PDF

Print

ThreatScope Analysis Report

For file tool.exe uploaded 2012-08-03 at 09:32:35 AM

Threat level: Suspicious

This file is suspicious. Monitor communications from any machine that has run the file to detect suspicious behavior.

Threat Assessment

Writes to the filesystem in the Startup directory of the Windows Start Menu

Drops executable file(s)

Screenshots: None

File details:

Hash MD5

3c7b7124f84cc4d29aa067eca6110e2f

File size

62.27 KB

Hash SHA-1

1f7cb066f5592851e043e2365c7a022e762a8d5a

File uploaded

2012-08-03 09:32:35 AM

Hash SHA-256

d30ddc3defbee30c5e010ea64e008af39268d673bf6948060d7098b9a8302080

Report created

2012-08-03 09:34:10 AM

Technical Details

Requested HTTP URLs

The analyzed file requests the following URLs.

URL

IP Address

Category

Details

May include user agent string, HTTP server, or encryption information.

Details

Method

Status

The first item is the response type (e.g. 200, meaning OK). The second item is the size of the response.

Status

MIME

The first item is the server-declared content type. The second item is the true content type.

MIME

www.download.windowsupdate.com
/msdownload/update/v3/static/t
rustedr/en/authrootseq.txt

8.26.207.126

United States

Information Technology

User agent:

Microsoft-CryptoAPI/5.131.2600.5512

HTTP Server:

Microsoft-IIS/7.5

GET

200
18 B

text/plain

Resolved hostnames

The analyzed file used DNS to resolve the following hostnames.

Hostname

Category

IP address

download.windowsupdate.com.c.footprint.net

Information Technology

8.26.207.126

download.windowsupdate.com.c.footprint.net

Information Technology

8.26.209.126

download.windowsupdate.com.c.footprint.net

Information Technology

4.27.10.253

who.xhhow4.com

Bot Networks

184.22.171.216

IP addresses

The analyzed file requests the following IP addresses.

IP Address

ASN

8.26.207.126

AS3356 Level 3 Communications

United States

File system modifications

The analyzed file changes the following items in the file system. This type of change can be performed by both malicious and benign files.

Event

File path

Creates file

c:\Documents and Settings\Administrator\Start Menu\Programs\Startup\winnet.exe

Writes file

c:\Documents and Settings\Administrator\Start Menu\Programs\Startup\winnet.exe

Process modifications

The analyzed file affected the following system processes.

Event

File path

Creates process

Sample started

Registry


No Windows Registry changes were made.

Global system events

The following global system events were detected.

Event

Name

Creates semaphore

shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}0e2f.exe

Creates event

DINPUTWINMM

Creates mutex

microsoft.com

Creates semaphore

shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}0e2f.exe

Forcepoint has made an effort to determine if your submission is malicious however, Forcepoint cannot guarantee the accuracy of the result

Copyright © 2024 Forcepoint, Inc. All rights reserved