Packed MD5	4c3df24b32325cc41e8ac6e8300bf6c8
Priority	38
First	06/17/2008
Last	08/27/2008
Count	177
History	177 hits: 06-17 to 08-27
Unpacked MD5	4c3df24b32325cc41e8ac6e8300bf6c8
AV Hits	0 30
AV Count	32
CC Servers	210.245.211.11:65520
DNS Lookups	HK:proxima.ircgalaxy.pl US:microsoft.com US:download.microsoft.com DE:dl2.teenpassage.com PL:proxima.ircgalaxy.pl US:ksn.a1001186.wrs.mcboo.com
Failed Connects	US:208.111.148.152:80 US:208.111.148.174:80 HK:210.245.211.11:65520 US:64.215.166.173:80 US:64.215.166.190:80 US:208.111.173.42:80 US:205.128.79.124:80 US:207.123.37.126:80 US:4.23.60.125:80 US:199.93.53.125:80 US:192.221.99.124:80 US:199.93.46.125:80 US:205.128.79.126:80 US:199.93.41.126:80 US:4.23.60.126:80 US:208.111.173.51:80 US:8.12.202.125:80 DE:85.114.141.207:80 US:199.93.53.126:80 US:207.123.46.126:80 US:199.93.46.124:80 US:204.160.126.126:80 US:207.123.44.125:80 US:72.247.30.83:80 US:208.111.148.23:80 US:198.78.220.126:80 US:205.128.66.124:80 US:199.93.44.126:80 US:207.123.47.126:80 DE:85.114.143.2:80 US:208.111.148.219:80 US:199.93.44.124:80 US:207.123.42.126:80 US:208.111.148.115:80 US:12.190.48.97:80 US:199.93.41.124:80 US:204.160.126.124:80 US:208.111.173.52:80 US:206.33.45.125:80 US:208.111.148.247:80 US:8.12.222.126:80 US:208.111.148.15:80 US:69.28.178.10:80 US:208.111.148.254:80 US:208.111.153.215:80 US:192.221.110.126:80 US:198.78.201.126:80 US:208.111.173.47:80 US:192.221.99.126:80 US:64.62.216.73:80 US:64.62.216.83:80 US:205.128.66.126:80 US:205.128.79.125:80 PL:195.78.66.134:65520 US:204.2.133.57:80 US:204.2.133.73:80 US:208.111.148.43:80 US:208.111.148.226:80 US:208.111.173.53:80 US:208.111.148.108:80 US:199.93.46.126:80 US:207.123.37.125:80 US:64.62.216.10:80 US:64.62.216.56:80 US:72.247.30.81:80 US:12.190.48.65:80 US:204.160.104.126:80 US:207.123.46.125:80 US:208.111.148.69:80 US:208.111.148.149:80 US:198.78.220.124:80
AV Name	AhnLab-V3:Virut, AntiVir:Virut.A, Authentium:Virut.4960, Avast:_Nachi, AVG:Virut.A, BitDefender:Welchia.A, CAT-QuickHeal:Virut.A, ClamAV:Virut.A, DrWeb:Virut, eSafe:Virut.a, eTrust-Vet:Virut.5127, Ewido:MISSED, FileAdvisor:MISSED, Fortinet:Virut.A, F-Prot:Virut.4960, F-Secure:Suspicious_Malware!Gemini, Ikarus:Virut.a, Kaspersky:Virut.a, McAfee:Virut.a, Microsoft:Virut.A, NOD32v2:Virut.5127, Norman:Virut.A, Panda:Virutas.B, Prevx1:MISSED, Rising:Virut.az, Sophos:Virut-T, Sunbelt:MISSED, Symantec:Virut.A, TheHacker:Virut.gen, VBA32:Virut.A, VirusBuster:Virut.Gen.4, Webwasher-Gateway:Virut.A
WinXP Files	DLLHOST.EXE, SVCHOST.EXE, catdb, dberr.txt, edb.log, KB823980.log, ole32.dll, rpcrt4.dll, rpcss.dll, setupapi.log, spmsg.dll, TimeStamp, tmp.edb, xpsp1hfm.exe, xpsp1hfm.log, accwiz.exe, actmovie.exe, agentsvr.exe, ahui.exe, alg.exe, arp.exe, asr_fmt.exe, asr_ldm.exe, at.exe, atmadm.exe, attrib.exe, bootcfg.exe, bootok.exe, bootvrfy.exe, cacls.exe, calc.exe, charmap.exe, chkdsk.exe, chkntfs.exe, cidaemon.exe, cipher.exe, cisvc.exe, ckcnv.exe, cleanmgr.exe, cliconfg.exe, clipbrd.exe, clipsrv.exe, cmdl32.exe, cmmon32.exe, cmstp.exe, compact.exe, comp.exe, comrepl.exe, conime.exe, control.exe, convert.exe, cscript.exe, ctfmon.exe, dcomcnfg.exe, ddeshare.exe, defrag.exe, dfrgfat.exe, dfrgntfs.exe, diantz.exe, diskpart.exe, diskperf.exe, dllhost.exe, dllhst3g.exe, dmadmin.exe, dmremote.exe, doskey.exe, dplaysvr.exe, dpnsvr.exe, dpvsetup.exe, driverquery.exe, drwtsn32.exe, dumprep.exe, dvdplay.exe, dvdupgrd.exe, dxdiag.exe, esentutl.exe, eudcedit.exe, eventcreate.exe, eventtriggers.exe, eventvwr.exe, expand.exe, extrac32.exe, fc.exe, find.exe, findstr.exe, finger.exe, fixmapi.exe, fontview.exe, forcedos.exe, freecell.exe, fsutil.exe, ftp.exe, getmac.exe, gpresult.exe, gpupdate.exe, grpconv.exe, HelpCtr.exe, help.exe, HelpHost.exe, HelpSvc.exe, hh.exe, hostname.exe, ie4uinit.exe, iexpress.exe, imapi.exe, ipconfig.exe, ipsec6.exe, ipv6.exe, ipxroute.exe, label.exe, lights.exe, lnkstub.exe, locator.exe, lodctr.exe, logagent.exe, logman.exe, logoff.exe, logon.scr, logonui.exe, lpq.exe, lpr.exe, magnify.exe, makecab.exe, migload.exe, migpwd.exe, migwiz_a.exe, migwiz.exe, mmc.exe, mnmsrvc.exe, mobsync.exe, mofcomp.exe, mountvol.exe, mplay32.exe, mpnotify.exe, mqbkup.exe, mqsvc.exe, mqtgsvc.exe, mrinfo.exe, msconfig.exe, msdtc.exe, msg.exe, mshearts.exe, mshta.exe, msiexec.exe, msoobe.exe, mspaint.exe, msswchx.exe, mstinit.exe, mstsc.exe, narrator.exe, nbtstat.exe, nddeapir.exe, net1.exe, netdde.exe, net.exe, netsetup.exe, netsh.exe, netstat.exe, NOTEPAD.EXE, notiflag.exe, nppagent.exe, nslookup.exe, ntbackup.exe, ntsd.exe, ntvdm.exe, nwscript.exe, odbcad32.exe, odbcconf.exe, oobebaln.exe, openfiles.exe, osk.exe, osuninst.exe, packager.exe, pathping.exe, pentnt.exe, perfmon.exe, ping6.exe, print.exe, progman.exe, proquota.exe, proxycfg.exe, qappsrv.exe, qprocess.exe, qwinsta.exe, rasautou.exe, rasdial.exe, rasphone.exe, rcimlby.exe, rcp.exe, rdpclip.exe, rdsaddin.exe, rdshost.exe, recover.exe, relog.exe, replace.exe, reset.exe, rexec.exe, routemon.exe, rsh.exe, rsm.exe, rsmsink.exe, rsmui.exe, rsnotify.exe, rsopprov.exe, rstrui.exe, rsvp.exe, rtcshare.exe, runas.exe, rundll32.exe, runonce.exe, rwinsta.exe, savedump.exe, scardsvr.exe, schtasks.exe, scrcons.exe, scrnsave.scr, sdbinst.exe, secedit.exe, sessmgr.exe, sethc.exe, sfc.exe, shadow.exe, shmgrate.exe, shrpubw.exe, shutdown.exe, sigverif.exe, skeys.exe, smlogsvc.exe, sndrec32.exe, sndvol32.exe, sol.exe, sort.exe, spider.exe, srdiag.exe, ss3dfo.scr, ssbezier.scr, ssflwbox.scr, ssmarque.scr, ssmypics.scr, ssmyst.scr, sspipes.scr, ssstars.scr, sstext3d.scr, stimon.exe, subst.exe, syncapp.exe, syskey.exe, sysocmgr.exe, systeminfo.exe, systray.exe, taskkill.exe, tasklist.exe, taskman.exe, taskmgr.exe, tcmsetup.exe, tcpsvcs.exe, telnet.exe, tftp.exe, tlntadmn.exe, tlntsess.exe, tlntsvr.exe, tourstart.exe, tracerpt.exe, tracert6.exe, tracert.exe, tscon.exe, tscupgrd.exe, tsdiscon.exe, tskill.exe, tsshutdn.exe, twunk_32.exe, typeperf.exe, unlodctr.exe, unsecapp.exe, UploadM.exe, upnpcont.exe, ups.exe, userinit.exe, usrmlnka.exe, usrprbda.exe, usrshuta.exe, utilman.exe, verifier.exe, vssadmin.exe, vssvc.exe, w32tm.exe, wbemtest.exe, wextract.exe, wiaacmgr.exe, winhlp32.exe, winmgmt.exe, winmine.exe, winmsd.exe, winver.exe, wmiadap.exe, wmiapsrv.exe, wmic.exe, wmiprvse.exe, wmpstub.exe, wpabaln.exe, wpnpinst.exe, write.exe, wuauclt.exe, wupdmgr.exe, xcopy.exe, , TFTP1104
WinXP Processes	CMD.EXE, CSRSS.EXE, DLLHOST.EXE, EXPLORER.EXE, LSASS.EXE, MSMSGS.EXE, SERVICES.EXE, SPOOLSV.EXE, SVCHOST.EXE, WINLOGON.EXE, defrag.exe, DfrgFat.exe
WinXP Registries	HKEY_LOCAL_MACHINE@...Microsoft\\DownloadManager, HKEY_LOCAL_MACHINE@...Filelist\\0, HKEY_LOCAL_MACHINE@...Filelist\\1, HKEY_LOCAL_MACHINE@...Filelist\\2, HKEY_LOCAL_MACHINE@...Filelist\\3, HKEY_LOCAL_MACHINE@...Filelist\\4, HKEY_LOCAL_MACHINE@...Filelist\\5, HKEY_LOCAL_MACHINE@...HotFix\\KB823980, HKEY_LOCAL_MACHINE@...KB823980\\File1, HKEY_LOCAL_MACHINE@...KB823980\\Filelist, HKEY_LOCAL_MACHINE@...Microsoft\\Updates, HKEY_LOCAL_MACHINE@...SP1\\KB823980, HKEY_LOCAL_MACHINE@...Updates\\WindowsXP, HKEY_LOCAL_MACHINE@...WindowsXP\\SP1
WinXP Ports	1031, 707, 1034, 69, 1035, 1036, 1037, 1028
Win-2Kf Files
Win-2Kf Processes	DLLHOST.EXE
Win-2Kf Registries	HKEY_LOCAL_MACHINE@...Microsoft\\DownloadManager, HKEY_USERS@...InternetSettings\\5.0, HKEY_USERS@...InternetSettings\\Connections, HKEY_LOCAL_MACHINE@...Filelist\\0, HKEY_LOCAL_MACHINE@...Filelist\\1, HKEY_LOCAL_MACHINE@...Filelist\\2, HKEY_LOCAL_MACHINE@...Filelist\\3, HKEY_LOCAL_MACHINE@...Filelist\\4, HKEY_LOCAL_MACHINE@...Filelist\\5, HKEY_LOCAL_MACHINE@...HotFix\\KB823980, HKEY_LOCAL_MACHINE@...KB823980\\File1, HKEY_LOCAL_MACHINE@...KB823980\\Filelist, HKEY_LOCAL_MACHINE@...Microsoft\\Updates, HKEY_LOCAL_MACHINE@...SP5\\KB823980, HKEY_LOCAL_MACHINE@...Updates\\Windows2000, HKEY_LOCAL_MACHINE@...Windows2000\\SP5
Win-2Kf Ports	1027, 707, 1031, 69, 1035, 135, 1033, 1039, 1028
Create Events
Create Files
Create RegKeys
Open RegKeys
Service Starts
Service Deletes
Service Creates
Cluster
Cluster Confidence
Packer ID1	tElock
Packer ID2
Embedded DNS
String Count	81
String Link	text
String MD5	44926503ef0b75a14cdb2930659e3dbc
Timerange	365 Days
Unpack Status	good (unpacked : 1 : Already Unpacked. (Code,Data) = (85.89%, 7.90%))
Countries	4
Unpacked Link	none[4] 4c3df24b32[1]
Callgraph	none:noneASM:Graph
API Resolution	47%
Comment	none