MD5: b72c44d894159e5ab4b85be89cfdc6fb
SHA1: 5b7d2cc20196a5904f78053a5e462940316fd3b2
SHA256: 18e4fc9a2accf43ae8e5c67975f6623c55d554893f1071e8de1acd8683a5bb1a
SSDeep: 1536:ITzg4oe7i2TCyycBLpSHinXZTCMYwIFQypXE3 EgWDpPi qsq1saGGSCI:Fe7i2TCyycbAEZGnFfxs ZapPOhOaGGY
Size: 83456 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2013-05-24 03:55:21
Analyzed on: WindowsXP SP3 32-bit

Summary:

Packed. A packed file can be a compressed and/or encrypted in a manner that prevents matching the memory image of that file and the actual file on disk. Sometimes used for copy protection, packers are often used to make Spyware less easy to analyze/detect.

Payload

No specific payload has been found.

Process activity

The Packed creates the following process(es):
No processes have been created.
The Packed injects its code into the following process(es):

%original file name%.exe:1716
ktab.exe:1812

File activity

The process %original file name%.exe:1716 makes changes in the file system.
The Packed creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Java\ktab.exe (20681 bytes)

Registry activity

The process %original file name%.exe:1716 makes changes in the system registry.
The Packed creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 19 E3 D1 BC 31 44 1E 36 9B 46 65 D7 52 6F 4C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\Java]
"ktab.exe" = "Java(TM) Platform SE binary"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

To automatically run itself each time Windows is booted, the Packed adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Startup" = "%Documents and Settings%\%current user%\Application Data\Java\Jusched.exe"

The Packed modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Packed modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Packed modifies IE settings for security zones to map all web-nodes that bypassing proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process ktab.exe:1812 makes changes in the system registry.
The Packed creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A 71 FC F7 5D 4E BA 32 C7 08 DE B7 86 66 4A DF"

Network activity (URLs)

URL	IP
hxxp://ge.tt/api/1/files/7d5fVUh/0/blob?/a.exe (Malicious)	79.125.123.149
hxxp://open.ge.tt/1/files/7d5fVUh/0/blob?referer=&user=anon-JD2okuFMB7vmzyHaBmA9qU4pQcQr3KZbeEpv1KxHf-&/a.exe= (Malicious)
hxxp://ec2-54-228-6-8.eu-west-1.compute.amazonaws.com/streams/7d5fVUh/ktab.exe?sig=-UQHUf9bRL4ZxIlDy1dNU49km7F0e5z7GqY
w540659.open.ge.tt	54.247.122.87
w909313.blob4.ge.tt	54.228.6.8

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Packed file.
   
3. Delete or disinfect the following files created/modified by the Packed:
   

   %Documents and Settings%\%current user%\Application Data\Java\ktab.exe (20681 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Startup" = "%Documents and Settings%\%current user%\Application Data\Java\Jusched.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.