Examples of Mal/DotNetRes-A include:
Example 1
File Information
- Size
- 779K
- SHA-1
- 18b770641601d7a97fd360e7c5a03ec9db3a804e
- MD5
- 542e7e8660577dbcefdc6ff8f7178cc6
- CRC-32
- 27ded300
- File type
- Windows executable
- First seen
- 2012-08-05
Other vendor detection
- Avira
- TR/Dropper.Gen
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Local Settings\Temp\UuU.uUu
- Size
- 8
- SHA-1
- 31f7c02116739f43c787e8d8e13c8fc0dd751fb2
- MD5
- e1cc0fc308779fd0833d3978d2b70460
- CRC-32
- 2eefee07
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2013-02-08
- c:\Documents and Settings\test user\Local Settings\Temp\XxX.xXx
- Size
- 8
- SHA-1
- e0ed4d1268e1683a34b0a3a9e21c802573b23cee
- MD5
- 229b9b03cc044940264ad4f37fd07d82
- CRC-32
- 59e8de91
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2012-08-16
- c:\Documents and Settings\test user\Application Data\logs.dat
- Size
- 271
- SHA-1
- 808ec0f493388b0a402250b3c231525f8068be58
- MD5
- 145c2e2b39c452b68dac106a87415fb6
- CRC-32
- e375ab9f
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2013-02-08
- c:\Documents and Settings\test user\Application Data\hd crack.txt
- Size
- 452
- SHA-1
- 4ab98fdbea950931db3ab7edc8a858fb607cb9e6
- MD5
- a8f6a8f88788f2f2742ec2d571cb2d37
- CRC-32
- 6d5ffeeb
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2012-08-05
Modified Files
- %SYSTEM%
- Set the readonly, hidden and system flags
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
- Services
- C:\WINDOWS\system32\win32.exe
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
- Services
- C:\WINDOWS\system32\win32.exe
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Win32
- C:\WINDOWS\system32\win32.exe
- HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{B70210F1-H134-UR8L-3QY2-7VP53FW8PH7W}
- StubPath
- C:\WINDOWS\system32\win32.exe
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Win32
- C:\WINDOWS\system32\win32.exe
- HKCU\Software\norival
- FirstExecution
- 08/02/2013 -- 19:23
Processes Created
- c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
- c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
- c:\windows\system32\notepad.exe
- c:\windows\system32\win32.exe
DNS Requests
Example 2
File Information
- Size
- 696K
- SHA-1
- 60c6ccb09880a3b8ab3a79707258c4f734a8937e
- MD5
- 2d3848f6951911417d2e509502fd9ebf
- CRC-32
- 25d075de
- File type
- Windows executable
- First seen
- 2012-08-05
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Local Settings\Temp\IMAG1055.JPG
- Size
- 101K
- SHA-1
- e5e52b5ab0fdeeeabed47212eaa3a66098199220
- MD5
- e31332b174fd76111d8917c64460fb49
- CRC-32
- 54dee44b
- File type
- JPEG Interchange Format
- First seen
- 2012-08-06
Modified Files
- %WINDOWS%
- Set the hidden and system flags
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Svost
- C:\WINDOWS\Svost.exe
Registry Keys Modified
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- Userinit
- C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\Svost.exe
Processes Created
- c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
- c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
- c:\windows\svost.exe
- c:\windows\system32\attrib.exe
- c:\windows\system32\cmd.exe
- c:\windows\system32\rundll32.exe
Example 3
File Information
- Size
- 2.1M
- SHA-1
- 836c782f2d4f1b8953e6cd5aa3623548eae13949
- MD5
- 235b44f197dfae0dd13aa715ec6cf5f8
- CRC-32
- 37c76d8f
- File type
- Windows executable
- First seen
- 2012-08-05
Runtime Analysis
Copies Itself To
- c:\Documents and Settings\test user\Application Data\javalk.exe
Dropped Files
- c:\Documents and Settings\test user\Local Settings\Temp\jusched.log
- Size
- 53
- SHA-1
- 7a7be37c177d9881490f88d7fda8e1845a1895cf
- MD5
- b033b27509c60af794f5fa8a3e99dd2d
- CRC-32
- 34dbe512
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2012-08-06
- c:\Documents and Settings\test user\Application Data\javalk.exe_ADS_AlternateDataStream_Found_zone.identifier
- Size
- 28
- SHA-1
- 660144ed130e034d738d8fcfacf9a3716447013a
- MD5
- 52266075b9cadf4377b74118cb899548
- CRC-32
- 44a25efe
- File type
- Configuration Data File (generic)
- First seen
- 2011-03-26
- c:\Documents and Settings\test user\Application Data\fp.txt
- Size
- 29
- SHA-1
- cd17007016116a412c21049e58093856b2829a12
- MD5
- 234baee1606d7db3c8a330578cee8723
- CRC-32
- edd3ef23
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2012-08-06
- c:\Documents and Settings\test user\Local Settings\Temp\jx.exe
- Size
- 872K
- SHA-1
- c8d1a4b74fd774718ad5d2210e5db1a8c57f931c
- MD5
- f6167efc4d1ef0d0e2739a521f6c87d0
- CRC-32
- f96beff4
- File type
- Windows executable
- First seen
- 2012-05-28
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- javams
- c:\Documents and Settings\test user\Application Data\javalk.exe
Processes Created
- c:\Documents and Settings\test user\local settings\temp\jx.exe
- c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
- c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
- c:\windows\system32\cmd.exe
DNS Requests
- essstzttztz.zapto.org
- javadl-esd.sun.com