ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 18 July 2012, 02:35:51
Processing time: 13 min 51 sec
Submitted sample:

File MD5: 0xC3E64D1EF8301B0BEC4CDDA8096CC0AB
File SHA-1: 0x27E4A881549E5E194315F3873DED397E820AB2EB
Filesize: 1,200,696 bytes

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%AppData%\Tuto4pc\Tuto4pc\Software.exe	714,600 bytes	MD5: 0xBAFD70094844D139B06091C2732AB6BF SHA-1: 0xD04A1359759BEEC320BC0850E7D662DABA0FB93E
2	%AppData%\Tuto4pc\Tuto4pc\SoftwareHP.exe	632,168 bytes	MD5: 0x254188437E381B8568CDA6D85BB2EAFB SHA-1: 0xD3248E3D769D6584C18A4F6DB3DB962CDAD7F127
3	%AppData%\Tuto4pc\Tuto4pc\user_config.cyp	216 bytes	MD5: 0x44B11D0F969ED49BE2EE38DF200B166D SHA-1: 0xBC4A2BA63A40D4354558A6594807AD735D7A7AB2
4	%AppData%\Tuto4pc\Tuto4pc\confmedia.cyp %ProgramFiles%\Tuto4pc\confmedia.cyp	2,712 bytes	MD5: 0x48E2C5D4BB3463D923BA39EAF27B8676 SHA-1: 0x9BF8A3FE7FB632957394E94873B06C58197D568D
5	%AppData%\Tuto4pc\Tuto4pc\user.cyp	152 bytes	MD5: 0x59F53D94D57C9D29D2AEEBC56D7AC17A SHA-1: 0x16A3A4916066B02DA6F6287958F7DD34FF96C53A
6	%Temp%\ins6.tmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709
7	%ProgramFiles%\Tuto4pc\tuto4pc.exe	910,184 bytes	MD5: 0xDF40DB7480BCE7D4A70C1E3A483E7469 SHA-1: 0x16AB51F648B0A89A28643BF21B058F2304A0D3BE
8	%ProgramFiles%\Tuto4pc\Tuto4pcBHO.dll	228,200 bytes	MD5: 0x8E3E3F0CCDAB894A6EE1DEE3AA156848 SHA-1: 0x23A794EEDC943C7CEECA307F2F6060861F8019B4
9	%ProgramFiles%\Tuto4pc\unins000.dat	8,385 bytes	MD5: 0xF49B1FFDC6EAD2FAFC68B57729014AA5 SHA-1: 0x2D242CFBCF617D315B90003C760E1AC4C3DA34DE
10	%ProgramFiles%\Tuto4pc\unins000.exe	718,312 bytes	MD5: 0xFBF442FAE7358C29FA93219BDED8F464 SHA-1: 0x73DDB9B1A26F8A82436916F924CFCF204D38219C
11	[file and pathname of the sample #1]	1,200,696 bytes	MD5: 0xC3E64D1EF8301B0BEC4CDDA8096CC0AB SHA-1: 0x27E4A881549E5E194315F3873DED397E820AB2EB

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

The following directories were created:

%AppData%\Tuto4pc
%AppData%\Tuto4pc\Tuto4pc
%ProgramFiles%\Tuto4pc

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
webinstall.exe	%Temp%\is-D67OE.tmp\Tuto4PC\webinstall.exe	1,097,728 bytes
software.exe	%AppData%\tuto4pc\tuto4pc\software.exe	733,184 bytes
softwarehp.exe	%AppData%\tuto4pc\tuto4pc\softwarehp.exe	659,456 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	81,920 bytes
tuto4pc.exe	%ProgramFiles%\Tuto4pc\tuto4pc.exe	933,888 bytes
[filename of the sample #1 without extension].tmp	%Temp%\is-3QJ62.tmp\[filename of the sample #1 without extension].tmp	770,048 bytes
setup_tuto4pc.exe	%Temp%\is-D67OE.tmp\Tuto4PC\setup_tuto4pc.exe	81,920 bytes
setup_tuto4pc.tmp	%Temp%\is-BOH88.tmp\setup_tuto4pc.tmp	770,048 bytes
[generic host process]	[generic host process filename]	20,480 bytes
derniere_etape.exe	%Temp%\is-D67OE.tmp\Tuto4PC\derniere_etape.exe	348,160 bytes

Notes:

[generic host process filename] is a full path filename of [generic host process].

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\Tuto4CPBHO.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C1C897CB-9D37-4462-8B23-14103A392372}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB720781-0670-4e46-B82E-376AEF228F25}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB720781-0670-4e46-B82E-376AEF228F25}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB720781-0670-4e46-B82E-376AEF228F25}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB720781-0670-4e46-B82E-376AEF228F25}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB720781-0670-4e46-B82E-376AEF228F25}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB720781-0670-4e46-B82E-376AEF228F25}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FAF4F3A-F47E-422F-9679-D2B2D721AB2D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FAF4F3A-F47E-422F-9679-D2B2D721AB2D}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FAF4F3A-F47E-422F-9679-D2B2D721AB2D}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FAF4F3A-F47E-422F-9679-D2B2D721AB2D}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39E273A-65B6-4D07-BF9D-3EF640505C47}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39E273A-65B6-4D07-BF9D-3EF640505C47}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39E273A-65B6-4D07-BF9D-3EF640505C47}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39E273A-65B6-4D07-BF9D-3EF640505C47}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39E273A-65B6-4D07-BF9D-3EF640505C47}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39E273A-65B6-4D07-BF9D-3EF640505C47}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tuto4PCBHO.T4PCBHO
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tuto4PCBHO.T4PCBHO\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tuto4PCBHO.T4PCBHO\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tuto4PCBHO.T4PCBHO.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tuto4PCBHO.T4PCBHO.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AB720781-0670-4e46-B82E-376AEF228F25}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tuto4pc_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Tuto4pc
HKEY_LOCAL_MACHINE\SOFTWARE\Tuto4pc\Tuto4pc
HKEY_CURRENT_USER\Software\Tuto4PC
HKEY_CURRENT_USER\Software\Tuto4PC\UpdateTuto4PC

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\Tuto4CPBHO.DLL]

AppID = "{C1C897CB-9D37-4462-8B23-14103A392372}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C1C897CB-9D37-4462-8B23-14103A392372}]

(Default) = "Tuto4CPBHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB720781-0670-4e46-B82E-376AEF228F25}\VersionIndependentProgID]

(Default) = "Tuto4PC.T4PCBHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB720781-0670-4e46-B82E-376AEF228F25}\TypeLib]

(Default) = "{{D39E273A-65B6-4d07-BF9D-3EF640505C47}}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB720781-0670-4e46-B82E-376AEF228F25}\ProgID]

(Default) = "Tuto4PCBHO.T4PCBHO.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB720781-0670-4e46-B82E-376AEF228F25}\InprocServer32]

(Default) = "%ProgramFiles%\Tuto4pc\Tuto4pcBHO.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB720781-0670-4e46-B82E-376AEF228F25}]

(Default) = "T4PCBHO Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FAF4F3A-F47E-422F-9679-D2B2D721AB2D}\TypeLib]

(Default) = "{D39E273A-65B6-4D07-BF9D-3EF640505C47}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FAF4F3A-F47E-422F-9679-D2B2D721AB2D}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FAF4F3A-F47E-422F-9679-D2B2D721AB2D}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0FAF4F3A-F47E-422F-9679-D2B2D721AB2D}]

(Default) = "IT4PCBHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39E273A-65B6-4D07-BF9D-3EF640505C47}\1.0\0\win32]

(Default) = "%ProgramFiles%\Tuto4pc\Tuto4pcBHO.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39E273A-65B6-4D07-BF9D-3EF640505C47}\1.0\HELPDIR]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39E273A-65B6-4D07-BF9D-3EF640505C47}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39E273A-65B6-4D07-BF9D-3EF640505C47}\1.0]

(Default) = "T4PCEngineBHO 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tuto4PCBHO.T4PCBHO\CurVer]

(Default) = "Tuto4PCBHO.T4PCBHO.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tuto4PCBHO.T4PCBHO\CLSID]

(Default) = "{AB720781-0670-4e46-B82E-376AEF228F25}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tuto4PCBHO.T4PCBHO]

(Default) = "T4PCBHO Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tuto4PCBHO.T4PCBHO.1\CLSID]

(Default) = "{AB720781-0670-4e46-B82E-376AEF228F25}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tuto4PCBHO.T4PCBHO.1]

(Default) = "T4PCBHO Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AB720781-0670-4e46-B82E-376AEF228F25}]

(Default) = "T4PCBHO"
NoExplorer = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

Tuto4pc = "%ProgramFiles%\Tuto4pc\tuto4pc.exe"
UpdateTuto4PCHP = "%AppData%\Tuto4pc\Tuto4pc\SoftwareHP.exe"

so that tuto4pc.exe runs every time Windows starts

so that SoftwareHP.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tuto4pc_is1]

Inno Setup: Setup Version = "5.4.3 (a)"
Inno Setup: App Path = "%ProgramFiles%\Tuto4pc"
InstallLocation = "%ProgramFiles%\Tuto4pc\"
Inno Setup: Icon Group = "Tuto4PC"
Inno Setup: User = "%UserName%"
Inno Setup: Language = "fr"
DisplayName = "Tuto4pc 1.0"
UninstallString = ""%ProgramFiles%\Tuto4pc\unins000.exe""
QuietUninstallString = ""%ProgramFiles%\Tuto4pc\unins000.exe" /SILENT"
Publisher = "Tuto4pc"
URLInfoAbout = "http://www.tuto4pc.com"
HelpLink = "http://www.tuto4pc.com"
URLUpdateInfo = "http://www.tuto4pc.com"
NoModify = 0x00000001
NoRepair = 0x00000001
InstallDate = "20120718"

[HKEY_LOCAL_MACHINE\SOFTWARE\Tuto4pc\Tuto4pc]

PathInstall = "%ProgramFiles%\Tuto4pc"

[HKEY_LOCAL_MACHINE\SOFTWARE\Tuto4pc]

HostGUID = "CA12183D-F03D-4AF6-B99A-F1E50AEED4EC"

[HKEY_CURRENT_USER\Software\Tuto4PC\UpdateTuto4PC]

MainDir = "%AppData%\Tuto4pc\Tuto4pc"
Version = "1.0.0.0"
SoftwareDir = "%AppData%\Tuto4pc\Tuto4pc\Software"

[HKEY_CURRENT_USER\Software\Tuto4PC]

LCID = 0x00000409

Other details

Analysis of the file resources indicate the following possible countries of origin:

	France
	Netherlands

To mark the presence in the system, the following Mutex object was created:

Tuto4PC

The following Internet Connections were established:

Server Name	Server Port	Connect as User	Connection Password
prof.tuto4pc.com	80	prof.tuto4pc.com	prof.tuto4pc.com
prof.tuto4pc.com	80	(null)	(null)
log.tuto4pc.com	80	(null)	(null)
ads.regiedepub.com	80	(null)	(null)

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.