Troj/FakeAV-FMS exhibits the following characteristics:
File Information
- Size
- 246K
- SHA-1
- df8d7d43b1e3be1bb405d8a04f200a011226467a
- MD5
- 15efb16bb89b4eef85f663acc6d8a683
- CRC-32
- c34987f9
- File type
- application/x-ms-dos-executable
- First seen
- 2012-01-27
Runtime Analysis
Copies Itself To
- C:\Documents and Settings\All Users\Application Data\Nda_pBTp3Cza=.exe
Dropped Files
- c:\Documents and Settings\test user\Desktop\Data_Recovery.lnk
- Size
- 832
- SHA-1
- af72a3b74f17ca216b3cccc1da737a4144f50a98
- MD5
- 247fa15bdca71b614ddfc84489dc6f62
- CRC-32
- bd822a4f
- File type
- application/octet-stream
- First seen
- 2012-05-03
- c:\Documents and Settings\test user\Start Menu\Programs\Data Recovery\Data Recovery.lnk
- Size
- 844
- SHA-1
- 999062cd435a9e219ce212117b088df4323a3645
- MD5
- 1f9cddb8c09aa37bd4ba71ee358ea702
- CRC-32
- 8d78ba1b
- File type
- application/octet-stream
- First seen
- 2012-05-03
- C:\Documents and Settings\All Users\Application Data\Nda_pBTp3Cza=
- Size
- 256
- SHA-1
- e3337da5a28073397e61eb66df98063b391d36a0
- MD5
- 97a42db1cac7425925cc23d87b6d91cd
- CRC-32
- fa1002c6
- File type
- application/octet-stream
- First seen
- 2012-05-03
- C:\Documents and Settings\All Users\Application Data\-Nda_pBTp3Cza=r
- Size
- 184
- SHA-1
- 067f2ff2bcfb49404be262c501861d33e04fed8e
- MD5
- ef09c931aeffb31ed47092c929e3b701
- CRC-32
- 63754f1f
- File type
- application/octet-stream
- First seen
- 2012-05-03
- c:\Documents and Settings\test user\Application Data\Microsoft\Internet Explorer\Quick Launch\Data_Recovery.lnk
- Size
- 850
- SHA-1
- d0eafb11ac4d2277dc797d819862604dc472ae26
- MD5
- 8daca0aaa11f9f918e8014d6e5f86417
- CRC-32
- 727ea028
- File type
- application/octet-stream
- First seen
- 2012-05-03
- c:\Documents and Settings\test user\Start Menu\Programs\Data Recovery\Uninstall Data Recovery.lnk
- Size
- 916
- SHA-1
- 74d36a9b51cc5383836d0a82a5629df0e178446a
- MD5
- cd9e53429be8991ff8faad3ca3ffa847
- CRC-32
- 89ad4fc9
- File type
- application/octet-stream
- First seen
- 2012-05-03
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
- WarnOnZoneCrossing
- 0x00000000
- HKCU\Software\Microsoft\Internet Explorer\Main
- Use FormSuggest
- Yes
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments
- SaveZoneInformation
- 0x00000001
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
- LowRiskFileTypes
- .zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.scr;
- HKCU\Software\Microsoft\Internet Explorer\Download
- CheckExeSignatures
- no
- HKCU\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
- State
- 0x00023e00
Processes Created
- c:\docume~1\alluse~1\applic~1\nda_pbtp3cza=.exe
HTTP Requests
- http://meijeroneca.com/support/s
- http://nardelfire.com/s.php
- http://psardcreator.com/support/s
- http://psardcreator.com/support/sr
DNS Requests
- meijeroneca.com
- nardelfire.com
- psardcreator.com