File: 87225c142a540789709a69dd3ce55ef9788e75d80e5ef650d02773e18db29c1f
Metadata
| office.exe | |
| PE32 executable (GUI) Intel 80386, for MS Windows | 555520 bytes |
| 2016-04-12 23:14:35 | |
| 4e3a0ce170d66eaea6d55a3d6c551653 | |
| 3fee1f034b37472646c5744a52ac25172d61091b | |
| 87225c142a540789709a69dd3ce55ef9788e75d80e5ef650d02773e18db29c1f | |
| 0cd0e3cf6de2774bbb20497f92505c7f2bef924cef5e334cbc7cdb34ea2d912c1afe7ecf596436c41cb9c93081d5519f4858452e68a14f2fcfc4208aab39dd21 | |
| 12288:XECBbdraXKsTcOFZxj9OfsUyVCRg85WOKnrPQFAx+qVKIfuCx:UCJdrUTVF3j9OfsUVR/WVrPfx+qkIGy | |
| 4f5bfb46ffce85b9d41feaeaafa9424b | |
| N/A | |
APTNotes
Cyber threat intelligence reports associated with 87225c142a540789709a69dd3ce55ef9788e75d80e5ef650d02773e18db29c1f.
Cyber threat intelligence reports associated with 87225c142a540789709a69dd3ce55ef9788e75d80e5ef650d02773e18db29c1f.
Domains
Domains the malware sample communicates with.
Domains the malware sample communicates with.
| Domain | IP |
|---|---|
| z1.zedo.com | 184.25.56.187 |
Hosts
Hosts the malware sample communicates with.
Hosts the malware sample communicates with.
HTTP Requests
HTTP requests the malware sample makes.
HTTP requests the malware sample makes.
| Host | URL | User-Agent |
|---|---|---|
| z1.zedo.com | /robots.txt |
AV Detections
AV detection names associated with the malware sample.
AV detection names associated with the malware sample.
| AVware | Trojan.Win32.Generic!BT |
| Ad-Aware | Trojan.GenericKD.3151887 |
| AegisLab | Troj.Ransom.W32.Foreign!c |
| Arcabit | Trojan.Generic.D30180F |
| Avast | Win32:Malware-gen |
| Avira | TR/Crypt.Xpack.afqc |
| BitDefender | Trojan.GenericKD.3151887 |
| Bkav | HW32.Packed.CF94 |
| DrWeb | Trojan.PWS.Papras.2046 |
| ESET-NOD32 | a variant of Win32/Kryptik.EUCQ |
| Emsisoft | Trojan.GenericKD.3151887 (B) |
| F-Secure | Trojan.GenericKD.3151887 |
| GData | Trojan.GenericKD.3151887 |
| Ikarus | Trojan.Win32.Crypt |
| Kaspersky | Trojan-Ransom.Win32.Foreign.nary |
| McAfee-GW-Edition | BehavesLike.Win32.Worm.hc |
| MicroWorld-eScan | Trojan.GenericKD.3151887 |
| Microsoft | Backdoor:Win32/Drixed |
| Qihoo-360 | HEUR/QVM10.1.Malware.Gen |
| Rising | PE:Malware.XPACK-HIE/Heur!1.9C48 [F] |
| Sophos | Troj/Gozi-CL |
| Symantec | Trojan Horse |
| Tencent | Win32.Trojan.Inject.Auto |
| TrendMicro | TSPY_DRIDEX.YYSTA |
| TrendMicro-HouseCall | TSPY_DRIDEX.YYSTA |
| VIPRE | Trojan.Win32.Generic!BT |
| ViRobot | Trojan.Win32.Agent.555520.A[h] |
Mutants
Mutants created by the malware sample.
Mutants created by the malware sample.
Registry keys
Registry keys created by the malware sample.
Registry keys created by the malware sample.
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Offload |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
| HKEY_LOCAL_MACHINE\Software\Microsoft\COM3 |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004_Classes |
| HKEY_LOCAL_MACHINE\Software\Classes |
| \REGISTRY\USER |
| HKEY_LOCAL_MACHINE\Software\Classes\CLSID |
| CLSID\{00000000-0000-0000-0000-000000000000} |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\App Management |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\App Management |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName |
| ActiveComputerName |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| HKEY_USERS\ |
| HKEY_USERS\\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
| HKEY_USERS\\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Run |
| HKEY_USERS\\S-1-5-21-1547161642-507921405-839522115-1004\Software\AppDataLow\Software\Microsoft\FD95D1E9-385F-3719-2A81-EC5BFE45E0BF |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor |
| HKEY_CURRENT_USER\Software\Microsoft\Command Processor |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\LevelObjects |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
| {dda3f824-d8cb-441b-834d-be2efd2c1a33} |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Option |
| HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\FD95D1E9-385F-3719-2A81-EC5BFE45E0BF |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RASAPI32 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004 |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Windows NT\CurrentVersion\Winlogon |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Environment |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Volatile Environment |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004_Classes\Software\Microsoft\windows\CurrentVersion\Internet Settings |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004_Classes\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections |
| HKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_URLHOSTNAME |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\Domains\zedo.com |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\zedo.com |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\ProtocolDefaults\ |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache |
| CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4} |
| CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\TreatAs |
| \CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4} |
| \CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32 |
| \CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServerX86 |
| \CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\LocalServer32 |
| \CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocHandler32 |
| \CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocHandlerX86 |
| \CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4} |
| HKEY_CLASSES_ROOT\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\TreatAs |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\SecurityService |
| CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2} |
| CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\TreatAs |
| \CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2} |
| \CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\InprocServer32 |
| \CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\InprocServerX86 |
| \CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\LocalServer32 |
| \CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\InprocHandler32 |
| \CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\InprocHandlerX86 |
| \CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\LocalServer |
| HKEY_CLASSES_ROOT\CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2} |
| HKEY_CLASSES_ROOT\CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\TreatAs |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{B83AF3AB-4FED-45D1-A8B8-9E66F3411813} |
| HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\MS TCP Loopback interface |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF |
| HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\SystemShared |
Comments
User comments about 87225c142a540789709a69dd3ce55ef9788e75d80e5ef650d02773e18db29c1f.
User comments about 87225c142a540789709a69dd3ce55ef9788e75d80e5ef650d02773e18db29c1f.
