Antivirus scan for 404f1875b0cb77f7d44da202facf26cd7244e0e3895c94b6bb50e345b2f4f1b5 at 2015-10-27 03:14:10 UTC

ウイルス対策ソフト	結果	更新日
ALYac	Gen:Variant.Kazy.576405	20151027
AVG	Agent4.BFJR	20151026
AVware	Trojan.Win32.Agent.nnv (v)	20151027
Ad-Aware	Gen:Variant.Kazy.576405	20151027
Yandex	Worm.Agent!gYgcVHdTuEA	20151026
AhnLab-V3	Trojan/Win32.Agent	20151027
Antiy-AVL	Trojan/Win32.Agent	20151027
Arcabit	Trojan.Kazy.D8CB95	20151027
Avast	Win32:Evo-gen [Susp]	20151027
Avira (no cloud)	TR/Rogue.zxdv	20151027
Baidu-International	Worm.Win32.Agent.NNV	20151026
BitDefender	Gen:Variant.Kazy.576405	20151027
ClamAV	Win.Trojan.Agent-729839	20151027
Comodo	TrojWare.Win32.Agent.NVA	20151027
Cyren	W32/A-b2473c7f!Eldorado	20151027
DrWeb	Trojan.StartPage.55764	20151027
ESET-NOD32	Win32/Agent.NNV	20151027
Emsisoft	Gen:Variant.Kazy.576405 (B)	20151027
F-Prot	W32/A-b2473c7f!Eldorado	20151027
F-Secure	Gen:Variant.Kazy.576405	20151027
Fortinet	W32/Blocker.KGW!tr	20151026
GData	Gen:Variant.Kazy.576405	20151027
Ikarus	Trojan.Win32.Agent	20151027
Jiangmin	Trojan/Agent.khnf	20151026
K7AntiVirus	Trojan ( 0040f80f1 )	20151026
K7GW	Trojan ( 0040f80f1 )	20151026
Kaspersky	Trojan.Win32.Agent.abmoq	20151027
Malwarebytes	Trojan.Agent.FR	20151026
McAfee	Ransom-FQA!3D4D90741705	20151027
McAfee-GW-Edition	Ransom-FQA!3D4D90741705	20151027
eScan	Gen:Variant.Kazy.576405	20151027
Microsoft	Trojan:Win32/Toga!rfn	20151027
NANO-Antivirus	Trojan.Win32.Agent.cqhzzw	20151026
Panda	Generic Suspicious	20151026
Qihoo-360	Win32/Trojan.b8f	20151027
Rising	PE:Malware.Generic/QRS!1.9E2D [F]	20151026
SUPERAntiSpyware	Trojan.Agent/Gen-Agent	20151027
Sophos	Troj/Sulunch-D	20151027
Symantec	SMG.Heur!cg1	20151026
TotalDefense	Win32/Tofsee.SePKVbC	20151026
TrendMicro	TROJ_GEN.R028C0DJO15	20151027
VBA32	Trojan.Agent	20151026
VIPRE	Trojan.Win32.Agent.nnv (v)	20151027
Zillya	Trojan.Agent.Win32.499870	20151026
AegisLab		20151026
Alibaba		20151027
Bkav		20151026
ByteHero		20151027
CAT-QuickHeal		20151027
CMC		20151026
TheHacker		20151026
TrendMicro-HouseCall		20151027
ViRobot		20151026
Zoner		20151027
nProtect		20151026

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2012-11-12 03:03:28

Entry Point 0x00005C60

Number of sections 4

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 21772 22016 6.19 715f724193018bc35b78b1331075f69f

.rdata 28672 3656 4096 4.75 cd1f5457fbe197bd72376a3c5083ca90

.data 32768 12968 512 2.08 cb702765c82da45c5b5335c18528ed59

.rsrc 49152 22088 22528 3.98 b4774073e946d467fe91a8958a50edd5

Overlays

MD5 829114c3e9bac5619bf0a695d2a79416

File type data

Offset 50176

Size 1031284

Entropy 8.00

PE imports

[+] KERNEL32.dll

[+] MSVCR80.dll

Number of PE resources by type

RT_ICON 2

RT_MANIFEST 1

RT_GROUP_ICON 1

Number of PE resources by language

ENGLISH US 4

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

TimeStamp

2012:11:12 04:03:28+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

22016

LinkerVersion

8.0

FileTypeExtension

exe

InitializedDataSize

6144

SubsystemVersion

4.0

EntryPoint

0x5c60

OSVersion

4.0

ImageVersion

0.0

UninitializedDataSize

File identification

MD5 3d4d907417052afb1a8c3072d4415006

SHA1 2ebe780eabb94b844f3144e0c1c125a5e0b7bfa1

SHA256 404f1875b0cb77f7d44da202facf26cd7244e0e3895c94b6bb50e345b2f4f1b5

ssdeep

24576:HIQMgK7HwPIOD7M/k/SVqlx1h5cGUIczw9KzpUoJQ2FHDvBz+0/e:e7TwNwiooPcrk0dRvp2

authentihash 531618f41b81245a41a1f54ac477b554a1e40681af1f707117e6b9a27ed8e0f0

imphash 8cdec05f61bb1fe71c4a3d444ea206c8

File size 1.0 MB ( 1081460 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Executable MS Visual C++ (generic) (67.3%) Win32 Dynamic Link Library (generic) (14.2%) Win32 Executable (generic) (9.7%) Generic Win/DOS Executable (4.3%) DOS Executable Generic (4.3%)

VirusTotal metadata

First submission 2015-10-27 03:14:10 UTC (8 ヶ月, 1 週間前)

Last submission 2015-10-27 03:14:10 UTC (8 ヶ月, 1 週間前)

ファイル名

UsoClient.exe

サインインしていません。登録ユーザーのみがコメントを投稿できます。サインインして意見をお聞かせください。

サインインコミュニティに参加

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\404f1875b0cb77f7d44da202facf26cd7244e0e3895c94b6bb50e345b2f4f1b5 (successful)

C:\Users\ASPIRE~1\AppData\Local\Temp\server.exe (failed)

C:\404f1875b0cb77f7d44da202facf26cd7244e0e3895c94b6bb50e345b2f4f1b5 (failed)

C:\Windows\system32\FrameServr.exe (successful)

\\.\PIPE\wkssvc (successful)

\\.\PIPE\lsarpc (successful)

\\.\MountPointManager (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\TZTZDEL.bat (successful)

C:\WINDOWS\system32\rsaenh.dll (successful)

Read files

C:\404f1875b0cb77f7d44da202facf26cd7244e0e3895c94b6bb50e345b2f4f1b5 (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\Windows\system32\FrameServr.exe (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\TZTZDEL.bat (successful)

C:\WINDOWS\system32\rsaenh.dll (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\TZTZDEL.bat (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\OWP1.tmp\eula.txt (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\133b5.msi (successful)

C:\Program Files\MSECache\ExPdfXps\1033\expdfxps.msi (successful)

c:\autoexec.bat (successful)

Written files

C:\404f1875b0cb77f7d44da202facf26cd7244e0e3895c94b6bb50e345b2f4f1b5 (successful)

C:\Windows\system32\FrameServr.exe (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\TZTZDEL.bat (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\OWP1.tmp\eula.txt (successful)

C:\Program Files\MSECache\ExPdfXps\1033\eula.txt (successful)

C:\Program Files\MSECache\ExPdfXps\1033\ExPdfXps.cab (successful)

C:\Program Files\MSECache\ExPdfXps\1033\ExPdfXps.msi (successful)

C:\Program Files\MSECache\ExPdfXps\1033\Catalog\files12.cat (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs (0).log (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\133b5.msi (successful)

Moved files

SRC: C:\404f1875b0cb77f7d44da202facf26cd7244e0e3895c94b6bb50e345b2f4f1b5
DST: C:\~404f1875b0cb77f7d44da202facf26cd7244e0e3895c94b6bb50e345b2f4f1b5 (successful)

Deleted files

C:\Users\ASPIRE~1\AppData\Local\Temp\server.exe (failed)

C:\~404f1875b0cb77f7d44da202facf26cd7244e0e3895c94b6bb50e345b2f4f1b5 (failed)

C:\404f1875b0cb77f7d44da202facf26cd7244e0e3895c94b6bb50e345b2f4f1b5 (failed)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\OWP1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\OWP1.tmp\eula.txt (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\133b5.msi (successful)

C:\WINDOWS\Installer\MSI2.tmp (successful)

C:\WINDOWS\Installer\1361a.ipi (successful)

C:\Config.Msi\MSI4.tmp (successful)

C:\WINDOWS\Installer\1361c.msi (successful)

Created processes

C:\404f1875b0cb77f7d44da202facf26cd7244e0e3895c94b6bb50e345b2f4f1b5"" (successful)

C:\Windows\system32\FrameServr.exe C:\Windows\system32\FrameServr.exe" " (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\TZTZDEL.bat" " (successful)

msiexec.exe /i expdfxps.msi" /l*v+ "C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs (0).log" " (successful)

C:\WINDOWS\system32\MsiExec.exe C:\WINDOWS\system32\MsiExec.exe -Embedding 34C915AD42598C23AD2E897DDCCE4DC1 (successful)

Shell commands

(open) C:\Windows\system32\FrameServr.exe(null) [(null)] (successful)

(open) C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\TZTZDEL.bat(null) [(null)] (successful)

Code injections in the following processes

cmd.exe (successful)

FrameServr.exe (successful)

msiexec.exe (successful)

Created mutexes

Global\_MSIExecute (successful)

WBEMPROVIDERSTATICMUTEX (successful)

Opened mutexes

ShimCacheMutex (successful)

Global\_MSIExecute (successful)

Runtime DLLs

kernel32.dll (successful)

shell32.dll (successful)

advapi32.dll (successful)

ole32.dll (successful)

netapi32 (successful)

rpcrt4.dll (successful)

setupapi.dll (successful)

clbcatq.dll (successful)

secur32.dll (successful)

version.dll (successful)

SHA256:	404f1875b0cb77f7d44da202facf26cd7244e0e3895c94b6bb50e345b2f4f1b5
ファイル名:	UsoClient.exe
検出率:	44 / 55
分析日時:	2015-10-27 03:14:10 UTC (8 ヶ月, 1 週間前)

Ciphered bundle

PE header basic information

PE sections

Overlays

PE imports

Number of PE resources by type

Number of PE resources by language

ExifTool file metadata

File identification

VirusTotal metadata

コメントを投稿してください...

Opened files

Read files

Written files

Moved files

Deleted files

Created processes

Shell commands

Code injections in the following processes

Created mutexes

Opened mutexes

Runtime DLLs

パスワードを復旧

VirusTotal コミュニティに参加

サインイン