Examples of Troj/MSIL-AX include:
Example 1
File Information
- Size
- 624K
- SHA-1
- d2739ff3e76e5f0b157faa3559bee64249c9027c
- MD5
- 3fa1e25a84ec324a86b30d6f44cc8f3d
- CRC-32
- 44a851e4
- File type
- Windows executable
- First seen
- 2013-01-22
Runtime Analysis
Copies Itself To
- c:\Documents and Settings\test user\Local Settings\Temp\panmap.exe
Dropped Files
- c:\Documents and Settings\test user\Templates\CertPolEng.exe
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Certificate Policy Engine
- c:\Documents and Settings\test user\Templates\CertPolEng.exe
- HKCU\Software\DC3_FEXEC
- 22/01/2013 at 03:19:12
- {8683e91a-044e-11df-871e-806d6172696f-1612674719}
Processes Created
- c:\Documents and Settings\test user\local settings\temp\panmap.exe
- c:\Documents and Settings\test user\templates\certpoleng.exe
- c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
DNS Requests
Example 2
File Information
- Size
- 503K
- SHA-1
- 99a5daa7876eea392f35fc46180e0d5e899aa74b
- MD5
- 98c92224da7744d2d71cef9dcc90e386
- CRC-32
- f99f5261
- File type
- RAR compressed archive
- First seen
- 2013-01-22
Example 3
File Information
- Size
- 475K
- SHA-1
- a7a87bcfb968cf190807f77ad6b6f5586cc0bfd4
- MD5
- 2f5b30ee9f430a3e444f91b93b448a81
- CRC-32
- 6120fa2c
- File type
- Windows executable
- First seen
- 2013-01-23
Runtime Analysis
Copies Itself To
- c:\Documents and Settings\test user\Local Settings\Temp\panmap.exe
- c:\Documents and Settings\test user\Templates\explorer.exe
Dropped Files
- c:\Documents and Settings\test user\Local Settings\Temp\support8
- c:\Documents and Settings\test user\Application Data\601F769F\ak.tmp
- Size
- 31
- SHA-1
- c28e1f12aa19cb840841e1ca9cad543f98cfc2cf
- MD5
- ba29d7401798f0513a55993f520d2eb9
- CRC-32
- f65671c1
- File type
- ASCII text / 8-bit Unicode Transformation Format
- First seen
- 2012-04-03
- c:\Documents and Settings\test user\Templates\CertPolEng.exe
Registry Keys Created
- HKCU\Software\remote
- NewGroup
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Certificate Policy Engine
- c:\Documents and Settings\test user\Templates\CertPolEng.exe
Processes Created
- c:\Documents and Settings\test user\local settings\temp\panmap.exe
- c:\Documents and Settings\test user\templates\certpoleng.exe
- c:\Documents and Settings\test user\templates\explorer.exe
- c:\windows\microsoft.net\framework\v2.0.50727\applaunch.exe
DNS Requests