Packed MD5 9bb68450cdaad8713b49ce7204512bdc 
Priority 12 
First 06/10/2009 
Last 11/03/2009 
Count  
History  
Unpacked MD5 c2d5ac23153a26d637eeb3165de524cc  
AV Hits 34 
AV Count 32 
CC Servers 121.12.116.142:65520 213.219.245.212:80 213.219.245.212:80 218.93.205.30:65520 213.219.245.212:80 91.212.220.156:65520 221.5.74.39:65520 213.219.245.212:80 91.212.220.75:65520 218.93.205.30:65520 213.219.245.212:80 91.121.221.157:65520 213.219.245.212:80 218.93.205.24:65520 
DNS Lookups CN:proxim.ircgalaxy.pl RU:citi-bank.ru FR:proxim.ircgalaxy.pl CN:gidromash.cn EU:proxim.ircgalaxy.pl EU:sleepatnight.cn 
Failed Connects RU:213.219.245.212:80 CN:221.5.74.39:65520 CN:218.93.205.24:65520 CN:218.93.205.30:65520 EU:91.212.220.156:65520 CN:121.12.116.142:65520 FR:91.121.221.157:65520 
AV Name AhnLab-V3:Virut, AntiVir:Virut.AT, Authentium:Virut.AG, Avast:_Virut, AVG:Korgo.A, BitDefender:Padobot.BV.Dam, CAT-QuickHeal:Virut.Y, ClamAV:Virut.ca, DrWeb:Lsabot, eSafe:MISSED, eTrust-Vet:Virut.6640, Ewido:Padobot.m, FileAdvisor:MISSED, Fortinet:Virut.AT, F-Prot:Virut.AG, F-Secure:Virut.n, Ikarus:Padobot.M, Kaspersky:Virut.n, McAfee:Virut.gen.a, Microsoft:Korgo.V, NOD32v2:MISSED, Norman:Virut.D, Panda:Virutas.AH, Prevx1:MISSED, Rising:Virut.al, Sophos:Virut-L, Sunbelt:MISSED, Symantec:Virut.W, TheHacker:Virut.f, VBA32:Virut.2, VirusBuster:Padobot.D, Webwasher-Gateway:MISSED  
WinXP Files accwiz.exe, actmovie.exe, agentsvr.exe, ahui.exe, alg.exe, arp.exe, asr_fmt.exe, asr_ldm.exe, at.exe, atmadm.exe, attrib.exe, bootcfg.exe, bootok.exe, bootvrfy.exe, cacls.exe, calc.exe, charmap.exe, chkdsk.exe, chkntfs.exe, cidaemon.exe, cipher.exe, cisvc.exe, ckcnv.exe, cleanmgr.exe, cliconfg.exe, clipbrd.exe, clipsrv.exe, cmd.exe, cmdl32.exe, cmmon32.exe, cmstp.exe, compact.exe, comp.exe, comrepl.exe, conime.exe, control.exe, convert.exe, cscript.exe, ctfmon.exe, dcomcnfg.exe, ddeshare.exe, defrag.exe, dfrgfat.exe, dfrgntfs.exe, diantz.exe, diskpart.exe, diskperf.exe, dllhost.exe, dllhst3g.exe, dmadmin.exe, dmremote.exe, doskey.exe, dplaysvr.exe, dpnsvr.exe, dpvsetup.exe, driverquery.exe, drwtsn32.exe, dumprep.exe, dvdplay.exe, dvdupgrd.exe, dxdiag.exe, esentutl.exe, eudcedit.exe, eventcreate.exe, eventtriggers.exe, eventvwr.exe, expand.exe, extrac32.exe, fc.exe, find.exe, findstr.exe, finger.exe, fixmapi.exe, fontview.exe, forcedos.exe, freecell.exe, fsutil.exe, ftp.exe, ftpupd.exe, getmac.exe, gpresult.exe, gpupdate.exe, grpconv.exe, HelpCtr.exe, help.exe, HelpHost.exe, HelpSvc.exe, hh.exe, hostname.exe, ie4uinit.exe, iexpress.exe, imapi.exe, ipconfig.exe, ipsec6.exe, ipv6.exe, ipxroute.exe, label.exe, lights.exe, lnkstub.exe, locator.exe, lodctr.exe, logagent.exe, logman.exe, logoff.exe, logon.scr, logonui.exe, lpq.exe, lpr.exe, magnify.exe, makecab.exe, migload.exe, migpwd.exe, migwiz_a.exe, migwiz.exe, mmc.exe, mnmsrvc.exe, mobsync.exe, mofcomp.exe, mountvol.exe, mplay32.exe, mpnotify.exe, mqbkup.exe, mqsvc.exe, mqtgsvc.exe, mrinfo.exe, msconfig.exe, msdtc.exe, msg.exe, mshearts.exe, mshta.exe, msiexec.exe, msoobe.exe, mspaint.exe, msswchx.exe, mstinit.exe, mstsc.exe, narrator.exe, nbtstat.exe, nddeapir.exe, net1.exe, netdde.exe, net.exe, netsetup.exe, netsh.exe, netstat.exe, NOTEPAD.EXE, notiflag.exe, nppagent.exe, nslookup.exe, ntbackup.exe, ntsd.exe, ntvdm.exe, nwscript.exe, odbcad32.exe, odbcconf.exe, oobebaln.exe, openfiles.exe, osk.exe, osuninst.exe, packager.exe, pathping.exe, pentnt.exe, perfmon.exe, ping6.exe, ping.exe, print.exe, progman.exe, proquota.exe, proxycfg.exe, qappsrv.exe, qkqwert.exe, qprocess.exe, qwinsta.exe, rasautou.exe, rasdial.exe, rasphone.exe, rcimlby.exe, rcp.exe, rdpclip.exe, rdsaddin.exe, rdshost.exe, recover.exe, relog.exe, replace.exe, reset.exe, rexec.exe, route.exe, routemon.exe, rsh.exe, rsm.exe, rsmsink.exe, rsmui.exe, rsnotify.exe, rsopprov.exe, rstrui.exe, rsvp.exe, rtcshare.exe, runas.exe, rundll32.exe, runonce.exe, rwinsta.exe, savedump.exe, scardsvr.exe, sc.exe, schtasks.exe, scrcons.exe, scrnsave.scr, sdbinst.exe, secedit.exe, sessmgr.exe, sethc.exe, setup.exe, sfc.exe, shadow.exe, shmgrate.exe, shrpubw.exe, shutdown.exe, sigverif.exe, skeys.exe, smlogsvc.exe, sndrec32.exe, sndvol32.exe, sol.exe, sort.exe, spider.exe, srdiag.exe, ss3dfo.scr, ssbezier.scr, ssflwbox.scr, ssmarque.scr, ssmypics.scr, ssmyst.scr, sspipes.scr, ssstars.scr, sstext3d.scr, stimon.exe, subst.exe, syncapp.exe, syskey.exe, sysocmgr.exe, systeminfo.exe, systray.exe, taskkill.exe, tasklist.exe, taskman.exe, taskmgr.exe, tcmsetup.exe, tcpsvcs.exe, telnet.exe, tftp.exe, tlntadmn.exe, tlntsess.exe, tlntsvr.exe, tourstart.exe, tracerpt.exe, tracert6.exe, tracert.exe, tscon.exe, tscupgrd.exe, tsdiscon.exe, tskill.exe, tsshutdn.exe, twunk_32.exe, typeperf.exe, unlodctr.exe, unsecapp.exe, UploadM.exe, upnpcont.exe, ups.exe, userinit.exe, usrmlnka.exe, usrprbda.exe, usrshuta.exe, utilman.exe, verifier.exe, vssadmin.exe, vssvc.exe, w32tm.exe, wbemtest.exe, wextract.exe, wiaacmgr.exe, winhlp32.exe, winmgmt.exe, winmine.exe, winmsd.exe, winver.exe, wmiadap.exe, wmiapsrv.exe, wmic.exe, wmiprvse.exe, wmpstub.exe, wpabaln.exe, wpnpinst.exe, write.exe, wscript.exe, wuauclt.exe, wupdmgr.exe, xcopy.exe, fbrpku.exe, ldzvgqmp.exe, yajbps.exe, ielqiw.exe, jaipg.exe, vreoer.exe, imxlso.exe, lzjgu.exe, cdngk.exe, cuxejs.exe, toorlq.exe, ydlopn.exe, ygmru.exe, acqgwy.exe, gghaeccy.exe, quvfrv.exe, relvak.exe, lzlmd.exe, rhrbky.exe, lzfgrw.exe, nveelro.exe, qdntsyu.exe, wooush.exe, tcruo.exe, kbvbboj.exe, kcaptk.exe, eqmwr.exe, pzxgwl.exe, tkylcm.exe, lwktys.exe, tbtcfkgl.exe, kmgxw.exe, ptavd.exe, rgcrfj.exe, ocejbtq.exe, bgtynai.exe, xlnqswvx.exe, nibwp.exe, nvvop.exe, kxcelv.exe, svdvpudu.exe, hihjvx.exe, kvcnj.exe, fauie.exe, zlnnmx.exe, zmdko.exe, idqdyd.exe, zxaczv.exe, sxxtmtps.exe, zoryx.exe, opczs.exe, dvfmev.exe, xljlmhfi.exe  
WinXP Processes CMD.EXE, CSRSS.EXE, EXPLORER.EXE, LSASS.EXE, MSMSGS.EXE, qkqwert.exe, SERVICES.EXE, SPOOLSV.EXE, SVCHOST.EXE, WINLOGON.EXE, fbrpku.exe, ldzvgqmp.exe, jaipg.exe, vreoer.exe, lzjgu.exe, cdngk.exe, toorlq.exe, NTVDM.EXE, ygmru.exe, gghaeccy.exe, quvfrv.exe, lzlmd.exe, nveelro.exe, qdntsyu.exe, tcruo.exe, kbvbboj.exe, eqmwr.exe, pzxgwl.exe, tbtcfkgl.exe, kmgxw.exe, ptavd.exe, rgcrfj.exe, ocejbtq.exe, bgtynai.exe, xlnqswvx.exe, nibwp.exe, nvvop.exe, svdvpudu.exe, hihjvx.exe, kvcnj.exe, fauie.exe, zmdko.exe, idqdyd.exe, zxaczv.exe, sxxtmtps.exe, zoryx.exe, opczs.exe, xljlmhfi.exe  
WinXP Registries HKEY_LOCAL_MACHINE@...Microsoft\Wireless, HKEY_LOCAL_MACHINE@...Microsoft\\Wireless  
WinXP Ports 5328, 1037, 1983, 1032, 1307, 4932, 1051, 5393, 2742, 1038, 1048, 1853, 3367, 1056, 3123, 656, 3354, 4074, 1046, 5403, 1039, 4872, 1045, 2456, 2545, 636, 6394, 1041, 5345, 5900, 1451, 1057, 2546, 1485, 1040, 1883, 486, 3108, 5848, 4220, 4269, 3159, 7949, 5875, 6570, 7547, 1061, 2343, 7652, 3861, 4188, 3944, 1060, 1551, 5665, 5603  
Win-2Kf Files  
Win-2Kf Processes  
Win-2Kf Registries  
Win-2Kf Ports  
Create Events  
Create Files  
Create RegKeys Cryptographic Service,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,ID,Client 
Open RegKeys Cryptographic Service,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Software\Microsoft\Wireless,ID,Client 
Service Starts  
Service Deletes  
Service Creates  
Cluster  
Cluster Confidence  
Packer ID1 PolyEnE 
Packer ID2  
Embedded DNS proxim.ircgalaxy.pl  
String Count 73 
String Link text
String MD5 8c3304017324f5b45b3492d8609c66f6 
Timerange 365 Days 
Unpack Status unknown (unpacked : 0 : Unpacking Provided Binary. (Code,Data) = (53.70%, 27.98%)) 
Countries
Unpacked Link  
Callgraph  
API Resolution  
Comment none