Analysis Report for 44847895

Comment on this report

Summary:

Description	Risk
AV Hit: This executable is detected by an antivirus software.

Table of Contents
expand all	collapse all
General information 44847895.exe C:\44847895.exe Primary Analysis Subject General Information a) Registry Activities b) File Activities

1. General Information

	- Information about Anubis' invocation

Time needed:	253 s
Report created:	04/21/11, 07:38:03 UTC
Termination reason:	Timeout
Program version:	1.75.3394

2. 44847895.exe

	- General information about this executable

Analysis Reason:	Primary Analysis Subject
Filename:	44847895.exe
MD5:	0be78489267544eb775ee68500af5849
SHA-1:	ebb48f00b4217c7c0ca6f2d78370200d2ce617a5
File Size:	45056 Bytes
Command Line:	"C:\44847895.exe"
Process-status at analysis end:	alive
Exit Code:	0

	- Load-time Dlls

Module Name	Base Address	Size
C:\WINDOWS\system32\ntdll.dll	0x7C900000	0x000AF000
C:\WINDOWS\system32\kernel32.dll	0x7C800000	0x000F6000
C:\WINDOWS\system32\USER32.dll	0x7E410000	0x00091000
C:\WINDOWS\system32\GDI32.dll	0x77F10000	0x00049000

	- Ikarus Virus Scanner

P2P-Worm.Win32.Palevo (Sig-Id:1503840)

2.a) 44847895.exe - Registry Activities

	- Registry Values Read:

Key	Name	Value	Times
HKLM\System\CurrentControlSet\Control\Terminal Server	TSAppCompat	0	2

2.b) 44847895.exe - File Activities

	- File System Control Communication:

File	Control Code	Times
C:\Program Files\Common Files\	0x00090028	1

International Secure Systems Lab
Vienna University of Technology, Eurecom France, UC Santa Barbara
Contact: anubis@iseclab.org