MD5: d23b5b83c11bcb782ba42350b49f9f6a
SHA1: 33cd458d0cc92ee3ce160211aa12639e49e0a72c
SHA256: 4165cf2b01032eced4c340d744b1b3b0e37777b5216a7783c60a7aca220ea940
SSDeep: 49152:eUTaGzhv/9yyFivizZIAHvgv/fZmFOiresvQ XuHYGOQWR7s8D:ens/8QiviGAH4v/gIoRvQ/gwM
Size: 2094080 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, MicrosoftVisualCv60SPx, UPolyXv05_v6
Company: StarApp
Created at: 2003-03-25 09:08:18

Summary:

Packed. A packed file can be a compressed and/or encrypted in a manner that prevents matching the memory image of that file and the actual file on disk. Sometimes used for copy protection, packers are often used to make Spyware less easy to analyze/detect.

Payload

No specific payload has been found.

Process activity

The Packed creates the following process(es):

d23b5b83c11bcb782ba42350b49f9f6a.exe:2772

The Packed injects its code into the following process(es):

120.exe:3080

File activity

The process d23b5b83c11bcb782ba42350b49f9f6a.exe:2772 makes changes in a file system.
The Packed creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\PROSCA~1.EXE (19303 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\120.exe (14400 bytes)

Registry activity

The process 120.exe:3080 makes changes in a system registry.
The Packed creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 BC 6D 8F 2A 2D EA 70 65 36 52 9D F2 9C 91 3C"

The process d23b5b83c11bcb782ba42350b49f9f6a.exe:2772 makes changes in a system registry.
The Packed creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 E9 86 8A FF 89 7E 34 72 37 24 D9 C6 D5 B1 A4"

To automatically run itself each time Windows is booted, the Packed adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

Network activity (URLs)

No activity has been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   d23b5b83c11bcb782ba42350b49f9f6a.exe:2772

2. Delete the original Packed file.
   
3. Delete or disinfect the following files created/modified by the Packed:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\PROSCA~1.EXE (19303 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\120.exe (14400 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
   "wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.