe, getmac.exe, gpresult.exe, gpupdate.exe, grpconv.exe, HelpCtr.exe, help.exe, HelpHost.exe, HelpSvc.exe, hh.exe, hostname.exe, ie4uinit.exe, iexpress.exe, imapi.exe, ipconfig.exe, ipsec6.exe, ipv6.exe, ipxroute.exe, label.exe, laxlq.exe, lights.exe, lnkstub.exe, locator.exe, lodctr.exe, logagent.exe, logman.exe, logoff.exe, logon.scr, logonui.exe, lpq.exe, lpr.exe, magnify.exe, makecab.exe, migload.exe, migpwd.exe, migwiz_a.exe, migwiz.exe, mmc.exe, mnmsrvc.exe, mobsync.exe, mofcomp.exe, mountvol.exe, mplay32.exe, mpnotify.exe, mqbkup.exe, mqsvc.exe, mqtgsvc.exe, mrinfo.exe, msconfig.exe, msdtc.exe, msg.exe, mshearts.exe, mshta.exe, msiexec.exe, msoobe.exe, mspaint.exe, msswchx.exe, mstinit.exe, mstsc.exe, narrator.exe, nbtstat.exe, nddeapir.exe, net1.exe, netdde.exe, net.exe, netsetup.exe, netsh.exe, netstat.exe, NOTEPAD.EXE, notiflag.exe, nppagent.exe, nslookup.exe, ntbackup.exe, ntsd.exe, ntvdm.exe, nwscript.exe, odbcad32.exe, odbcconf.exe, oobebaln.exe, openfiles.exe, osk.exe, osuninst.exe, packager.exe, pathping.exe, pentnt.exe, perfmon.exe, ping6.exe, ping.exe, print.exe, progman.exe, proquota.exe, proxycfg.exe, qappsrv.exe, qprocess.exe, qwinsta.exe, rasautou.exe, rasdial.exe, rasphone.exe, rcimlby.exe, rcp.exe, rdpclip.exe, rdsaddin.exe, rdshost.exe, recover.exe, relog.exe, replace.exe, reset.exe, rexec.exe, route.exe, routemon.exe, rsh.exe, rsm.exe, rsmsink.exe, rsmui.exe, rsnotify.exe, rsopprov.exe, rstrui.exe, rsvp.exe, rtcshare.exe, runas.exe, rundll32.exe, runonce.exe, rwinsta.exe, savedump.exe, scardsvr.exe, sc.exe, schtasks.exe, scrcons.exe, scrnsave.scr, sdbinst.exe, secedit.exe, sessmgr.exe, sethc.exe, setup.exe, sfc.exe, shadow.exe, shmgrate.exe, shrpubw.exe, shutdown.exe, sigverif.exe, skeys.exe, smlogsvc.exe, sndrec32.exe, sndvol32.exe, sol.exe, sort.exe, spider.exe, srdiag.exe, ss3dfo.scr, ssbezier.scr, ssflwbox.scr, ssmarque.scr, ssmypics.scr, ssmyst.scr, sspipes.scr, ssstars.scr, sstext3d.scr, stimon.exe, subst.exe, syncapp.exe, syskey.exe, sysocmgr.exe, systeminfo.exe, systray.exe, taskkill.exe, tasklist.exe, taskman.exe, taskmgr.exe, tcmsetup.exe, tcpsvcs.exe, telnet.exe, tftp.exe, tlntadmn.exe, tlntsess.exe, tlntsvr.exe, tourstart.exe, tracerpt.exe, tracert6.exe, tracert.exe, tscon.exe, tscupgrd.exe, tsdiscon.exe, tskill.exe, tsshutdn.exe, twunk_32.exe, typeperf.exe, unlodctr.exe, unsecapp.exe, UploadM.exe, upnpcont.exe, ups.exe, userinit.exe, usrmlnka.exe, usrprbda.exe, usrshuta.exe, utilman.exe, verifier.exe, vssadmin.exe, vssvc.exe, w32tm.exe, wbemtest.exe, wextract.exe, wiaacmgr.exe, winhlp32.exe, winmgmt.exe, winmine.exe, winmsd.exe, winver.exe, wmiadap.exe, wmiapsrv.exe, wmic.exe, wmiprvse.exe, wmpstub.exe, wpabaln.exe, wpnpinst.exe, write.exe, wscript.exe, wuauclt.exe, wupdmgr.exe, xcopy.exe, bstfi.exe, yfjyal.exe, ziacvnnu.exe, grgco.exe, cpytbl.exe, qgahzl.exe, xdpydfto.exe, ddgarxa.exe, aibuwnwy.exe, qncuq.exe, qpnno.exe  
WinXP Processes CMD.EXE, CSRSS.EXE, EXPLORER.EXE, laxlq.exe, LSASS.EXE, MSMSGS.EXE, SERVICES.EXE, SPOOLSV.EXE, SVCHOST.EXE, WINLOGON.EXE, bstfi.exe, yfjyal.exe, ziacvnnu.exe, grgco.exe, cpytbl.exe, qgahzl.exe, xdpydfto.exe, ddgarxa.exe, aibuwnwy.exe, qncuq.exe, qpnno.exe  
WinXP Registries HKEY_LOCAL_MACHINE@...Microsoft\Wireless, HKEY_LOCAL_MACHINE@...Microsoft\\Wireless  
WinXP Ports 113, 3067, 4940, 1032, 1000, 2136, 1947, 2951, 3540, 5744, 8150, 325, 5971, 3639, 6235, 738, 4076  
Win-2Kf Files  
Win-2Kf Processes  
Win-2Kf Registries  
Win-2Kf Ports  
Create Events  
Create Files  
Create RegKeys .exe,System Update,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,ID,Client 
Open RegKeys System Update,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Software\Microsoft\Wireless,ID,Client 
Service Starts  
Service Deletes  
Service Creates  
Cluster  
Cluster Confidence  
Packer ID1 PolyEnE 
Packer ID2  
Embedded DNS qis.md.us.dal.net, ced.dal.net, viking.dal.net, vancouver.dal.net, ozbytes.dal.net, broadway.ny.us.dal.net, coins.dal.net, lulea.se.eu.undernet.org, diemen.nl.eu.undernet.org, gaspode.zanet.org.za, lia.zanet.net, london.uk.eu.undernet.org, washington.dc.us.undernet.org, los-angeles.ca.us.undernet.org, brussels.be.eu.undernet.org, caen.fr.eu.undernet.org, flanders.be.eu.undernet.org, graz.at.eu.undernet.org, moscow-advokat.ru  
String Count 154 
String Link text
String MD5 f95ca0b993457f913d4f842c24660a3a 
Timerange 365 Days 
Unpack Status good (unpacked : 0 : Unpacking Provided Binary. (Code,Data) = (63.84%, 12.40%)) 
Countries
Unpacked Link eda2056971 [0
Callgraph ASM:Graph 
API Resolution 100% 
Comment none