Packed MD5 8a759550333dd50078381b0e536bee02 
Priority
First 06/10/2009 
Last 10/18/2009 
Count  
History  
Unpacked MD5 2bf3e548b9e94774852639b3e260a928  
AV Hits 29 28 12 25 
AV Count 32 
CC Servers 121.12.116.142:65520 114.80.101.21:65520 114.80.101.21:65520 121.12.116.142:65520 218.93.205.30:65520 218.93.205.23:65520 91.212.220.156:65520 221.5.74.39:65520 
DNS Lookups CN:proxim.ircgalaxy.pl US:microsoft.com DE:dl2.guarddog2009.com :www.google.com :upr15may.com GB:zz-dns.com CN:goasi.cn CN:lometr.pl CN:brenz.pl CN:dl.guarddog2009.com CN:gidromash.cn :dretis.cn CN:ottopay.cn CN:dretis.cn CN:www.brans.pl EU:gidromash.cn 
Failed Connects EU:91.207.61.180:80 CN:211.95.79.6:80 CN:211.95.79.170:80 CN:218.93.205.19:80 US:64.235.53.208:80 EU:91.212.220.156:65520 CN:221.5.74.39:65520 CN:218.93.205.30:65520 114.80.101.21:65520 EU:91.206.201.39:80 
AV Name AhnLab-V3:MISSED, AntiVir:Virut.Gen, Authentium:Virut.AI!Generic, Avast:_JunkPoly, AVG:MISSED, BitDefender:Gen_Heur.GM.0006022800, CAT-QuickHeal:MISSED, ClamAV:MISSED, DrWeb:Virut.56, eSafe:Virut, eTrust-Vet:MISSED, Ewido:MISSED, FileAdvisor:MISSED, Fortinet:PossibleThreat, F-Prot:Virut.AI!Generic, F-Secure:MISSED, Ikarus:Koobface, Kaspersky:Virut.ce, McAfee:MISSED, Microsoft:Virut.gen!O, NOD32v2:MISSED, Norman:MISSED, Panda:Sality.AO, Prevx1:MISSED, Rising:Virut.bm, Sophos:MalHckPk-A, Sunbelt:MISSED, Symantec:Virut.CF, TheHacker:MISSED, VBA32:MISSED, VirusBuster:Virut.Y.Gen, Webwasher-Gateway:MISSED  
WinXP Files 010112010146118114.dat, 010112010146118114.lso, accwiz.exe, actmovie.exe, agentsvr.exe, ahui.exe, alg.exe, arp.exe, asr_fmt.exe, asr_ldm.exe, at.exe, atmadm.exe, attrib.exe, bootcfg.exe, bootok.exe, bootvrfy.exe, cacls.exe, calc.exe, charmap.exe, chkdsk.exe, chkntfs.exe, cidaemon.exe, cipher.exe, cisvc.exe, ckcnv.exe, cleanmgr.exe, cliconfg.exe, clipbrd.exe, clipsrv.exe, cmdl32.exe, cmmon32.exe, cmstp.exe, compact.exe, comp.exe, comrepl.exe, conime.exe, control.exe, convert.exe, cscript.exe, ctfmon.exe, dcomcnfg.exe, ddeshare.exe, defrag.exe, dfrgfat.exe, dfrgntfs.exe, diantz.exe, diskpart.exe, diskperf.exe, dllhost.exe, dllhst3g.exe, dmadmin.exe, dmremote.exe, doskey.exe, dplaysvr.exe, dpnsvr.exe, dpvsetup.exe, driverquery.exe, drwtsn32.exe, dumprep.exe, dvdplay.exe, dvdupgrd.exe, dxdiag.exe, esentutl.exe, eudcedit.exe, eventcreate.exe, eventtriggers.exe, eventvwr.exe, expand.exe, extrac32.exe, fc.exe, find.exe, findstr.exe, finger.exe, fixmapi.exe, fontview.exe, forcedos.exe, freecell.exe, fsutil.exe, ftp.exe, getmac.exe, gpresult.exe, gpupdate.exe, grpconv.exe, HelpCtr.exe, help.exe, HelpHost.exe, HelpSvc.exe, hh.exe, hostname.exe, ie4uinit.exe, iexpress.exe, imapi.exe, ipconfig.exe, ipsec6.exe, ipv6.exe, ipxroute.exe, label.exe, lights.exe, lnkstub.exe, locator.exe, lodctr.exe, logagent.exe, logman.exe, logoff.exe, logon.scr, logonui.exe, lpq.exe, lpr.exe, magnify.exe, makecab.exe, migload.exe, migpwd.exe, migwiz_a.exe, migwiz.exe, mmc.exe, mnmsrvc.exe, mobsync.exe, mofcomp.exe, mountvol.exe, mplay32.exe, mpnotify.exe, mqbkup.exe, mqsvc.exe, mqtgsvc.exe, mrinfo.exe, msconfig.exe, msdtc.exe, msg.exe, mshearts.exe, mshta.exe, msiexec.exe, msoobe.exe, mspaint.exe, msswchx.exe, mstinit.exe, mstsc.exe, narrator.exe, nbtstat.exe, nddeapir.exe, net1.exe, netdde.exe, net.exe, netsetup.exe, netsh.exe, netstat.exe, NOTEPAD.EXE, notiflag.exe, nppagent.exe, nslookup.exe, ntbackup.exe, ntsd.exe, ntvdm.exe, nwscript.exe, odbcad32.exe, odbcconf.exe, oobebaln.exe, openfiles.exe, osk.exe, osuninst.exe, packager.exe, pathping.exe, pentnt.exe, perfmon.exe, ping6.exe, ping.exe, print.exe, progman.exe, proquota.exe, proxycfg.exe, qappsrv.exe, qprocess.exe, qwinsta.exe, rasautou.exe, rasdial.exe, rasphone.exe, rcimlby.exe, rcp.exe, rdpclip.exe, rdsaddin.exe, rdshost.exe, recover.exe, relog.exe, replace.exe, reset.exe, rexec.exe, ro_1199986936.exe, route.exe, routemon.exe, rsh.exe, rsm.exe, rsmsink.exe, rsmui.exe, rsnotify.exe, rsopprov.exe, rstrui.exe, rsvp.exe, rtcshare.exe, runas.exe, rundll32.exe, runonce.exe, rwinsta.exe, savedump.exe, scardsvr.exe, sc.exe, schtasks.exe, scrcons.exe, scrnsave.scr, sdbinst.exe, secedit.exe, sessmgr.exe, sethc.exe, setup.exe, sfc.exe, shadow.exe, shmgrate.exe, shrpubw.exe, shutdown.exe, sigverif.exe, skeys.exe, smlogsvc.exe, sndrec32.exe, sndvol32.exe, sol.exe, sort.exe, spider.exe, srdiag.exe, ss3dfo.scr, ssbezier.scr, ssflwbox.scr, ssmarque.scr, ssmypics.scr, ssmyst.scr, sspipes.scr, ssstars.scr, sstext3d.scr, stimon.exe, subst.exe, SVCHOST.EXE, syncapp.exe, syskey.exe, sysocmgr.exe, systeminfo.exe, systray.exe, taskkill.exe, tasklist.exe, taskman.exe, taskmgr.exe, tcmsetup.exe, tcpsvcs.exe, telnet.exe, tftp.exe, tlntadmn.exe, tlntsess.exe, tlntsvr.exe, tourstart.exe, tracerpt.exe, tracert6.exe, tracert.exe, tscon.exe, tscupgrd.exe, tsdiscon.exe, tskill.exe, tsshutdn.exe, twunk_32.exe, typeperf.exe, unlodctr.exe, unsecapp.exe, UploadM.exe, upnpcont.exe, ups.exe, userinit.exe, usrmlnka.exe, usrprbda.exe, usrshuta.exe, utilman.exe, verifier.exe, vssadmin.exe, vssvc.exe, w32tm.exe, wbemtest.exe, wextract.exe, wiaacmgr.exe, winhlp32.exe, winmgmt.exe, winmine.exe, winmsd.exe, winver.exe, wmiadap.exe, wmiapsrv.exe, wmic.exe, wmiprvse.exe, wmpstub.exe, wpabaln.exe, wpnpinst.exe, write.exe, wscript.exe, wuauclt.exe, wupdmgr.exe, xcopy.exe, smss.exe, 2.tmp, 3.tmp  
WinXP Processes CMD.EXE, CSRSS.EXE, DLLHOST.EXE, EXPLORER.EXE, ld10.exe, LSASS.EXE, MSMSGS.EXE, SERVICES.EXE, SPOOLSV.EXE, SVCHOST.EXE, WINLOGON.EXE  
WinXP Registries HKEY_USERS@...Explorer\Navigating, HKEY_USERS@...Navigating\.Current, HKEY_USERS@...Navigating\.Default, HKEY_LOCAL_MACHINE@...Microsoft\\DownloadManager  
WinXP Ports 1031, 1035, 1035, 8085, 1034, 1040, 1037, 1036  
Win-2Kf Files  
Win-2Kf Processes  
Win-2Kf Registries  
Win-2Kf Ports  
Create Events  
Create Files  
Create RegKeys  
Open RegKeys SOFTWARE\Microsoft\Updates\Windows 2000\SP5\KB823980,SOFTWARE\Microsoft\Updates\Windows XP\SP1\KB823980,SOFTWARE\Microsoft\Updates\Windows XP\SP2\KB823980 
Service Starts RpcPatch 
Service Deletes RpcPatch,RpcTftpd 
Service Creates  
Cluster  
Cluster Confidence  
Packer ID1 ASProtect 
Packer ID2  
Embedded DNS  
String Count 81 
String Link text
String MD5 44926503ef0b75a14cdb2930659e3dbc 
Timerange 365 Days 
Unpack Status unknown (unpacked : 0 : Unpacking Provided Binary. (Code,Data) = (48.39%, 32.92%)) 
Countries
Unpacked Link  
Callgraph  
API Resolution  
Comment none