Multiperspective Malware Analysis Page - Daily Malware Binary Digest Summary

Welcome to the Cyber-TA
Daily Malware Binary DIGEST Summary Page

06 May 2008

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Packed
MD5 UnPacket
MD5 Victim
OS AntiVirus
Hit-Cnt First
Encounter Last
Encounter Freq
Cnt Behavioral
Clusters Unpacked
Egg.asm Packer
Fingerprint API
Resolution String
Cnt Syscall
Trace

89193031d2
[Firefox: 4 hits: 05-04 to 05-06] none[4] Win2K-f 28 of 31 07:59:43 10:25:41 2 none none:none
none|none none trace

57802172a4
[Firefox: 2 hits: 05-03 to 05-06] 638ec51ab7 [0] WinXP 28 of 31 08:35:42 08:35:42 1 none ASM:Graph
ASProtect| 57% lines=439
embedded dns trace

7a6a916be1
NEW none[4] Win2K-f 23 of 31 11:55:24 11:55:24 1 none none:none
none|none none trace

f58222344f
[Firefox: 9 hits: 12-31 to 05-06] 2a56436a64 [0] WinXP 28 of 31 09:21:45 09:21:45 1 none ASM:Graph
PolyEnE| 54% lines=265
embedded dns trace

78cf013bea
NEW f1b2b159da [0] WinXP 15 of 31 15:43:08 15:43:08 1 none ASM:Graph
ASPack| 0% lines=0 trace

beb8369329
[Firefox: 8 hits: 04-23 to 05-07] 665f1def5b [0] Win2K-f
WinXP 12 of 32 12:07:02 21:48:15 3 none ASM:Graph
ASPack| 0% lines=0 trace

efd8da3c6e
NEW none[4] WinXP 28 of 31 07:12:31 07:12:31 1 none none:none
none|none none trace

45d304294e
[Firefox: 4 hits: 05-06 to 05-06] f1b2b159da [0] WinXP
Win2K-f 14 of 30 12:28:35 14:25:14 4 none ASM:Graph
ASPack| 0% lines=0 trace

af98fe0c94
[Firefox:47 hits: 04-27 to 05-07] 480d076a0a [0] Win2K-f
WinXP 20 of 31 00:36:13 23:41:14 7 none ASM:Graph
ASProtect| 57% lines=422
embedded dns trace

e9e24ea87a
NEW aeb0a54c45 [0] WinXP 30 of 30 21:24:04 21:24:04 1 none ASM:Graph
PolyEnE| 100% lines=61 trace

80074a7499
NEW 3fd1c9f2f7 [0] WinXP 15 of 32 13:00:03 13:00:03 1 none ASM:Graph
ASPack| 0% lines=0 trace

4d2be535ec
NEW 46108e8e2d [0] Win2K-f 28 of 31 02:01:30 02:01:30 1 none ASM:Graph
ASPack| 56% lines=470
embedded dns trace

d42c1cc7c0
[Firefox:271 hits: 05-01 to 05-07] af9ca5bed1 [0] WinXP 29 of 29 12:26:01 12:26:01 1 none ASM:Graph
PolyEnE| 100% lines=54 trace

f502585714
[Firefox:83 hits: 05-03 to 05-06] ae590430c5 [0] WinXP 29 of 29 15:15:53 15:15:56 2 none ASM:Graph
PolyEnE| 100% lines=63 trace

03f912899b
[Firefox: 6 hits: 12-14 to 05-06] 83893bd25d [0] WinXP 32 of 32 16:05:22 16:05:22 1 none ASM:Graph
none|none 100% lines=65 trace

4dd70453aa
[Firefox:11 hits: 04-21 to 05-06] f1b2b159da [0] WinXP
Win2K-f 12 of 32 10:59:59 16:20:19 7 none ASM:Graph
ASPack| 0% lines=0 trace

4a96c36552
[Firefox: 8 hits: 07-15 to 05-06] 0816671a99 [0] Win2K-f 29 of 29 01:53:06 01:53:06 1 none ASM:Graph
none|none 93% lines=1969
embedded dns trace

3a65749370
[Firefox: 3 hits: 05-05 to 05-07] c0e04edf74 [0] Win2K-f 23 of 31 15:55:22 15:55:22 1 none ASM:Graph
TXT2COM| 59% lines=407
embedded dns trace

046e65ea58
NEW 16738ce659 [0] WinXP 9 of 31 14:42:58 14:42:58 1 none ASM:Graph
ASPack| 0% lines=0 trace

639a247ece
[Firefox:24 hits: 04-28 to 05-06] 29d53eec72 [0] Win2K-f 10 of 32 08:23:30 08:23:30 1 none ASM:Graph
StarForce| 77% lines=132 trace

7fdfe363d5
[Firefox:2587 hits: 12-31 to 05-07] 10862ea8b8 [0] Win2K-f 25 of 28 06:40:49 16:35:37 3 none ASM:Graph
FSG| 95% lines=1933
embedded dns trace

6a08d9e276
[Firefox: 2 hits: 05-06 to 05-07] none[4] Win2K-f 12 of 31 09:35:27 09:35:27 1 none none:none
none|none none trace

75e3565fdc
NEW none[4] WinXP 27 of 31 07:28:17 07:28:17 1 none none:none
none|none none trace

741e3b03b3
[Firefox:25 hits: 09-28 to 05-07] e0197e8a64 [0] WinXP 31 of 32 08:10:59 08:10:59 1 none ASM:Graph
none|none 100% lines=62 trace

fa0359dfff
NEW none[4] Win2K-f 28 of 31 09:08:19 09:08:19 1 none none:none
none|none none trace

40803c27ae
NEW ee3395ef30 [0] WinXP 23 of 31 08:44:26 08:44:26 1 none none:none
ASPack| none trace

161b316ac3
[Firefox: 2 hits: 05-06 to 05-06] f1b2b159da [0] Win2K-f
WinXP 14 of 31 15:57:45 16:37:39 2 none ASM:Graph
ASPack| 0% lines=0 trace

bf846c5d31
NEW 991a1fe06d [0] WinXP 27 of 32 12:44:28 12:44:28 1 none ASM:Graph
ASPack| 0% lines=61 trace

46dbeecaf1
NEW none[4] Win2K-f 23 of 28 09:12:33 09:12:33 1 none none:none
none|none none trace

831f4ee0a7
[Firefox:576 hits: 07-11 to 05-06] eb7546c600 [0] WinXP 29 of 29 11:20:41 12:34:43 2 none ASM:Graph
none|none 100% lines=61 trace

f914515fdd
NEW none[4] Win2K-f 26 of 30 03:53:13 03:53:13 1 none none:none
none|none none trace

26536a4ebc
NEW none[4] Win2K-f 17 of 32 20:48:14 20:48:14 1 none none:none
none|none none trace

5f78ff609d
[Firefox:825 hits: 04-27 to 05-07] d4a06bdc3a [0] Win2K-f
WinXP 21 of 32 00:25:12 23:28:12 81 none ASM:Graph
none|none 46% lines=4 trace

e37555c26e
[Firefox: 2 hits: 05-06 to 05-07] none[4] Win2K-f 27 of 31 08:31:11 08:31:11 1 none none:none
Xtreme-Pr| none trace

dc8e1c63cd
[Firefox:77 hits: 12-27 to 05-07] e0eb8646ee [0] Win2K-f 22 of 32 17:11:04 17:11:04 1 none ASM:Graph
none|none 62% lines=601
embedded dns trace

7ef46e4e16
[Firefox:13 hits: 11-28 to 05-06] ef2e743fd2 [0] WinXP 31 of 32 09:32:05 09:34:16 2 none ASM:Graph
PolyEnE| 99% lines=74 trace

364bdad9bc
[Firefox: 2 hits: 05-06 to 05-06] faab09fef3 [0] Win2K-f
WinXP 16 of 31 11:46:18 13:11:21 2 none ASM:Graph
ASPack| 42% lines=3214
embedded dns trace

5462cc1bde
[Firefox: 5 hits: 04-21 to 05-07] 665f1def5b [0] Win2K-f
WinXP 10 of 32 11:11:09 15:31:13 3 none ASM:Graph
ASPack| 0% lines=0 trace

890fb4fa10
[Firefox:42 hits: 12-27 to 05-06] b9c7f08a57 [0] Win2K-f 19 of 32 12:35:36 12:35:36 1 none ASM:Graph
ASProtect| 3% lines=393
embedded dns trace

8be304341b
[Firefox: 4 hits: 05-06 to 05-07] 51c0a74ab9 [0] Win2K-f 23 of 32 13:30:14 18:24:31 3 none ASM:Graph
ASPack| 47% lines=4773
embedded dns trace

82d7a8cb3b
NEW none[4] WinXP 26 of 31 09:44:13 09:44:13 1 none none:none
none|none none trace

d349189ee2
NEW none[4] Win2K-f 27 of 31 09:12:11 09:12:11 1 none none:none
none|none none trace

daa2cc54b7
NEW 674dc24333 [0] Win2K-f 28 of 31 17:43:21 17:43:21 1 none ASM:Graph
ASPack| 0% lines=61 trace

9345b57563
[Firefox:11 hits: 12-27 to 05-07] none[4] Win2K-f 9 of 32 23:43:05 23:43:05 1 none none:none
none|none none trace

10252565c9
[Firefox: 2 hits: 05-02 to 05-06] none[4] Win2K-f 16 of 29 13:15:48 13:15:48 1 none none:none
none|none none trace

552ff80216
NEW 552ff80216 [1] Win2K-f 27 of 31 11:11:16 11:11:16 1 none ASM:Graph
none|none 50% lines=19 trace

ee2f534e24
NEW e65d4881f4 [0] Win2K-f 27 of 31 10:56:30 10:56:30 1 none ASM:Graph
ASPack| 58% lines=410
embedded dns trace

a4da27f5aa
[Firefox: 2 hits: 05-05 to 05-06] none[4] WinXP 28 of 32 10:34:49 10:34:49 1 none none:none
none|none none trace

03d714d33d
[Firefox: 2 hits: 05-06 to 05-06] none[4] Win2K-f
WinXP 20 of 31 02:52:23 09:48:04 2 none none:none
none|none none trace

02d323380b
[Firefox: 3 hits: 10-23 to 05-06] none[4] WinXP 31 of 32 07:22:09 07:22:09 1 none none:none
none|none none trace

867a214b24
NEW none[4] Win2K-f 28 of 32 06:27:56 06:27:56 1 none none:none
none|none none trace

8937a104c5
NEW 04217fc678 [0] WinXP 14 of 30 13:09:37 13:09:37 1 none ASM:Graph
NsPacK| 0% lines=8 trace

df17a625ee
[Firefox:438 hits: 05-04 to 05-06] none[3] WinXP 29 of 29 10:18:01 10:18:01 1 none none:none
ASPack| none trace

76b4ab852e
[Firefox:29 hits: 04-29 to 05-07] none[4] WinXP
Win2K-f 12 of 30 00:34:55 15:32:55 5 none none:none
none|none none trace

14ef234ad3
[Firefox: 7 hits: 04-29 to 05-07] none[4] WinXP 23 of 31 06:24:24 06:24:24 1 none none:none
none|none none trace

254cceafc9
NEW 474a9f7196 [0] Win2K-f 16 of 30 01:00:44 01:00:44 1 none ASM:Graph
ASProtect| 51% lines=428
embedded dns trace

79560e1553
NEW none[4] WinXP 29 of 31 05:57:49 05:57:49 1 none none:none
none|none none trace

d94d21fc29
[Firefox: 4 hits: 12-28 to 05-06] 9deff996b5 [0] Win2K-f 12 of 32 06:34:20 06:34:20 1 none ASM:Graph
ASProtect| 57% lines=423
embedded dns trace

54be6de1a7
NEW 6048e21586 [0] WinXP 10 of 30 12:49:55 12:49:55 1 none ASM:Graph
ASPack| 0% lines=0 trace

2cf72f62c6
[Firefox: 3 hits: 05-02 to 05-06] none[4] WinXP 22 of 31 04:53:45 04:53:45 1 none none:none
none|none none trace

e376398720
NEW none[4] WinXP 27 of 31 02:29:11 02:29:11 1 none none:none
none|none none trace

62258fc1b9
[Firefox: 3 hits: 05-04 to 05-06] 673798df40 [0] WinXP 30 of 31 07:31:15 07:33:35 2 none ASM:Graph
PolyEnE| 100% lines=154
embedded dns trace

2ac741a4d2
NEW 901e9570a2 [0] WinXP 29 of 31 11:06:31 11:06:31 1 none ASM:Graph
none|none 100% lines=13 trace

a2a036466a
[Firefox:52 hits: 05-05 to 05-07] none[4] Win2K-f
WinXP 14 of 32 00:18:28 19:50:43 18 none none:none
none|none none trace

0c74913012
NEW 29d969a15e [0] WinXP 30 of 32 01:40:02 01:40:02 1 none ASM:Graph
PolyEnE| 98% lines=76 trace

53123fadcc
[Firefox:35 hits: 01-26 to 05-07] none[4] Win2K-f 13 of 32 17:27:31 17:27:31 1 none none:none
none|none none trace

7f60162c2c
[Firefox:1274 hits: 12-31 to 05-07] 1aad8e4632 [0] WinXP 25 of 25 18:05:11 18:05:11 1 none ASM:Graph
PolyEnE| 100% lines=93
embedded dns trace

f3a13c33b5
NEW none[4] Win2K-f 27 of 31 13:58:35 13:58:35 1 none none:none
none|none none trace

bdfea2fcbe
NEW 80aeea81b0 [0] WinXP 27 of 31 04:24:11 04:24:11 1 none ASM:Graph
StarForce| 77% lines=132 trace

0cb86518c1
[Firefox: 5 hits: 04-23 to 05-06] f1b2b159da [0] WinXP
Win2K-f 12 of 32 10:59:28 15:32:29 3 none ASM:Graph
ASPack| 0% lines=0 trace

1021fe5610
NEW 587e6b49c8 [0] WinXP 27 of 30 03:42:20 03:42:20 1 none ASM:Graph
ASProtect| 53% lines=423
embedded dns trace

06b2a063d4
NEW 83c641189a [0] Win2K-f 14 of 30 18:33:51 18:33:51 1 none ASM:Graph
ASPack| 0% lines=0 trace

3ae357d17b
[Firefox:697 hits: 05-01 to 05-07] 462a7be171 [0] WinXP 29 of 29 18:55:07 18:55:07 1 none ASM:Graph
PolyEnE| 99% lines=73 trace

39b81ab576
[Firefox: 3 hits: 05-02 to 05-06] 7b8b096e8e [0] WinXP 28 of 32 04:44:22 04:44:22 1 none ASM:Graph
EXECrypto| 71% line=1 trace

a407412b1d
NEW none[2] Win2K-f 14 of 30 12:08:42 12:08:42 1 none none:none
none|none none trace

d053d1c0ad
NEW 12ab89414f [0] WinXP 27 of 32 12:14:25 12:14:25 1 none ASM:Graph
ASPack| 100% lines=61 trace

7d99b0e910
[Firefox:2956 hits: 12-31 to 05-07] 7a70e1b592 [0] WinXP 26 of 28 08:05:10 16:54:18 6 none ASM:Graph
PolyEnE| 99% lines=68 trace

7e28dac8de
[Firefox:11 hits: 04-27 to 05-06] none[4] Win2K-f 18 of 32 12:21:17 12:21:17 1 none none:none
none|none none trace

6bd16b7a95
[Firefox: 2 hits: 05-05 to 05-06] none[4] WinXP 21 of 30 04:02:03 04:02:03 1 none none:none
none|none none trace

9693f6f38e
NEW 4911290aec [0] Win2K-f 28 of 31 11:17:48 11:17:48 1 none ASM:Graph
ASPack| 100% lines=65
embedded dns trace

c1f12e0109
[Firefox:10 hits: 04-28 to 05-07] none[4] Win2K-f
WinXP 21 of 31 02:17:05 23:19:12 3 none none:none
none|none none trace

af3b1f95c4
NEW fef1ead5fb [0] Win2K-f 26 of 31 17:40:34 17:40:34 1 none ASM:Graph
NsPacK| 85% lines=4770
embedded dns trace

980e1bdba5
[Firefox: 2 hits: 05-06 to 05-06] acf2e1645e [0] WinXP
Win2K-f 25 of 31 13:04:02 15:30:43 2 none ASM:Graph
NsPacK| 0% lines=13 trace

a2106b4e9d
NEW
d22b35f1b8
[Firefox: 2 hits: 05-06 to 05-06] 069b356c04 [0]
d22b35f1b8[1] Win2K-f
WinXP 23 of 31 10:25:41 17:42:55 2 none ASM:Graph
ASM:Graph
ASPack|
FSG| 50% lines=61
lines=6 trace
trace

9caca05b25
[Firefox: 5 hits: 05-06 to 05-06] 1b8c24c677 [0] Win2K-f
WinXP 18 of 31 11:15:10 16:36:02 5 none ASM:Graph
ASPack| 0% lines=0 trace

7a0c69e783
[Firefox: 5 hits: 04-21 to 05-06] 1b8c24c677 [0] Win2K-f 13 of 32 12:46:58 14:53:08 3 none ASM:Graph
ASPack| 0% lines=0 trace

1881995236
NEW none[4] WinXP 27 of 31 00:52:30 00:52:30 1 none none:none
StarForce| none trace

1523406fa9
NEW none[4] WinXP 27 of 31 03:33:08 03:33:08 1 none none:none
none|none none trace

a2106b4e9d
NEW 069b356c04 [0] WinXP 29 of 31 17:42:55 17:42:55 1 none ASM:Graph
ASPack| 0% lines=61 trace

fd0bf48a75
[Firefox: 7 hits: 04-28 to 05-07] none[3] Win2K-f 20 of 32 07:03:38 07:03:38 1 none none:none
ASProtect| none trace

a973fc1184
[Firefox: 2 hits: 05-02 to 05-06] none[2] Win2K-f 15 of 31 01:39:20 01:39:20 1 none none:none
none|none none trace