Multiperspective Malware Analysis Page - Daily Malware Binary Digest Summary

Welcome to the Cyber-TA
Daily Malware Binary DIGEST Summary Page

22 August 2008

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Packed
MD5 UnPacket
MD5 Victim
OS AntiVirus
Hit-Cnt First
Encounter Last
Encounter Freq
Cnt Behavioral
Clusters Unpacked
Egg.asm Packer
Fingerprint API
Resolution String
Cnt Syscall
Trace

eb9217b966
NEW
ff2150aa95
[Firefox: 2 hits: 07-03 to 08-07] none[none]
none [none] Win2K-f 30 of 33 06:24:10 06:24:10 1 none none:none
none:none
none|none
none|none none
none none
none

70c31be294
[Firefox: 2 hits: 07-29 to 08-10]
e07c29c4ae
[Firefox:349 hits: 06-19 to 08-21]
fead05e431
[Firefox: 2 hits: 07-29 to 08-10] none[none]
e07c29c4ae[1]
none [none] WinXP 28 of 35 14:00:49 14:00:49 1 none none:none
ASM:Graph
none:none
none|none
FSG|
none|none none
lines=92
none none
trace
none

da00a8e7a1
[Firefox: 8 hits: 08-05 to 08-20]
f685f8e027
[Firefox:12 hits: 06-18 to 08-20] none[none]
f685f8e027[1] Win2K-f
WinXP 28 of 33 11:04:22 20:45:58 2 none none:none
ASM:Graph
none|none
Armadillo| 48% none
lines=82 none
trace

0081629431
NEW
8646fc5510
NEW none[none]
none [none] Win2K-f 32 of 36 07:25:22 07:25:22 1 none none:none
none:none
none|none
none|none none
none none
none

177159de26
[Firefox: 3 hits: 08-08 to 08-20] none[none] WinXP 32 of 36 02:33:30 02:33:30 1 none none:none
none|none none none

5bd33f839a
[Firefox: 4 hits: 08-19 to 08-19] none[none] WinXP 35 of 36 02:24:41 02:24:41 1 none none:none
none|none none none

53bfe15e91
[Firefox:1720 hits: 06-17 to 08-21]
73f1082158
[Firefox:862 hits: 06-18 to 08-21] none[4]
73f1082158[1] Win2K-f
WinXP 0 of 32 00:24:50 23:11:48 13 none none:none
ASM:Graph
tElock|
Armadillo| 47% none
lines=81 trace
trace

64748c59aa
NEW
78e31db533
[Firefox: 3 hits: 08-13 to 08-16]
9b09258622
[Firefox:10 hits: 08-05 to 08-16]
d5a5e9f7a9
[Firefox: 3 hits: 08-13 to 08-16] none[none]
none [none]
none [none]
none [none] Win2K-f 18 of 36 04:10:00 04:10:00 1 none none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none none
none
none
none none
none
none
none

1fcc146d70
[Firefox:29 hits: 01-02 to 08-19] 258fafe892 [0] WinXP 29 of 29 18:34:14 18:34:14 1 none ASM:Graph
PolyEnE| 99% lines=68 trace

e253fef35b
[Firefox: 5 hits: 08-10 to 08-21] none[none] WinXP 36 of 36 08:01:58 08:01:58 1 none none:none
none|none none none

4c3df24b32
[Firefox:165 hits: 06-17 to 08-21]
53bfe15e91
[Firefox:1720 hits: 06-17 to 08-21] 4c3df24b32 [1]
none [4] Win2K-f
WinXP 33 of 33 00:24:50 23:39:12 34 none ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

1a7bebb1cf
NEW none[none] WinXP 20 of 36 16:12:32 16:12:32 1 none none:none
none|none none none

087e2ee6ac
NEW none[none] WinXP 33 of 35 01:17:37 01:17:37 1 none none:none
none|none none none

b19b1a3b65
NEW none[none] WinXP 36 of 36 10:12:35 10:12:35 1 none none:none
none|none none none

64748c59aa
NEW none[none] Win2K-f 34 of 36 04:10:00 04:10:00 1 none none:none
none|none none none

7f89b38665
[Firefox: 8 hits: 08-02 to 08-20] none[none] Win2K-f 32 of 36 12:50:18 12:50:18 1 none none:none
none|none none none

b7082104e4
[Firefox:110 hits: 06-18 to 08-21] none[4] Win2K-f
WinXP 8 of 33 02:19:52 20:03:16 3 none none:none
tElock| none trace

f8763e5dea
NEW none[none] WinXP 35 of 36 09:40:42 09:42:24 2 none none:none
none|none none none

4671f33cff
NEW none[none] Win2K-f 1 of 36 09:24:25 09:30:03 2 none none:none
none|none none none

0c26670e4d
NEW
997a63d3bc
NEW none[none]
none [none] Win2K-f 28 of 36 05:41:02 05:41:02 1 none none:none
none:none
none|none
none|none none
none none
none

9a490aee06
NEW
f69862c856
NEW none[none]
none [none] WinXP 35 of 36 14:15:52 14:15:52 1 none none:none
none:none
none|none
none|none none
none none
none

0dce5e364c
NEW none[none] Win2K-f 30 of 36 11:04:22 11:04:22 1 none none:none
none|none none none

73ce2b74da
[Firefox: 8 hits: 06-18 to 08-18] 73ce2b74da [1] Win2K-f 3 of 33 13:08:24 13:08:24 1 none ASM:Graph
Armadillo| 47% lines=81 trace

9824b60bec
[Firefox: 7 hits: 08-18 to 08-21] none[none] WinXP 31 of 36 10:11:18 10:11:18 1 none none:none
none|none none none

d42c1cc7c0
[Firefox:126 hits: 01-01 to 08-15] af9ca5bed1 [0] WinXP 29 of 29 20:38:07 20:38:07 1 none ASM:Graph
PolyEnE| 100% lines=54 trace

3060fff5c0
NEW
a7d11d75cd
NEW none[none]
none [none] WinXP 34 of 36 05:06:22 05:06:22 1 none none:none
none:none
none|none
none|none none
none none
none

bca9e0fb5f
[Firefox:22 hits: 06-18 to 08-21] none[4] WinXP 31 of 32 01:58:33 01:58:33 1 none none:none
PolyEnE| none trace

a12cab51ef
[Firefox:483 hits: 01-01 to 08-21] 40f7f463c4 [0] WinXP 29 of 29 13:43:42 13:43:42 1 none ASM:Graph
ASPack| 54% lines=281
embedded dns trace

64748c59aa
NEW
78e31db533
[Firefox: 3 hits: 08-13 to 08-16]
9b09258622
[Firefox:10 hits: 08-05 to 08-16] none[none]
none [none]
none [none] Win2K-f 14 of 36 04:10:00 04:10:00 1 none none:none
none:none
none:none
none|none
none|none
none|none none
none
none none
none
none

177159de26
[Firefox: 3 hits: 08-08 to 08-20]
9c50aa3c45
[Firefox: 3 hits: 08-08 to 08-20] none[none]
none [none] WinXP 34 of 36 02:33:30 02:33:30 1 none none:none
none:none
none|none
none|none none
none none
none

03f912899b
[Firefox:100 hits: 01-08 to 08-21] 83893bd25d [0] WinXP 32 of 32 02:18:58 16:20:59 3 none ASM:Graph
none|none 100% lines=65 trace

68cd473638
NEW
935f6902c4
NEW
bcd63e69ea
NEW none[none]
none [none]
none [none] WinXP 0 of 36 07:29:01 07:29:01 1 none none:none
none:none
none:none
none|none
none|none
none|none none
none
none none
none
none

4c3df24b32
[Firefox:165 hits: 06-17 to 08-21] 4c3df24b32 [1] Win2K-f 0 of 33 23:39:12 23:39:12 1 none ASM:Graph
Armadillo| 47% lines=81 trace

63452bf08e
NEW none[none] WinXP 34 of 35 12:07:44 12:07:44 1 none none:none
none|none none none

741e3b03b3
[Firefox:310 hits: 01-05 to 08-21] e0197e8a64 [0] WinXP 31 of 32 08:14:34 23:43:20 6 none ASM:Graph
none|none 100% lines=62 trace

68cd473638
NEW none[none] WinXP 22 of 32 07:29:01 07:29:01 1 none none:none
none|none none none

831f4ee0a7
[Firefox:501 hits: 01-01 to 08-21] eb7546c600 [0] WinXP 29 of 29 10:02:43 16:52:07 2 none ASM:Graph
none|none 100% lines=61 trace

53bfe15e91
[Firefox:1720 hits: 06-17 to 08-21]
bea8cb1865
[Firefox: 5 hits: 08-11 to 08-20] none[4]
none [none] Win2K-f 32 of 36 00:28:41 00:28:41 1 none none:none
none:none
tElock|
none|none none
none trace
none

0081629431
NEW none[none] Win2K-f 34 of 36 07:25:22 07:25:22 1 none none:none
none|none none none

a0044bcb25
[Firefox: 7 hits: 08-02 to 08-17] none[none] WinXP 36 of 36 13:45:21 13:45:21 1 none none:none
none|none none none

0f55e617b4
[Firefox: 3 hits: 06-25 to 08-01] none[none] Win2K-f 21 of 33 03:13:57 03:13:57 1 none none:none
none|none none none

0dce5e364c
NEW
213be7183e
NEW
42e56ccaeb
NEW
75d013e972
[Firefox: 5 hits: 08-20 to 08-21] none[none]
none [none]
none [none]
none [none] Win2K-f 14 of 36 11:04:22 11:04:22 1 none none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none none
none
none
none none
none
none
none

53bfe15e91
[Firefox:1720 hits: 06-17 to 08-21]
73f1082158
[Firefox:862 hits: 06-18 to 08-21]
b5919931fe
[Firefox:443 hits: 06-20 to 08-21] none[4]
73f1082158[1]
b5919931fe[1] Win2K-f 0 of 32 00:24:50 15:31:45 6 none none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| 48% none
lines=81
lines=90 trace
trace
trace

57ce4acac2
[Firefox:140 hits: 06-17 to 08-21] 57ce4acac2 [1] WinXP
Win2K-f 0 of 33 06:44:20 15:26:27 2 none ASM:Graph
Armadillo| 47% lines=81 trace

087e2ee6ac
NEW
a6fe69d9f1
NEW none[none]
none [none] WinXP 34 of 36 01:17:37 01:17:37 1 none none:none
none:none
none|none
none|none none
none none
none

7a06e8e9a8
NEW none[none] WinXP 31 of 36 01:09:33 01:09:33 1 none none:none
none|none none none

1a2c0e6130
[Firefox:351 hits: 12-31 to 08-21] 048df78048 [0] WinXP 29 of 29 02:22:35 22:13:39 5 none ASM:Graph
none|none 100% lines=61 trace

0c0acdd902
NEW
8682af6215
NEW none[none]
none [none] WinXP 34 of 36 12:51:47 12:51:47 1 none none:none
none:none
none|none
none|none none
none none
none

53bfe15e91
[Firefox:1720 hits: 06-17 to 08-21]
a08f3b74a4
[Firefox:570 hits: 06-18 to 08-21] none[4]
a08f3b74a4[1] Win2K-f
WinXP 0 of 33 01:16:12 23:09:34 16 none none:none
ASM:Graph
tElock|
Armadillo| 47% none
lines=81 trace
trace

70c31be294
[Firefox: 2 hits: 07-29 to 08-10] none[none] WinXP 34 of 35 14:00:49 14:00:49 1 none none:none
none|none none none

97be872152
NEW none[none] WinXP 35 of 36 22:51:08 22:51:08 1 none none:none
none|none none none

6371af4c72
NEW none[none] WinXP 36 of 36 20:11:34 20:11:34 1 none none:none
none|none none none

7f89b38665
[Firefox: 8 hits: 08-02 to 08-20]
a51a50404e
[Firefox: 8 hits: 08-02 to 08-20] none[none]
none [none] Win2K-f 34 of 36 12:50:18 12:50:18 1 none none:none
none:none
none|none
none|none none
none none
none

0dce5e364c
NEW
213be7183e
NEW
42e56ccaeb
NEW none[none]
none [none]
none [none] Win2K-f 11 of 36 11:04:22 11:04:22 1 none none:none
none:none
none:none
none|none
none|none
none|none none
none
none none
none
none

68cd473638
NEW
935f6902c4
NEW none[none]
none [none] WinXP 0 of 36 07:29:01 07:29:01 1 none none:none
none:none
none|none
none|none none
none none
none

73a8a1751d
NEW none[none] WinXP 30 of 35 11:17:15 11:17:15 1 none none:none
none|none none none

d0a6e01449
[Firefox: 3 hits: 07-27 to 08-19] none[none] WinXP 33 of 34 06:50:23 06:50:26 2 none none:none
none|none none none

9b9e5dcb18
[Firefox:10 hits: 08-08 to 08-20] none[none] WinXP 36 of 36 20:02:14 20:02:14 1 none none:none
none|none none none

0c338f33e1
NEW none[none] WinXP 30 of 35 18:49:19 18:49:19 1 none none:none
none|none none none

0d3fafbf29
[Firefox: 2 hits: 06-21 to 07-28]
d401773a07
[Firefox: 2 hits: 06-21 to 07-28] 0d3fafbf29 [1]
none [4] Win2K-f 29 of 33 00:25:43 00:25:43 1 none ASM:Graph
none:none
Armadillo|
tElock| lines=82
none trace
trace

607b60ad51
[Firefox:21 hits: 06-20 to 08-18]
e5c7bce70e
[Firefox:20 hits: 06-20 to 08-18] none[4]
e5c7bce70e[1] Win2K-f
WinXP 2 of 32 13:37:28 21:47:30 3 none none:none
ASM:Graph
tElock|
Armadillo| 47% none
lines=81 trace
trace

64748c59aa
NEW
78e31db533
[Firefox: 3 hits: 08-13 to 08-16] none[none]
none [none] Win2K-f 16 of 36 04:10:00 04:10:00 1 none none:none
none:none
none|none
none|none none
none none
none

0d3fafbf29
[Firefox: 2 hits: 06-21 to 07-28] 0d3fafbf29 [1] Win2K-f 28 of 33 00:25:43 00:25:43 1 none ASM:Graph
Armadillo| 47% lines=82 trace

4b2541d5f7
[Firefox: 3 hits: 08-19 to 08-21] none[none] WinXP 35 of 36 04:54:51 04:54:51 1 none none:none
none|none none none

df17a625ee
[Firefox:222 hits: 01-01 to 08-21] 9bbdd086c5 [0] WinXP 29 of 29 09:10:26 09:10:26 1 none ASM:Graph
ASPack| 49% lines=186
embedded dns trace

986b59708d
[Firefox:70 hits: 01-14 to 08-21] 8a00217866 [0] WinXP 29 of 29 07:14:17 07:14:17 1 none ASM:Graph
PolyEnE| 100% lines=57 trace

9a490aee06
NEW none[none] WinXP 31 of 35 14:15:52 14:15:52 1 none none:none
none|none none none

1be9721a10
NEW none[none] WinXP
Win2K-f 32 of 36 03:42:43 03:45:08 2 none none:none
none|none none none

bca9e0fb5f
[Firefox:22 hits: 06-18 to 08-21]
e53a9ea82e
[Firefox:22 hits: 06-18 to 08-21] none[4]
e53a9ea82e[1] WinXP 23 of 33 01:58:33 01:58:33 1 none none:none
ASM:Graph
PolyEnE|
Armadillo| 47% none
lines=81 trace
trace

0dce5e364c
NEW
213be7183e
NEW none[none]
none [none] Win2K-f 1 of 36 11:04:22 11:04:22 1 none none:none
none:none
none|none
none|none none
none none
none

36dfdf19c9
NEW
f33ab73e8d
NEW none[none]
none [none] WinXP 32 of 36 18:50:11 18:50:11 1 none none:none
none:none
none|none
none|none none
none none
none

49f8b27cca
[Firefox: 4 hits: 06-24 to 08-18]
e07c29c4ae
[Firefox:349 hits: 06-19 to 08-21] 49f8b27cca [1]
e07c29c4ae[1] WinXP 0 of 33 05:48:28 15:25:12 7 none ASM:Graph
ASM:Graph
Armadillo|
FSG| 48% lines=82
lines=92 trace
trace

0c0acdd902
NEW none[none] WinXP 32 of 36 12:51:47 12:51:47 1 none none:none
none|none none none

0dce5e364c
NEW
213be7183e
NEW
42e56ccaeb
NEW
75d013e972
[Firefox: 5 hits: 08-20 to 08-21]
812a0cf35a
NEW none[none]
none [none]
none [none]
none [none]
none [none] Win2K-f 26 of 36 11:04:22 11:04:22 1 none none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none none
none
none
none
none

68a76c215f
[Firefox: 3 hits: 08-14 to 08-21] none[none] WinXP 36 of 36 15:51:13 15:51:13 1 none none:none
none|none none none

0f55e617b4
[Firefox: 3 hits: 06-25 to 08-01]
4c764cd519
[Firefox: 3 hits: 06-25 to 08-01] none[none]
none [none] Win2K-f 31 of 33 03:13:57 03:13:57 1 none none:none
none:none
none|none
none|none none
none none
none

6e2eaa0359
[Firefox: 6 hits: 07-10 to 08-18]
740e3bffe0
[Firefox: 7 hits: 06-25 to 08-18] none[none]
none [none] Win2K-f 24 of 33 16:57:01 16:57:01 1 none none:none
none:none
none|none
none|none none
none none
none

6d448e9832
NEW none[4] WinXP 22 of 32 10:19:03 10:19:03 1 none none:none
none|none none trace

15d4d85dc0
[Firefox: 7 hits: 06-10 to 08-19] none[4] Win2K-f 32 of 32 02:25:22 02:25:22 1 none none:none
StarForce| none trace

9d51993bf7
NEW none[none] WinXP 35 of 36 12:33:57 12:33:57 1 none none:none
none|none none none

7f60162c2c
[Firefox:486 hits: 12-31 to 08-21] 1aad8e4632 [0] WinXP 25 of 25 10:46:14 15:27:01 6 none ASM:Graph
PolyEnE| 100% lines=93
embedded dns trace

6e2eaa0359
[Firefox: 6 hits: 07-10 to 08-18] none[none] Win2K-f 31 of 33 16:57:01 16:57:01 1 none none:none
none|none none none

53bfe15e91
[Firefox:1720 hits: 06-17 to 08-21]
d2b05e43df
NEW none[4]
none [none] Win2K-f 32 of 36 11:47:36 11:47:36 1 none none:none
none:none
tElock|
none|none none
none trace
none

86176b6a8e
NEW none[none] Win2K-f 34 of 35 12:58:46 12:58:46 1 none none:none
none|none none none

49f8b27cca
[Firefox: 4 hits: 06-24 to 08-18]
e07c29c4ae
[Firefox:349 hits: 06-19 to 08-21]
e414dccc52
[Firefox: 4 hits: 06-24 to 08-18] 49f8b27cca [1]
e07c29c4ae[1]
none [4] WinXP 31 of 33 15:25:12 15:25:12 1 none ASM:Graph
ASM:Graph
none:none
Armadillo|
FSG|
ASProtect| lines=82
lines=92
none trace
trace
trace

b74e792974
[Firefox: 4 hits: 06-18 to 08-18] b74e792974 [1] WinXP 31 of 33 01:20:35 01:20:35 1 none ASM:Graph
Armadillo| 47% lines=82 trace

f0b49cdcfc
[Firefox: 9 hits: 07-04 to 08-21] none[none] WinXP 33 of 33 14:03:13 14:03:13 1 none none:none
none|none none none

73f1082158
[Firefox:862 hits: 06-18 to 08-21]
b55e5748a9
NEW 73f1082158 [1]
none [none] Win2K-f 33 of 34 20:32:45 20:32:45 1 none ASM:Graph
none:none
Armadillo|
none|none lines=81
none trace
none

0c26670e4d
NEW none[none] Win2K-f 35 of 36 05:41:02 05:41:02 1 none none:none
none|none none none

3ae357d17b
[Firefox:165 hits: 01-01 to 08-20] 462a7be171 [0] WinXP 29 of 29 06:28:52 23:35:13 3 none ASM:Graph
PolyEnE| 99% lines=73 trace

1be9721a10
NEW
48923dcf8c
NEW none[none]
none [none] WinXP
Win2K-f 34 of 36 03:42:43 03:45:08 2 none none:none
none:none
none|none
none|none none
none none
none

da00a8e7a1
[Firefox: 8 hits: 08-05 to 08-20] none[none] Win2K-f
WinXP 34 of 36 11:04:22 20:45:58 2 none none:none
none|none none none

73ce2b74da
[Firefox: 8 hits: 06-18 to 08-18]
79c01ec060
[Firefox:24 hits: 06-18 to 08-20] 73ce2b74da [1]
none [4] Win2K-f 33 of 33 13:08:24 13:08:24 1 none ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

7d99b0e910
[Firefox:1003 hits: 12-31 to 08-21] 7a70e1b592 [0] WinXP 26 of 28 02:39:16 23:32:26 6 none ASM:Graph
PolyEnE| 99% lines=68 trace

089d3e7af7
NEW none[none] WinXP 32 of 36 22:55:36 22:55:36 1 none none:none
none|none none none

49f8b27cca
[Firefox: 4 hits: 06-24 to 08-18] 49f8b27cca [1] WinXP 29 of 33 15:25:12 15:25:12 1 none ASM:Graph
Armadillo| 47% lines=82 trace

b3154d1b2a
NEW none[none] WinXP 36 of 36 08:47:35 08:47:35 1 none none:none
none|none none none

70b3b3de04
NEW none[none] WinXP 33 of 36 15:51:24 15:51:24 1 none none:none
none|none none none

1509c8d024
[Firefox:19 hits: 06-17 to 08-16]
f23b040440
[Firefox:10 hits: 06-22 to 08-16] none[4]
f23b040440[1] Win2K-f 30 of 32 07:06:18 07:06:18 1 none none:none
ASM:Graph
tElock|
Armadillo| 47% none
lines=82 trace
trace

b74e792974
[Firefox: 4 hits: 06-18 to 08-18]
f0e73c39a8
[Firefox: 5 hits: 06-18 to 08-18] b74e792974 [1]
none [4] WinXP 31 of 33 01:20:35 01:20:35 1 none ASM:Graph
none:none
Armadillo|
tElock| lines=82
none trace
trace

36dfdf19c9
NEW none[none] WinXP 34 of 36 18:50:11 18:50:11 1 none none:none
none|none none none

1509c8d024
[Firefox:19 hits: 06-17 to 08-16] none[4] Win2K-f 31 of 33 07:06:18 07:06:18 1 none none:none
tElock| none trace

c4c5a56ffe
[Firefox: 4 hits: 08-15 to 08-20] none[none] Win2K-f 11 of 36 17:47:33 17:47:33 1 none none:none
none|none none none

607b60ad51
[Firefox:21 hits: 06-20 to 08-18] none[4] Win2K-f
WinXP 31 of 32 13:37:28 21:47:30 3 none none:none
tElock| none trace

3060fff5c0
NEW none[none] WinXP 30 of 34 05:06:22 05:06:22 1 none none:none
none|none none none

a3364f8634
NEW none[none] WinXP 36 of 36 15:26:09 15:26:09 1 none none:none
none|none none none

a73d9b037c
NEW none[none] WinXP 34 of 36 14:19:10 14:19:10 1 none none:none
none|none none none

eb9217b966
NEW none[none] Win2K-f 34 of 36 06:24:10 06:24:10 1 none none:none
none|none none none

86176b6a8e
NEW
8a7d6cc74f
NEW none[none]
none [none] Win2K-f 32 of 36 12:58:46 12:58:46 1 none none:none
none:none
none|none
none|none none
none none
none