ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 19 July 2012, 20:56:42
Processing time: 11 min 2 sec
Submitted sample:

File MD5: 0x3F95BE610F3C4E50E60CA8D58EE39614
File SHA-1: 0x858CC89178BBC30335CF3B466BC7F4FFDD957F69
Filesize: 61,505 bytes

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.

Technical Details:

File System Modifications

The following file was created in the system:

#	Filename(s)	File Size	File Hash
1	[file and pathname of the sample #1]	61,505 bytes	MD5: 0x3F95BE610F3C4E50E60CA8D58EE39614 SHA-1: 0x858CC89178BBC30335CF3B466BC7F4FFDD957F69

The following Alternate Data Stream was created in the system:

#	ADS name(s)	ADS Size	ADS Hash
1	%Windir%\system32:flashrplay.exe	61,505 bytes	MD5: 0x3F95BE610F3C4E50E60CA8D58EE39614 SHA-1: 0x858CC89178BBC30335CF3B466BC7F4FFDD957F69

Note:

%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Registry Modifications

The newly created Registry Value is:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

microsoft flashrplayer = "%Windir%\system32:flashrplay.exe"

Other details

Analysis of the file resources indicate the following possible countries of origin:

	China
	Turkey

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
175.41.138.162	80

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 80:

00000000 | 2A6C 5A95 92CD 5A3E B107 2FC2 4C86 546D | *lZ...Z>../.L.Tm
00000010 | 846A B26D CC76 E6AC 3ADA 7ABB 3EA2 D66B | .j.m.v..:.z.>..k
00000020 | 2F35 8921 1C3C 7429 96CC BF33 64BE 9F90 | /5.!.<t)...3d...
00000030 | 3F22 F1DB 8B27 D824 BBBC AB5A 846C 1B7E | ?"...'.$...Z.l.~
00000040 | C1D4 5B7E D6E3 0B40 C447 EACE 00A5 380A | ..[~...@.G....8.
00000050 | 0BF5 47DB E9D8 4265 BFB4 9014 001E 7452 | ..G...Be......tR
00000060 | 2069 6B26 33F6 8F9D 6B4B 691E BC69 757C |  ik&3...kKi..iu|
00000070 | ADDF 8CD0 CC00 C8AC 9574 1AAA 73A6 38D2 | .........t..s.8.
00000080 | 8661 4767 5F84 FF9C F042 0E10 8E67 00BC | .aGg_....B...g..
00000090 | 0888 76A3 39E6 E9BB B6D8 9F6F 57B5 0D23 | ..v.9......oW..#
000000A0 | FA8D A158 E1D0 1DAD E0BF BF33 08C1 09BE | ...X.......3....
000000B0 | 26F4 14C2 1E07 1D8B F82A 9CD5 F42A 6830 | &........*...*h0
000000C0 | 30DC B8D0 0AB5 67B6 9105 3984 7367 2650 | 0.....g...9.sg&P
000000D0 | 8749 519D D8D8 6DA5 557E 2A07 2F1D 6DB8 | .IQ...m.U~*./.m.
000000E0 | 2987 7DBE 8D2C 6F49 0835 FABF 110C A1B8 | ).}..,oI.5......
000000F0 | 2E7C 0191 4481 FAB3 0E01 7023 4644 2E31 | .|..D.....p#FD.1
00000100 | BD05 370F FF5C 2B59 ADF4 45DB 43CA 9AFB | ..7..\+Y..E.C...
00000110 | F22A 1020 EC72 BDDE 0B26 A07D 60B6 2D55 | .*. .r...&.}`.-U
00000120 | E1CF F454 23DE CFEA 7C55 1202 3BD1 F830 | ...T#...|U..;..0
00000130 | A451 D9E9 7C76 72E5 DBC8 F428 ABBB B3BF | .Q..|vr....(....
00000140 | 5D90 9CEC 82FC 3122 D3B8 A518 E171 771D | ].....1".....qw.
00000150 | 24C2 165F C300 3F0F FB89 246A A14D 13BD | $.._..?...$j.M..
00000160 | 5ACB A990 D423 CB06 6F71 ACFC FB58 7259 | Z....#..oq...XrY
00000170 | 304E C806 3E57 104A 9574 3047 AF29 BEC8 | 0N..>W.J.t0G.)..
00000180 | 4EBB 1165 903A 9EF2 4B6C D86B 6874 04FC | N..e.:..Kl.kht..
00000190 | AE79 9F8D 583A 66F2 209B 9E79 BEE2 8493 | .y..X:f. ..y....
000001A0 | F3E0 1D57 CEFC C64A 8D14 A7DE 572E 0BD1 | ...W...J....W...
000001B0 | D6FE ECB3 5606 8F83 2CBD 014E D53E BE36 | ....V...,..N.>.6
000001C0 | BF8C 0CEB B671 7B6F DC9F 9568 ABB7 EA3E | .....q{o...h...>
000001D0 | 49D9 1669 9C47 6CA8 9873 8D8D 432F 66B3 | I..i.Gl..s..C/f.
000001E0 | 5B05 DB8A C487 CAE5 7D2F A14F 0C02 3C86 | [.......}/.O..<.
000001F0 | 9048 5CD5 EC70 A38B 4172 2850 ECF6 D52A | .H\..p..Ar(P...*
00000200 | A4B3 8E89 7AAE 4298 05BE A1D7 B023 267F | ....z.B......#&.
00000210 | 5B05 DB8A C487 CAE5 7D2F A14F 0C02 3C86 | [.......}/.O..<.
00000220 | 9048 5CD5 EC70 A38B 4172 2850 ECF6 D52A | .H\..p..Ar(P...*
00000230 | A4B3 8E89 7AAE 4298 05BE A1D7 B023 267F | ....z.B......#&.
00000240 | 5B05 DB8A C487 CAE5 7D2F A14F 0C02 3C86 | [.......}/.O..<.
00000250 | 9048 5CD5 EC70 A38B 4172 2850 ECF6 D52A | .H\..p..Ar(P...*
00000260 | A4B3 8E89 7AAE 4298 05BE A1D7 B023 267F | ....z.B......#&.

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.