Examples of Mal/MSIL-EX include:
Example 1
File Information
- Size
- 353K
- SHA-1
- 08c48c51c1d4108a4c57056a3578f30a361d2a42
- MD5
- 9d18c28757b522795293f28a857801ab
- CRC-32
- 627c1143
- File type
- Windows executable
- First seen
- 2007-07-24
Runtime Analysis
Copies Itself To
- c:\Documents and Settings\test user\Local Settings\Temp\panmap.exe
Dropped Files
- c:\Documents and Settings\test user\Application Data\supportlog.dat
- c:\Documents and Settings\test user\Local Settings\Temp\support7
- Size
- 8
- SHA-1
- b633306f8f6f419c5ab921908915a3a6f57f9274
- MD5
- 4532ca73b43cdb496416161afdf54d68
- CRC-32
- ae5a37c9
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2011-01-24
- c:\Documents and Settings\test user\Local Settings\Temp\support8
- Size
- 8
- SHA-1
- 44433e4b84f01737529be9973a2b3574918aa38f
- MD5
- f4fd4ad064cc09a0e3f97af9e0173533
- CRC-32
- 405456e5
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2013-01-16
- c:\Documents and Settings\test user\Templates\CertPolEng.exe
- Size
- 6.5K
- SHA-1
- 7590af2b69e9dfaf1cb3e814615181c710f492bc
- MD5
- 928c5919d1148abb141d702b7d008e30
- CRC-32
- 5686a783
- File type
- Windows executable
- First seen
- 2013-01-06
- C:\WINDOWS\system32\install\Very Bad Blagues.exe
Registry Keys Created
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
- Policies
- C:\WINDOWS\system32\install\Very Bad Blagues.exe
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- HKLM
- C:\WINDOWS\system32\install\Very Bad Blagues.exe
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
- Policies
- C:\WINDOWS\system32\install\Very Bad Blagues.exe
- HKCU\Software\Damran
- FirstExecution
- 16/01/2013 -- 17:55
- HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{K58F3W7I-PVR5-2XXF-F13X-6EL3S65O7E16}
- StubPath
- C:\WINDOWS\system32\install\Very Bad Blagues.exe Restart
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- HKCU
- C:\WINDOWS\system32\install\Very Bad Blagues.exe
Processes Created
- c:\Documents and Settings\test user\local settings\temp\panmap.exe
- c:\Documents and Settings\test user\templates\certpoleng.exe
- c:\windows\microsoft.net\framework\v2.0.50727\applaunch.exe
- c:\windows\system32\install\very bad blagues.exe
DNS Requests
Example 2
File Information
- Size
- 690K
- SHA-1
- 11638659c4aae6205ed9cd4a9f8759bd29bb064f
- MD5
- 3ce21c446960e01df73843567b0e1663
- CRC-32
- eb77ea57
- File type
- Windows executable
- First seen
- 2013-01-07
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Local Settings\Temp\Software\_ KMS autoactivation.exe
- Size
- 176K
- SHA-1
- cca4c956c0ed0afed713a868d01bb7bb67d5c0dc
- MD5
- 68decad4f9cb9ef9bded0d544446b9ed
- CRC-32
- a46ba81c
- File type
- Windows executable
- First seen
- 2013-01-07
Processes Created
- c:\Documents and Settings\test user\local settings\temp\software\_ kms autoactivation.exe
- c:\windows\microsoft.net\framework\v2.0.50727\applaunch.exe
Example 3
File Information
- Size
- 309K
- SHA-1
- 1177802296d44ce4baccaae3433c57bd6bf23e16
- MD5
- ba92bf46eff624ced082ea5c2515b2bf
- CRC-32
- d682b630
- File type
- Windows executable
- First seen
- 2007-07-24
Runtime Analysis
Copies Itself To
- c:\Documents and Settings\test user\Local Settings\Temp\panmap.exe
Dropped Files
- c:\Documents and Settings\test user\Local Settings\Temp\UuU.uUu
- Size
- 8
- SHA-1
- 85c6e12b7e4ec07b61dc667b9c1c2e089a5567b3
- MD5
- ba90ac1c55dd342c4616ddc029585abd
- CRC-32
- 0cab600c
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2012-12-22
- c:\Documents and Settings\test user\Application Data\cglogs.dat
- c:\Documents and Settings\test user\Templates\CertPolEng.exe
- Size
- 6.5K
- SHA-1
- 7590af2b69e9dfaf1cb3e814615181c710f492bc
- MD5
- 928c5919d1148abb141d702b7d008e30
- CRC-32
- 5686a783
- File type
- Windows executable
- First seen
- 2013-01-06
- c:\Documents and Settings\test user\Local Settings\Temp\XxX.xXx
- Size
- 8
- SHA-1
- 21f3b7451b3754985d325a3dea4b0cbd23b553cc
- MD5
- c0a9d4f16af58c827be5bf9fe207419a
- CRC-32
- 9c147d9d
- File type
- application/octet-stream
- First seen
- 2011-07-11
Registry Keys Created
- HKCU\Software\nassino02
- NewGroup
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Certificate Policy Engine
- c:\Documents and Settings\test user\Templates\CertPolEng.exe
Processes Created
- c:\Documents and Settings\test user\local settings\temp\panmap.exe
- c:\Documents and Settings\test user\templates\certpoleng.exe
- c:\windows\microsoft.net\framework\v2.0.50727\applaunch.exe
DNS Requests