Multiperspective Malware Analysis Page - Daily Malware Binary Digest Summary

Welcome to the Cyber-TA
Daily Malware Binary DIGEST Summary Page

30 September 2008

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Packed
MD5 UnPacket
MD5 Victim
OS AntiVirus
Hit-Cnt First
Encounter Last
Encounter Freq
Cnt Behavioral
Clusters Unpacked
Egg.asm Packer
Fingerprint API
Resolution String
Cnt Syscall
Trace

53bfe15e91
[Firefox:2628 hits: 06-17 to 09-29]
73f1082158
[Firefox:1301 hits: 06-18 to 09-29] none[4]
73f1082158[1] Win2K-f
WinXP 0 of 32 01:31:47 23:43:33 28 none none:none
ASM:Graph
tElock|
Armadillo| 47% none
lines=81 trace
trace

22999be88c
[Firefox:25 hits: 04-05 to 09-29] eda2056971 [0] WinXP 31 of 32 16:49:02 16:49:02 1 none ASM:Graph
PolyEnE| 100% lines=154
embedded dns trace

5f173c9c43
NEW none[none] Win2K-f 31 of 36 01:02:56 01:02:56 1 none none:none
none|none none none

22de60782a
NEW none[none] WinXP 2 of 36 12:12:37 12:12:37 1 none none:none
none|none none none

53bfe15e91
[Firefox:2628 hits: 06-17 to 09-29] none[4] Win2K-f
WinXP 33 of 33 01:31:47 23:53:51 44 none none:none
tElock| none trace

1eacab1cc9
NEW none[none] Win2K-f 34 of 36 11:36:57 11:36:57 1 none none:none
none|none none none

717cda1f48
NEW none[none] WinXP 32 of 36 06:45:31 06:45:31 1 none none:none
none|none none none

01ccd8c1fd
NEW none[none] WinXP 34 of 36 20:45:27 20:45:27 1 none none:none
none|none none none

87e1117f2a
[Firefox: 9 hits: 07-18 to 09-24] none[none] Win2K-f 32 of 33 09:22:22 09:22:22 1 none none:none
none|none none none

13c460fd31
NEW none[none] WinXP 34 of 36 09:42:34 09:42:34 1 none none:none
none|none none none

7f89b38665
[Firefox:17 hits: 08-02 to 09-26] none[none] Win2K-f 32 of 36 14:49:20 14:49:20 1 none none:none
none|none none none

53bfe15e91
[Firefox:2628 hits: 06-17 to 09-29]
b7082104e4
[Firefox:156 hits: 06-18 to 09-29] none[4]
none [4] Win2K-f 8 of 33 10:58:54 20:46:11 3 none none:none
none:none
tElock|
tElock| none
none trace
trace

69be040d0b
[Firefox: 5 hits: 06-21 to 08-20] none[4] Win2K-f 30 of 33 22:46:08 22:46:08 1 none none:none
tElock| none trace

3baa8fcc3d
NEW none[none] WinXP 35 of 36 10:02:14 10:02:14 1 none none:none
none|none none none

bfa308b13a
[Firefox:11 hits: 02-29 to 05-05] 7586a2002b [0] WinXP 30 of 32 09:40:39 09:40:39 1 none ASM:Graph
PolyEnE| 0% lines=0 trace

8390780c27
[Firefox:38 hits: 06-18 to 09-29] none[4] WinXP
Win2K-f 30 of 32 05:49:29 05:52:11 2 none none:none
tElock| none trace

69be040d0b
[Firefox: 5 hits: 06-21 to 08-20]
81bbbeac34
[Firefox: 5 hits: 06-21 to 08-20] none[4]
81bbbeac34[1] Win2K-f 30 of 33 22:46:08 22:46:08 1 none none:none
ASM:Graph
tElock|
Armadillo| 47% none
lines=82 trace
trace

24135d98a2
NEW none[none] Win2K-f 33 of 36 06:05:45 06:05:45 1 none none:none
none|none none none

776985f561
[Firefox:15 hits: 06-24 to 09-24]
97fef473b9
NEW 776985f561 [1]
none [none] WinXP 33 of 33 11:29:25 11:29:25 1 none ASM:Graph
none:none
Armadillo|
none|none lines=82
none trace
none

9c1f1407f9
NEW none[none] WinXP 25 of 36 15:38:41 15:38:41 1 none none:none
none|none none none

73ce2b74da
[Firefox:17 hits: 06-18 to 09-28] 73ce2b74da [1] Win2K-f
WinXP 3 of 33 12:58:41 16:24:24 2 none ASM:Graph
Armadillo| 47% lines=81 trace

d42c1cc7c0
[Firefox:139 hits: 01-01 to 09-29] af9ca5bed1 [0] WinXP 29 of 29 18:08:27 18:08:27 1 none ASM:Graph
PolyEnE| 100% lines=54 trace

a12cab51ef
[Firefox:548 hits: 01-01 to 09-29] 40f7f463c4 [0] WinXP 29 of 29 11:48:33 12:19:50 2 none ASM:Graph
ASPack| 54% lines=281
embedded dns trace

c8b162e3a6
NEW none[none] WinXP 34 of 36 12:56:55 12:56:55 1 none none:none
none|none none none

03f912899b
[Firefox:145 hits: 01-08 to 09-29] 83893bd25d [0] WinXP 32 of 32 17:31:04 19:50:33 3 none ASM:Graph
none|none 100% lines=65 trace

726638fb22
[Firefox: 2 hits: 09-19 to 09-25] none[none] WinXP 34 of 36 21:57:54 21:57:54 1 none none:none
none|none none none

4c3df24b32
[Firefox:204 hits: 06-17 to 09-29] 4c3df24b32 [1] Win2K-f 0 of 33 14:31:22 14:31:22 1 none ASM:Graph
Armadillo| 47% lines=81 trace

686d4ca67b
[Firefox: 7 hits: 07-08 to 09-15]
b7e379b157
[Firefox: 7 hits: 07-08 to 09-15] none[none]
none [none] Win2K-f 29 of 33 23:44:33 23:44:33 1 none none:none
none:none
none|none
none|none none
none none
none

d3be2c7a88
NEW none[none] Win2K-f 34 of 36 22:45:01 22:45:01 1 none none:none
none|none none none

38ba49d65c
NEW none[none] Win2K-f 2 of 36 19:23:54 19:23:54 1 none none:none
none|none none none

741e3b03b3
[Firefox:416 hits: 01-05 to 09-29] e0197e8a64 [0] WinXP 31 of 32 04:06:34 05:26:21 3 none ASM:Graph
none|none 100% lines=62 trace

f353d4eed9
[Firefox:22 hits: 09-17 to 09-28] none[none] WinXP 35 of 36 09:40:35 19:22:52 5 none none:none
none|none none none

8390780c27
[Firefox:38 hits: 06-18 to 09-29]
af88ae89f8
[Firefox: 6 hits: 06-18 to 08-18] none[4]
af88ae89f8[1] WinXP
Win2K-f 31 of 33 05:49:29 05:52:11 2 none none:none
ASM:Graph
tElock|
Armadillo| 47% none
lines=82 trace
trace

2d6c8c447f
[Firefox: 7 hits: 09-16 to 09-27] none[none] WinXP 36 of 36 23:34:11 23:34:11 1 none none:none
none|none none none

831f4ee0a7
[Firefox:571 hits: 01-01 to 09-29] eb7546c600 [0] WinXP 29 of 29 08:57:57 18:57:12 2 none ASM:Graph
none|none 100% lines=61 trace

039e3fa376
[Firefox: 6 hits: 07-24 to 09-29]
57563d3af4
NEW
76f2c59ef8
[Firefox: 6 hits: 07-24 to 09-29] none[none]
none [none]
none [none] Win2K-f 31 of 35 03:23:22 23:57:55 2 none none:none
none:none
none:none
none|none
none|none
none|none none
none
none none
none
none

1eacab1cc9
NEW
d43f7bdb88
NEW none[none]
none [none] Win2K-f 22 of 36 11:36:57 11:36:57 1 none none:none
none:none
none|none
none|none none
none none
none

53bfe15e91
[Firefox:2628 hits: 06-17 to 09-29]
73f1082158
[Firefox:1301 hits: 06-18 to 09-29]
b5919931fe
[Firefox:688 hits: 06-20 to 09-29] none[4]
73f1082158[1]
b5919931fe[1] Win2K-f 0 of 32 03:25:26 20:46:53 12 none none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| 48% none
lines=81
lines=90 trace
trace
trace

93385541f3
[Firefox:29 hits: 06-22 to 09-27] none[4] WinXP 32 of 32 07:31:50 07:31:50 1 none none:none
none|none none trace

53bfe15e91
[Firefox:2628 hits: 06-17 to 09-29]
57ce4acac2
[Firefox:217 hits: 06-17 to 09-29] none[4]
57ce4acac2[1] Win2K-f 0 of 33 03:25:26 22:28:42 4 none none:none
ASM:Graph
tElock|
Armadillo| 47% none
lines=81 trace
trace

40870345c3
[Firefox: 3 hits: 09-22 to 09-25] none[none] Win2K-f 0 of 0 15:48:47 15:48:47 1 none none:none
none|none none none

039e3fa376
[Firefox: 6 hits: 07-24 to 09-29] none[none] Win2K-f 33 of 35 03:23:22 23:57:55 2 none none:none
none|none none none

1a2c0e6130
[Firefox:439 hits: 12-31 to 09-29] 048df78048 [0] WinXP 29 of 29 13:07:16 16:57:58 2 none ASM:Graph
none|none 100% lines=61 trace

4ca3056804
[Firefox: 4 hits: 06-18 to 07-06] 4ca3056804 [1] WinXP 1 of 33 22:55:08 22:55:08 1 none ASM:Graph
Armadillo| 47% lines=81 trace

53bfe15e91
[Firefox:2628 hits: 06-17 to 09-29]
a08f3b74a4
[Firefox:926 hits: 06-18 to 09-29] none[4]
a08f3b74a4[1] Win2K-f
WinXP 0 of 33 03:42:58 23:53:51 10 none none:none
ASM:Graph
tElock|
Armadillo| 47% none
lines=81 trace
trace

b872c76081
[Firefox:29 hits: 09-13 to 09-28] none[none] WinXP 36 of 36 08:50:24 13:13:47 2 none none:none
none|none none none

7f89b38665
[Firefox:17 hits: 08-02 to 09-26]
a51a50404e
[Firefox:17 hits: 08-02 to 09-26] none[none]
none [none] Win2K-f 34 of 36 14:49:20 14:49:20 1 none none:none
none:none
none|none
none|none none
none none
none

95d9507747
NEW none[none] WinXP 33 of 33 13:56:14 13:56:14 1 none none:none
none|none none none

0c01728b7e
[Firefox: 3 hits: 08-30 to 09-28] none[none] Win2K-f 36 of 36 08:51:35 08:51:35 1 none none:none
none|none none none

a0139d7ad8
[Firefox:126 hits: 01-03 to 09-29] d9e9662db1 [0] WinXP 29 of 29 07:54:47 16:33:36 2 none ASM:Graph
PolyEnE| 99% lines=68 trace

87e1117f2a
[Firefox: 9 hits: 07-18 to 09-24]
b4fe4581c3
[Firefox: 9 hits: 07-18 to 09-24] none[none]
none [none] Win2K-f 29 of 33 09:22:22 09:22:22 1 none none:none
none:none
none|none
none|none none
none none
none

330eaa2da2
[Firefox:20 hits: 01-28 to 09-29] none[3] WinXP 28 of 29 06:28:24 06:28:24 1 none none:none
ASPack| none trace

c019bc8764
NEW none[none] WinXP 35 of 36 22:41:06 22:41:06 1 none none:none
none|none none none

6a7fb64400
[Firefox: 2 hits: 09-28 to 09-29] none[none] WinXP 5 of 36 05:49:29 05:49:29 1 none none:none
none|none none none

686d4ca67b
[Firefox: 7 hits: 07-08 to 09-15] none[none] Win2K-f 32 of 33 23:44:33 23:44:33 1 none none:none
none|none none none

2e9f4c97cc
NEW none[none] WinXP 34 of 36 07:18:52 07:18:52 1 none none:none
none|none none none

71d5528293
[Firefox: 4 hits: 09-13 to 09-17] none[none] WinXP 35 of 36 09:39:12 09:39:12 1 none none:none
none|none none none

0d3fafbf29
[Firefox: 4 hits: 06-21 to 09-19]
b5919931fe
[Firefox:688 hits: 06-20 to 09-29]
d401773a07
[Firefox: 4 hits: 06-21 to 09-19] 0d3fafbf29 [1]
b5919931fe[1]
none [4] Win2K-f 29 of 33 08:45:27 08:45:27 1 none ASM:Graph
ASM:Graph
none:none
Armadillo|
ASProtect|
tElock| lines=82
lines=90
none trace
trace
trace

8a75955033
[Firefox:37 hits: 06-20 to 09-29]
9276c8b36b
[Firefox:37 hits: 06-20 to 09-29] none[4]
9276c8b36b[1] WinXP 28 of 32 00:50:36 00:50:36 1 none none:none
ASM:Graph
tElock|
Armadillo| 47% none
lines=81 trace
trace

4b2541d5f7
[Firefox:11 hits: 08-19 to 09-27] none[none] WinXP 35 of 36 04:01:38 07:51:54 2 none none:none
none|none none none

0d3fafbf29
[Firefox: 4 hits: 06-21 to 09-19] 0d3fafbf29 [1] Win2K-f 28 of 33 08:45:27 08:45:27 1 none ASM:Graph
Armadillo| 47% lines=82 trace

3373948767
[Firefox:26 hits: 07-03 to 09-25]
c73f738c30
[Firefox:26 hits: 07-03 to 09-25] none[none]
none [none] WinXP 29 of 33 20:57:57 20:57:57 1 none none:none
none:none
none|none
none|none none
none none
none

40870345c3
[Firefox: 3 hits: 09-22 to 09-25]
6c539a9f23
[Firefox: 3 hits: 09-22 to 09-25] none[none]
none [none] Win2K-f 0 of 0 15:48:47 15:48:47 1 none none:none
none:none
none|none
none|none none
none none
none

ab695d30ef
NEW none[none] WinXP 36 of 36 03:21:45 03:21:45 1 none none:none
none|none none none

df17a625ee
[Firefox:259 hits: 01-01 to 09-29] 9bbdd086c5 [0] WinXP 29 of 29 06:06:37 06:06:37 1 none ASM:Graph
ASPack| 49% lines=186
embedded dns trace

c05385e600
[Firefox:18 hits: 01-20 to 09-27] 6a383b021d [0] WinXP 29 of 29 08:01:03 08:01:03 1 none ASM:Graph
PolyEnE| 99% lines=68 trace

58408136a4
[Firefox:19 hits: 06-28 to 09-23]
7655e4d162
NEW none[none]
none [none] Win2K-f 34 of 36 11:06:03 11:06:03 1 none none:none
none:none
none|none
none|none none
none none
none

039e3fa376
[Firefox: 6 hits: 07-24 to 09-29]
57563d3af4
NEW none[none]
none [none] Win2K-f 0 of 36 23:57:55 23:57:55 1 none none:none
none:none
none|none
none|none none
none none
none

4c3df24b32
[Firefox:204 hits: 06-17 to 09-29]
e2e45762bf
NEW 4c3df24b32 [1]
none [none] Win2K-f 34 of 36 14:31:22 14:31:22 1 none ASM:Graph
none:none
Armadillo|
none|none lines=81
none trace
none

53bfe15e91
[Firefox:2628 hits: 06-17 to 09-29]
a08f3b74a4
[Firefox:926 hits: 06-18 to 09-29]
e07c29c4ae
[Firefox:529 hits: 06-19 to 09-29] none[4]
a08f3b74a4[1]
e07c29c4ae[1] WinXP 0 of 33 00:50:36 23:53:51 6 none none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| 48% none
lines=81
lines=92 trace
trace
trace

382279b44f
[Firefox:258 hits: 05-22 to 09-29] 049e62d55b [0] Win2K-f
WinXP 19 of 32 05:04:17 14:06:37 5 none ASM:Graph
Armadillo| 50% lines=192 trace

ca47a36342
[Firefox: 9 hits: 02-16 to 09-29] c3a58f69c6 [0] WinXP 26 of 28 09:42:36 09:42:36 1 none ASM:Graph
PolyEnE| 100% lines=89
embedded dns trace

eca9a5fa95
[Firefox:22 hits: 08-09 to 09-29] none[none] WinXP 36 of 36 09:16:57 21:50:07 2 none none:none
none|none none none

8a75955033
[Firefox:37 hits: 06-20 to 09-29] none[4] WinXP 29 of 32 00:50:36 00:50:36 1 none none:none
tElock| none trace

5f173c9c43
NEW
ed28244121
NEW none[none]
none [none] Win2K-f 33 of 36 01:02:56 01:02:56 1 none none:none
none:none
none|none
none|none none
none none
none

31dbe08df8
NEW none[none] WinXP 35 of 36 10:32:28 10:32:28 1 none none:none
none|none none none

57ce4acac2
[Firefox:217 hits: 06-17 to 09-29]
83f26f5044
[Firefox:22 hits: 06-20 to 09-29] 57ce4acac2 [1]
none [4] Win2K-f 29 of 32 18:57:14 18:57:14 1 none ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

7f60162c2c
[Firefox:647 hits: 12-31 to 09-29] 1aad8e4632 [0] WinXP 25 of 25 08:24:18 23:11:03 7 none ASM:Graph
PolyEnE| 100% lines=93
embedded dns trace

6a7fb64400
[Firefox: 2 hits: 09-28 to 09-29]
8390780c27
[Firefox:38 hits: 06-18 to 09-29]
91dc355a93
[Firefox:20 hits: 09-25 to 09-29] none[none]
none [4]
none [none] WinXP 15 of 36 05:49:29 05:49:29 1 none none:none
none:none
none:none
none|none
tElock|
none|none none
none
none none
trace
none

776985f561
[Firefox:15 hits: 06-24 to 09-24] 776985f561 [1] WinXP 31 of 33 11:29:25 22:17:46 2 none ASM:Graph
Armadillo| 47% lines=82 trace

b74e792974
[Firefox:10 hits: 06-18 to 09-22] b74e792974 [1] Win2K-f 31 of 33 18:32:27 18:32:27 1 none ASM:Graph
Armadillo| 47% lines=82 trace

ea096a2bdf
[Firefox:17 hits: 07-12 to 09-25] none[none] WinXP 31 of 32 07:04:22 07:04:22 1 none none:none
none|none none none

9eff47183a
NEW none[none] WinXP 32 of 36 11:53:28 11:53:28 1 none none:none
none|none none none

f0b49cdcfc
[Firefox:16 hits: 07-04 to 09-20] none[none] WinXP 33 of 33 22:49:57 22:49:57 1 none none:none
none|none none none

3373948767
[Firefox:26 hits: 07-03 to 09-25] none[none] WinXP 30 of 33 20:57:57 20:57:57 1 none none:none
none|none none none

a3b8b12699
NEW none[none] Win2K-f 10 of 36 17:41:51 17:41:51 1 none none:none
none|none none none

3b069bdf62
NEW none[none] WinXP 35 of 36 08:47:24 08:47:24 1 none none:none
none|none none none

717cda1f48
NEW
e43035f06b
NEW none[none]
none [none] WinXP 34 of 36 06:45:31 06:45:31 1 none none:none
none:none
none|none
none|none none
none none
none

31dbe08df8
NEW
78a1dce44a
NEW none[none]
none [none] WinXP 32 of 36 10:32:28 10:32:28 1 none none:none
none:none
none|none
none|none none
none none
none

06799205df
NEW none[none] WinXP 35 of 36 01:40:57 01:40:57 1 none none:none
none|none none none

73ce2b74da
[Firefox:17 hits: 06-18 to 09-28]
79c01ec060
[Firefox:47 hits: 06-18 to 09-28] 73ce2b74da [1]
none [4] Win2K-f
WinXP 33 of 33 12:58:41 16:24:24 2 none ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

7d99b0e910
[Firefox:1193 hits: 12-31 to 09-29] 7a70e1b592 [0] WinXP 26 of 28 02:19:19 23:46:29 16 none ASM:Graph
PolyEnE| 99% lines=68 trace

7b84f08f30
NEW none[none] Win2K-f 21 of 36 17:46:36 17:46:36 1 none none:none
none|none none none

776985f561
[Firefox:15 hits: 06-24 to 09-24]
8ec6129efe
[Firefox:15 hits: 06-24 to 09-24] 776985f561 [1]
none [4] WinXP 31 of 33 22:17:46 22:17:46 1 none ASM:Graph
none:none
Armadillo|
tElock| lines=82
none trace
trace

aaf4077b09
NEW none[none] Win2K-f 20 of 35 03:36:17 03:36:17 1 none none:none
none|none none none

b74e792974
[Firefox:10 hits: 06-18 to 09-22]
f0e73c39a8
[Firefox:11 hits: 06-18 to 09-22] b74e792974 [1]
none [4] Win2K-f 31 of 33 18:32:27 18:32:27 1 none ASM:Graph
none:none
Armadillo|
tElock| lines=82
none trace
trace

68bb55178d
NEW none[none] WinXP 34 of 36 08:01:43 08:01:43 1 none none:none
none|none none none

7ab7b989fe
NEW none[none] WinXP 35 of 36 16:21:06 16:21:06 1 none none:none
none|none none none

58408136a4
[Firefox:19 hits: 06-28 to 09-23] none[none] Win2K-f 32 of 33 11:06:03 11:06:03 1 none none:none
none|none none none

ede5f598cf
NEW none[none] Win2K-f 9 of 12 02:56:32 02:56:32 1 none none:none
none|none none none