[nsp-sec] MayDay botnet?

Thu Feb 14 16:21:53 EST 2008

On Thu, 14 Feb 2008, John Fraizer wrote:

> As much information as I can get my hands on.  Its prominence in the 
> press as of late has higher-ups asking me questions.  I want to be able 
> to give them the drawn in crayon version but, I want the hi-res glossy 
> version for myself. :)

one of my guys unpacked it and we ran my auto-static analyzer over it, the 
summary report is below. disasm (via IDA) and strings also available.

in short it matches the symantec writeup, but this adds some more lines i 
hope. we didn't detect any of the ICMP communications that dagon claimed 
it did, and we didn't detect any ICMP Win API calls or packet contents in 
a dynamic analkysis, either.

the sizes, hashes, etc all are bogus for the real version since this is an 
unpacked version.

BASIC INFO:
-----------------------------------------------
FILE TYPE:     application/x-ms-dos-executable
FILE SIZE:     397312 bytes
PACKER/S:     [FSG v1.10 (Eng) -> dulek/xt]
-----------------------------------------------

URLS:
-----------------------------------------------
http://75.126.177.141/~merc27dc/cgi-bin
http://75.126.177.141/~merc27dc/cgi-bin/gate.cgi',0
http://www.maydaynet2008.co.uk/cgi-bin/
http://www.maydaynet2008.co.uk/cgi-bin/gate.cgi',0
-----------------------------------------------

FILENAMES:
-----------------------------------------------
.dll
NTDLL.DLL
USER32.dll
.exe
KERNEL32.DLL
mscoree.dll
kernel32.dll
USER32.DLL
Ws2_32.dll
Kernel32.dll
Advapi32.dll
PSAPI.dll
Ole32.dll
Wininet.dll
Dnsapi.dll
KERNEL32.dll
C:\DOCUME~1\asert\LOCALS~1\Temp\svchost.exe
C:\DOCUME~1\asert\LOCALS~1\Temp\svchost.exe
user32.dll
-----------------------------------------------

POSSIBLE REGISTRY KEYS:
-----------------------------------------------
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\IcmpSettings
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
Software\Microsoft\Windows\CurrentVersion\Run
-----------------------------------------------

POSSIBLE HOSTNAMES:
-----------------------------------------------
.com
Visibleimpact.Com
usnewscenter.com
Ukplanet.Com
The-Factor.Com
talkcollege.com
Skywebsite.Com
Seventies.Net
selfimprovements.com
Schoolmatters.Com
quotedeal.com
pctopc.com
parentingdirectory.com
nicepages.com
newsbeats.com
motorcyclesnet.com
Modernwoman.Com
Minnesotalotto.Com
Militaryrecords.Net
maphq.com
Mackdaddy.Com
Lovecalifornia.Com
kingdomlinks.com
Kentuckyattractions.Com
hurricaneweather.com
hurricanenews.com
harleylinks.com
greaternet.com
gloriousnet.com
Floridanatives.Com
Floridamotor.Com
Floridabiker.Com
favoritepages.com
fabulousweb.com
criminalrecords.net
BRIDALPLANNER.COM
Bikemessengers.Com
bestcoolsites.com
Angelpictures.Net
Aerialphotos.Net
Uniquevisitors.biz
Selfimprovement.biz
Policereports.biz
Newscenter.biz
Manufacturedhomes.biz
Localweather.biz
Lawdegree.biz
Jacksonvillebeach.biz
Intelligentdesigns.biz
Homeauctions.biz
Holidaydecorating.biz
Governmentauctions.biz
Extrememakeovers.biz
Decoratingideas.biz
Classreunions.biz
Bathroomdesign.biz
Websitedesigns.org
Vegasvacation.org
Rolemodels.org
Plumbingfixtures.org
Lightingfixtures.org
Fernandinabeach.org
Extrememakeovers.org
Nursingscholarships.net
Kitchenremodeling.net
Decorativeideas.net
Americasmostwanted.net
Premierbathtubs.com
Landscapinglighting.com
Landscape-Lighting.com
Iqratings.com
Holidaypromotion.com
Graduatedegreeprogram.com
Fatride.com
Excellentsites.com
Degreenews.com
Decorativeideas.com
Creatememories.com
Continuelearning.com
Chocolateturtles.com
Calendarsearch.com
Bronxonline.com
Bathroom-Fixtures.com
Associates-Degree.com
Tattoogallery.biz
Photocontest.net
Hotornot.net
Freegreetings.net
Entertains.net
Beautifulpictures.net
Poetrytonight.com
Jokesoftheday.com
Hystericalhumor.com
Humorshop.com
Hotmag.com
Greetingsmail.com
Greetingmail.com
Greatreviews.com
Freefunnyjokes.com
Epopularity.com
Downloadmoviez.com
Bikiniscreensavers.com
Aliasfan.com
Rentdvds.org
Karaokeequipment.net
Realitytv.info
Celebritynews.info
Smartjokes.com
Rentdvdmovies.com
Redneckfun.com
Judgemybody.com
Funnypolls.com
Discounthdtvs.com
Celebrityjokes.com
Tkts.biz
Missamerica.biz
Horrorfilms.biz
Funnyjokes.biz
Electronicpostcards.net
Downloadsoftware.net
Windowsfreeware.com
Ultimatefreebies.com
Screensaversnet.com
Megafreestuff.com
Justfreeweb.com
Justfreebies.com
Gimmefreestuff.com
Getwallpapers.com
Getfonts.com
Freebiztools.com
Findfreebies.com
Downloadusa.com
Desktophorizon.com
Clipartplanet.com
Cdshareware.com
Bestskins.com
Animationstation.com
Allfreeart.com
Absolutelyfreestuff.com
Freewebsite.info
Freedvds.info
Freewebpages.biz
Freevideogames.biz
Freelivecams.biz
Freeinsurancequotes.biz
Freecards.biz
Freecreditscores.org
Freecreditrepair.org
Freewaresoftware.net
Freewebsurfing.com
Freelifequote.com
Freegamecube.com
Freecashonline.com
Free-Canada.com
wavfilez.com
songspider.com
songlyric.net
Songdirectory.Com
Sheetmusicpro.Com
sheetmusicguide.com
searchlyrics.com
Rockmusicnews.Com
rockvideos.net
pcjam.com
music-player.com
musichaggle.com
musicadvertisers.com
mp3metasearch.com
Mp3Megasearch.com
mp3magnet.com
mp3hotlist.com
mp3find.net
mp3dd.net
mp3crypt.com
lyricserver.com
lyricsearch.net
Loveguitar.Com
legalmp3s.net
guitarsearch.com
guitarresources.com
fullmp3s.com
freemusicmachine.com
freemusicfinder.com
freemp3tools.com
Freecdmusic.Com
electricguitar.org
Discvault.Com
Digitalmp3Player.Com
audiovalley.com
audiograb.com
Musicgifts.info
Kazza.info
Freesongs.info
Electricguitar.info
Acousticguitar.info
Voicelessons.biz
Rockposters.biz
Remixes.biz
Musicgifts.biz
Musicdownloads.biz
Musicboxes.biz
Guitarparts.biz
Guitarchords.biz
Videoguitarlessons.com
Musicnews.org
Freemp3Download.org
Lead-Guitar.com
Latinmusicvideos.com
Countrylyricsearch.com
Pokemonyellow.net
Gamehints.net
Contestants.net
Computergamer.net
Cardcentral.net
Playstationcheats.net
Gameboycolor.net
Wirelesswebgames.com
Sweepstaker.com
Psxplanet.com
Prizeoffers.com
Playstationshop.com
Playstationplanet.com
Playstationhints.com
Playstationcentral.com
Playgamez.com
Justprizes.com
Gamecrawler.com
Fastgamesnow.com
Cubez.com
Coolfreegames.com
Computergamez.com
Cheatsandhints.com
Auctiongames.com
Internetgaming.Info
Gamecube.Info
Bingogames.Info
Freevideogames.Biz
Rentgames.Org
Vitalgames.Com
Ukonlinegames.Com
Psxnetwork.Com
Players-Online.Com
Newonlinegames.Com
Gamerewards.Com
Freegamecube.Com
Digitalsims.Com
wirelesscrawler.com
spidercrawler.com
Searchfindings.Com
robocrawler.com
researchwebsite.com
photoseek.net
Payperclicks.Com
midisearch.net
lawfinder.net
Internationalpeoplesearch.Com
imagesearch.net
Hugefind.Com
ftpspider.com
Findtexas.Com
Findperson.Net
Findpeople.biz
findexpert.com
ezcrawler.com
eliteseek.com
electronicresearch.com
domaincrawler.com
cyberdetectives.net
coolcrawler.com
cleancrawler.com
automobilefinder.com
ancestryfinders.com
alloftheweb.com
address-search.com
Detectives.Biz
Findaschoolmate.Com
Accuratepeoplesearch.Com
turbotravel.com
tropical-resorts.com
Skiingconditions.Com
premiertravel.biz
Nightcruise.Com
musicvacation.com
Mexicocruises.Net
jamaicainternational.com
hotjax.com
flyaway.net
Destinationtravels.Com
conceptsintravel.com
bermudaislands.net
bermudaislands.com
auctionfares.com
Alpinetravels.Com
Caribbeanresorts.Info
Traveltickets.Biz
Timessquare.Biz
Caribbeanvacation.Biz
Orlandovacations.Org
Hotelreviews.Org
Cheapmotels.Org
Cheapmotels.Net
Super-Bowl-Hotels.Com
Lesbianvacations.Com
Jaxcruise.Com
Discountcruisenetwork.Com
Warehousecellular.Com
Satellitewholesalers.Com
Phoneequipment.Net
Phonecarddistributor.Com
networkbroadcasting.com
net2phones.com
Mobilesearch.Com
HOTCELLPHONES.COM
Emailcommunications.Com
Cellphonediscounts.Com
Celldeals.Com
callingcards.biz
allyourcalls.com
Teleconferencing.info
Prepaidcellular.info
Cellphoneplan.info
Satellitesystem.biz
Payphones.biz
Internationalcalls.biz
Satellitereceivers.net
Specialringtones.com
Satellitedoctor.com
Local-Telephone.com
Learnemail.com
Cheapemail.com
YourSmallbusiness.com
Workfromhomebasedbusiness.com
Workathomemom.biz
WebpageProfits.com
WebOpp.com
WebmasterWealth.com
Wealthresources.com
WealthBuilder.biz
VirtualEarnings.com
UKprofits.com
UKmoneymaker.com
TakeOnlineSurvey.com
SuperAffiliates.info
SuperAffiliates.com
Superaffiliates.biz
SuperAffiliate.info
Superaffiliate.biz
StartupKit.com
StartmyownBiz.com
SparetimeProfits.com
SixfiguresOnline.com
SixfigureProfits.com
SixFigure.net
SFI-Affiliates.com
SFIaffiliate.com
Selfpublish.biz
SecretShopping.net
SecondIncome.org
ReferralMadness.com
PureProfits.net
ProfitSuccess.com
ProfitPlay.com
PreLaunch.org
PreLaunch.net
Perpetual-Income.com
PaidforSurvey.com
OpportunitiesNet.com
OnlineProfits.net
OnlineIncome.biz
Networkmarketingcompany.com
NetworkMarketingbiz.com
NetProfitable.com
MyfirstBillion.com
MoneymakingStrategy.com
MoneyMachines.net
MoneyinMail.com
MLMopportunity.com
MLMmomentum.com
MLMdownlineclub.com
MLMcompanies.com
MLMboard.com
Mlmarketing.com
MLMaffiliate.com
MillionaireMail.com
MedicalBilling.info
MarketingOpportunity.com
MakingMoney.org
MakeMoneyEasy.com
LowcostHomebusiness.com
InternetOps.com
InternetHomebiz.com
InternetAffiliate.com
InnovativeIncome.com
InfoEntrepreneurs.com
IncreaseWealth.com
IncomeVentures.com
IncomeOps.com
IdeasforBusiness.com
HomeworkingHeaven.com
HomeProfits.com
HomeofficeBiz.com
HomebusinessProfits.com
HomebusinessNews.com
HomebusinessEbook.com
HomebizCentral.com
HomebasedEntrepreneur.com
HomebasedCash.com
HomebasedBiz.org
GoodMoney.net
GoingPlatinum.com
FreeMall.com
FreeHomebiz.com
FortuneOpportunity.com
Findyourdream.com
ExtraMoneymaking.com
ExplodeIncome.com
EmailIncome.com
EcommerceEntrepreneurs.com
EarnCash.net
DropshippingUK.com
Downline-Club.com
CreativeIncome.com
CommissionPrograms.com
CEOentrepreneur.com
CashAttic.com
Businessopportunity.info
Business-Opp.com
BusinessLeads.biz
Businessathome.net
BuildYourDownline.com
BigCheck.net
BestMLM.net
BestHomebusinesses.com
BestHomebusiness.com
Bestbusinessopportunities.net
AuctionEntrepreneur.com
AuctionBusiness.com
Athomebusiness.org
Athomebusiness.biz
AffiliateVentures.com
AffiliateVenture.com
AAAmedicalbilling.com
WorkFromYourHome.net
WorkatHomeIdeas.net
UniversalIncome.com
ProfitableOpportunities.com
PartnerPrograms.org
Online-Ventures.com
MoneyFromHome.biz
MLMprospecting.com
MLMhomebusiness.net
MakeMoneyVending.com
HomeTypist.net
HomebasedNews.com
FinancialFreedom.biz
ExplosiveOpportunity.com
Christian-Home-Business.com
AffiliateMillionaires.com
AbundantRiches.com
MotorcycleTires.biz
VerticalBlinds.net
TruckRims.net
TruckAccesories.net
SpaFinder.net
RecreationVehicles.net
JewelryAuction.net
GroceryShop.net
FruitBasket.net
Finejewelry.net
EngagementRing.net
CustomRims.net
CoffeeBeans.net
ChromeRims.net
BuySeafood.net
BirthdayCards.net
BabyBedding.net
WinBid.com
VirtualValuables.com
ValentineGoodies.com
UsedShops.com
UltimateBid.com
TotallyPearls.com
SuperbShopping.com
Shoppingpedia.com
ShoppingJewelry.com
ShoppingGems.com
ShopFinders.com
SearchDeals.com
RugSales.com
RealMeals.com
QualityDVDs.com
PrintaCalendar.com
PremierGems.com
PreciousGiftbaskets.com
PreciousGems.com
PlushCarpet.com
Patchez.com
PalmtopShop.com
OverniteRoses.com
OutpostAuctions.com
NiceJewelry.com
Netlobster.com
Mostwantedgear.com
MinervaWatches.com
MemorableBaskets.com
LovePerfumes.com
JewelryAuctions.com
ItsMyShop.com
HollywoodDVDs.com
HeartVitamins.com
Gucci-Watches.com
GourmetStores.com
GiftbasketBiz.com
GetGreatCoffee.com
GearUnlimited.com
ForeverGems.com
FineGiftshops.com
FineGiftshop.com
FineGiftsDepot.com
FineDVDs.com
FashionWebsites.com
FashionJewelery.com
EverydayMoments.com
EmpireDVD.com
EliteWatches.com
ElegantFlowers.com
ElectronicsEquipment.com
DVDdomain.com
DutchBid.com
DiscountSatellite.com
DiscountFurs.com
DiamondEngagmentRing.com
DealDirectory.com
DealBrowser.com
Dailywatch.com
Cornerstores.com
ComputerFinders.com
CigaretteKingdom.com
CDmusicnow.com
CDboulevard.com
CamperGear.com
BargainCables.com
AwesomeDVDs.com
AuctionVista.com
Aromaverde.com
AntiqueJewelryauction.com
AffordableRoses.com
AAAflorist.com
4Carats.com
Skateshop.info
LeatherBoots.info
CouponCodes.info
Birthdaypresents.info
Antiquewatches.info
Womensfashion.biz
Wholesalegifts.biz
Wholesalecigarettes.biz
Whitegold.biz
Weddinginvitations.biz
Vintagejewelry.biz
Videorentals.biz
Uniquejewelry.biz
Thankyoucards.biz
Stereos.biz
Silklingerie.biz
Scentedcandles.biz
Romanticgifts.biz
Replicawatches.biz
Paintballgear.biz
Outfitters.biz
Onlinecoupons.biz
Megadeals.biz
Maternityclothing.biz
Loosediamonds.biz
Jewerlyboxes.biz
Jewelrydesign.biz
Hiphopclothing.biz
Halloweencostume.biz
Goldclub.biz
Goldchains.biz
Dogleashes.biz
Discountluggage.biz
Clubwear.biz
Carquotes.biz
Bedsheets.biz
Babybeds.biz
Winebasket.org
Waterskis.org
RentDVD.org
PublicAuctions.org
PlatinumJewelry.org
Jewelryboxes.org
ConsumerRatings.org
SafeShopping.net
PromiseRing.net
OnlyShopping.net
KitchenGifts.net
GardenLights.net
DiscountCarparts.net
BuyFlowers.net
BasketballGifts.net
Training-Gear.com
SprayPerfume.com
SpinningJewelry.com
Ski-Jackets.com
ShoeGuy.com
Princess-Shoes.com
PersianRugstore.com
Perfume-Cologne.com
PerfumeAuctions.com
PageantGifts.com
Newcologne.com
Lidshop.com
KitchenLights.com
JeepGear.com
JaguarGear.com
HotHighheels.com
HiddenGem.com
HeavenlyJewelry.com
FashionProfits.com
FallGear.com
FabulousImports.com
DiscountHDTVs.com
DesignerDinnerware.com
CollegeMemorabilia.com
ChocolateTurtles.com
CertifiedGemstones.com
Buy-Watches.com
BirthstoneJewelry.com
BestHandbag.com
BestColognes.com
BestbodyJewelry.com
BeddingBoutique.com
BargainLights.com
AutomotiveNeeds.com
Artmecca.com
AffordableBedding.com
Wilderness.biz
Whiteners.net
Whiten.net
Warranty.net
Warranties.biz
Wakeboards.org
Vivacious.org
Tweaks.net
True.biz
Translates.org
Translates.net
Transact.biz
Trained.net
Thinner.net
Technology.biz
Tattoed.com
Surnames.biz
Sunshine.biz
Successful.biz
Subcontracts.net
Storefront.biz
Stogies.net
Stimulates.net
Spoken.net
Specializes.net
Sophisticated.biz
Softener.net
Socialize.biz
Snooze.net
Snapped.net
Sightings.info
Setlist.org
Series.org
Semiconductors.biz
Scented.biz
Rumours.biz
Rhinestones.net
Revenues.biz
Residuals.biz
Reminders.net
Relocator.net
Relo.org
Relaxing.net
Rekindle.com
Rejuvenation.biz
Rejuvenates.com
Redirects.net
Pursue.biz
Publishes.net
Prosecutes.com
Promotes.net
Prom.biz
Priceless.org
Preschools.biz
Prelaunch.org
Prelaunch.net
Preforeclosure.biz
Prankster.net
Possibilities.net
Position.biz
Porky.net
Playoffs.biz
Phonics.biz
Pasttimes.net
Overstocks.net
Nutritious.net
Namers.net
Mustache.net
Multimillionaires.net
Miniblinds.biz
Minibikes.biz
Mingle.biz
Marinade.biz
Liquidates.com
Libations.net
Leases.org
Layouts.biz
Launching.net
Kwanza.info
James.biz
Inspirational.biz
Innocent.net
Ideas.biz
Housesitting.net
Houseowners.net
Housekeeping.biz
Hotwings.biz
Homeowner.biz
Homegyms.biz
Homebuilders.biz
Halftime.biz
Halfprice.info
Haggle.net
Guides.net
Groupies.net
Groundbreaking.net
Givers.net
Fruitcakes.biz
Fruitbaskets.biz
Frugal.biz
Formals.biz
Foreclosure.biz
Flirting.net
Flattens.com
Financials.org
Financials.biz
Filtration.biz
Filet.net
Feeds.net
Ezines.net
Extravagant.biz
Exposes.net
Excited.net
Excels.net
Enrolled.net
Endure.biz
Elevates.com
Durangos.net
Downloads.net
Doghouses.org
Discovers.net
Dazed.net
Customizations.com
Crayons.net
Convenience.net
Consolidation.biz
Communicator.net
Communicates.org
Claddagh.biz
Cheeseburgers.net
Charles.biz
Cashflow.biz
Carbohydrate.biz
Cabinetry.biz
Buddy.biz
Breathalyzer.biz
Borrowers.net
Bookbags.biz
Bodypiercings.biz
Bling.info
Blemishes.org
Bartender.biz
Authenticates.com
Attracts.net
Attire.biz
Arrests.net
Arouses.net
Appraisals.biz
Animators.net
Aggressive.biz
Accredited.net
Accept.net
Abilene.org
Zoologists.net
Videotape.biz
Videoblogging.org
Turntables.biz
Tournaments.biz
Tonneau.biz
Teleconference.biz
Telecommuter.biz
Teddies.biz
Tahoma.biz
Seats.biz
Redesign.biz
Petbeds.biz
Pensacola.biz
Mpegs.biz
Milehigh.org
Krista.biz
Jpegs.biz
Immunity.biz
Husbands.biz
Homejob.biz
Golfswing.biz
Filipino.biz
Females.biz
Bustiers.net
Budgets.biz
Boosters.biz
Accelerators.biz
SuperstarSports.com
Spreads.Net
proflexsports.com
PlayoffGames.Com
NCAApolls.com
Metfans.com
InsideBasketball.com
Hokiefootball.com
GamedayFootball.com
FootballRank.Com
football-fantasy.com
footballBB.com
fantasynascar.net
DiscountGolfclubs.Net
Cornhuskers.Net
AmazingSports.com
SportsTrivia.Info
SportsApparel.Info
SoccerEquipment.Info
FootballPicks.Info
WomensBasketball.Biz
Terrapins.Biz
Sportsline.Biz
SportsCollectibles.Biz
SoccerEquipment.Biz
Seminoles.Biz
Playoffs.Biz
PaintballGear.Biz
Inflatableboats.Biz
Halftime.Biz
Gamecocks.Biz
FootballJerseys.Biz
Series.Org
FootballRankings.Org
CollegeGames.Org
CollegeFootballNews.Org
ClemsonFootball.Org
Warchant.Net
Teamplay.Net
SuperbowlPools.Net
PennStateFootball.Net
FootballScores.Net
CollegeFootballNews.Net
SteelersGear.Com
NordicEquipment.Com
NetSportscenter.Com
JaguarGear.Com
Hotcorner.Com
HockeyDiscussion.Com
FootballSportsline.Com
FootballShopping.Com
CollegeMemorabilia.Com
Bowlbetting.Com
PrinterDrivers.Net
InkCartridges.Net
FreeAnimation.Net
FlashAnimations.Net
FaxSoftware.Net
DesktopIcons.Net
WindowsIcons.Com
Storagemarket.com
RealComputing.Com
PhotoshopTutorial.Com
PChelponline.Com
LaptopCentral.Com
Digitalvideosoftware.com
ComputersWorld.Com
ComputerScanners.Com
ComputerNotebooks.Com
CleanYourComputer.Com
CheapKeyboards.Com
ITmanagement.info
HighSpeedInternet.info
FreeDVDs.info
DigitalSatellite.info
WirelessNetworks.biz
Technicaltraining.biz
Nanobiotechnology.biz
InternetTraining.biz
Inkrefill.biz
HighspeedInternet.biz
GraphicsCards.biz
DvdWriters.biz
DvdCopy.biz
DvdCases.biz
DigitalSatellite.biz
DesktopComputers.biz
ComputerMonitors.biz
ComputerAnimation.biz
Dvdcopier.org
WirelessPDA.com
TattooTechnology.com
StemcellTechnology.com
StemcellReplacement.com
Smartdvds.com
SEOtechnology.com
PDAexpert.com
NewDesktops.com
Learnexcel.com
LearnEmail.com
Fuelcelltech.com
Free-Webcam.com
CheapPlasma.com
Caddsoftware.com
Bestdvdsoftware.com
BargainGPS.com
WeightlossTips.biz
Virility.biz
Fastweightloss.biz
Weightroom.net
MuscleBuilding.net
Medication.net
Healthsavings.net
BuildMuscle.net
Backaches.net
AerobicExercise.net
AbWorkout.net
AbExercises.net
Abdominals.net
Pharmhealth.com
OnlineOptical.com
NetMedicalCenter.com
Net-Med.com
Muscleandhealth.com
MegaVitamins.com
Lowerhealthrates.com
LongerLives.com
Improvelibido.com
Healthyweightlossdiets.com
Healthinsureamerica.com
Healthengines.com
GetMuscle.com
Freeonlinediet.com
Eweightlifting.com
Discountmedbooks.com
Dentaldiscountcard.com
Bodyrenewal.com
Bodybuildingnews.com
AbMuscles.com
Hyperbaric.info
Ephedra.info
Wheelchairs.biz
Viacreme.biz
ToothWhitening.biz
StopSnoring.biz
SkincareProducts.biz
ProfessionalHaircare.biz
Pedicures.biz
Oncologist.biz
NutritionSupplements.biz
Newdiet.biz
Mesotherapy.biz
Manicures.biz
Libido.biz
Hyperbaric.biz
HomeGyms.biz
GenericDrugs.biz
DiscountMedication.biz
Cryogenics.biz
CoralCalcium.biz
Bodysculpting.biz
AirPurification.biz
NutritionSupplements.org
HealthQuote.org
GeneticMedicine.org
DaySpa.org
ContactLens.org
Workingout.net
MedicationInformation.net
EasyWeightLoss.net
Discountfitness.net
UKhealthfoods.com
QualityHealthFoods.com
Ourhealthplan.com
Instanthealthquotes.com
HealthyDiscussion.com
GroupDiets.com
FavoritePharmacy.com
Discount-Nutrition.com
DependableDental.com
BargainViagra.com
AuthenticBeauty.com
Advancedmedicaltechnology.com
Advancebodynutrition.com
Acnecareformula.com
OnlinePromotion.info
WebPromotions.info
WebVentures.biz
WebsiteTraffic.biz
Webpromote.biz
VirtualHosting.biz
Topsites.biz
Sitepromotions.biz
Sitepromotion.biz
SearchRankings.biz
SearchPromotion.biz
OnlinePromotion.biz
NetProperties.biz
NetPromotion.biz
Netdesigns.biz
Multimediadesigns.biz
Hotsites.biz
Hotproperties.biz
Bargaindomains.biz
WinampSkins.net
SitePromote.net
SellingOnline.net
InternetConsulting.net
ICQskins.net
HtmlTutorial.net
Groupemail.net
Freewebpage.net
EmailNewsletters.net
DiscussionForums.net
WebpageDesign.net
Iclasses.net
WebstoreBuilders.com
WebsiteScripts.com
WebsiteIncome.com
Websitehostprovider.com
WebsiteBackups.com
Webmaster-Forum.com
Waitinglistservices.com
TrainingWebsite.com
TrafficUpgrade.com
Topdotnames.com
TextFonts.com
Stickyserver.com
SpanishServer.com
SmartSites.com
ServerNow.com
ScreamDesigns.com
RateHosting.com
Rankbest.com
Publishsite.com
ProtectDomain.com
Promotionz.com
PromotionBiz.com
Primewebspace.com
PowerPromote.com
PowerfulMarketing.com
P2Psites.com
ObtainDomains.com
ObtainDomain.com
NiceDots.com
NameProperties.com
NamePreserve.com
MegaPromotion.com
MaximumPromotions.com
LowcostDesigns.com
LiveRegister.com
Linkventures.com
LifetimeHosting.com
InternetIncorporated.com
InfoHosting.com
IncreaseVisitors.com
Hotresponder.com
HostingSearch.com
Hitnetwork.com
Guerrillapromotions.com
FindAdvertisers.com
FetchDomain.com
FastInternetAccess.com
EnhancedInternet.com
EmailPayments.com
EmailAnnounce.com
EcommerceTraffic.com
DrivingHits.com
DownloadEbook.com
Dotcomdomain.com
Domainsyndicate.com
Domainnameprofits.com
DiscussionSearch.com
Discountdotcoms.com
DiscountDomains.com
DesktopPrivacy.com
Deletedomains.com
CreativeWebmasters.com
CoolNewsletters.com
Clubmeg.com
Broadbandinfo.com
Banner-Design.com
AffiliateStorm.com
Adstoclick.com
30Megs.com
Downloaded.info
Webhostingservices.biz
EmailAdvertising.biz
DedicatedServer.biz
Datafeeds.biz
BannerDesign.biz
AnimatedScreensavers.biz
AffordableWebhost.biz
SiteLaunch.net
Hyperlinking.net
WebsiteResellers.com
WebsiteBrokers.com
Verybesthosting.com
UKwebtools.com
TrialDownloads.com
SeoTechnology.com
PremierClicks.com
Modernhosting.com
Masshost.com
LowcostDomain.com
KeywordRevenue.com
InnovativeDomains.com
HostingTraffic.com
Homepagegoodies.com
FlashResources.com
DomainBackorders.com
ClickCorporation.com
CheapEmail.com
BestDedicatedServers.com
AffordableColo.com
AffordableClicks.com
Affiliatetrac.com
Credithistory.info
Cleancredit.info
Personalloansonline.biz
Paydayadvances.biz
Daytrading.biz
Cleancredit.biz
Autofinancing.biz
Onlineautoloans.net
Interestcalculator.net
Homemortgagerate.net
HomeImprovementLoans.net
EliminateDebt.net
DebtManagement.net
Creditapplications.net
Consolidates.net
Consolidateloans.net
Carlender.net
Cardsearch.net
Bestmortgages.net
VAfinancing.com
Sophisticatedinvestor.com
Realestatedollars.com
Qualityquote.com
Principalmortgages.com
Premierlenders.com
Personalizedquotes.com
Need-Cash.com
Mrsmoney.com
Mortgagepoints.com
Megafinancial.com
Marketsigns.com
LoanCompanies.com
LendingSearch.com
Howsmycredit.com
Hotstocknews.com
Homeloanswithbadcredit.com
Hedgeinvestment.com
Grandeproperties.com
Freescholarshipmoney.com
Freehealthquote.com
Freecreditcheckreport.com
Forsalelisting.com
Financialguides.com
Financialforums.com
Dentalandhealth.com
DeliverCash.com
Debtfreefinancial.com
Dallas-Mortgages.com
Creditindependence.com
Creditfinances.com
Creditcardsearches.com
CompleteCredit.com
Cashfunds.com
Cashbackmortgage.com
Cashadvancebiz.com
Carloancompany.com
Carfinancingcompany.com
Budgetquote.com
Bestrealtors.com
Alanmortgage.com
Advertiserealty.com
WaterfrontProperty.Info
RealEstateProperties.Info
MedicalBilling.Info
DebtElimination.Info
Warranties.Biz
UnsecuredCreditCards.Biz
TaxRefunds.Biz
StockPicks.Biz
SavingsAccounts.Biz
RealEstateMarketing.Biz
QuickLoans.Biz
Preforeclosure.Biz
PersonalFinances.Biz
NoMoneyDown.Biz
NeedMoney.Biz
Mesotherapy.Biz
LoanCalculators.Biz
InsuranceRates.Biz
InsuranceOnline.Biz
HouseInsurance.Biz
Homeowner.Biz
FreeInsuranceQuotes.Biz
Foreclosure.Biz
Financials.Biz
ExchangeMoney.Biz
EmergencyCash.Biz
CreditCounseling.Biz
CreditCardProcessing.Biz
CreditCardConsolidation.Biz
Consolidation.Biz
CheckingAccounts.Biz
CheckCredit.Biz
CashFlow.Biz
AutomobileLoans.Biz
Appraisals.Biz
YourMoney.Org
TaxQuestions.Org
RefinanceHome.Org
PlatinumCard.Org
LoanCalculators.Org
Leases.Org
HomeAppraisals.Org
FreeCreditScores.Org
FreeCreditRepair.Org
ForeclosureSearch.Org
Financials.Org
FederalGrant.Org
CreditRating.Org
CashMoney.Org
ATMmachines.Org
StudentHealthInsurance.Net
SixFigure.Net
AffordableLending.Net
ValueQuotes.Com
TotalCreditRepair.Com
TaxReturnServices.Com
TaxDebtHelp.Com
StockGains.Com
Stock-Forecast.Com
RussianMoney.Com
RealDebtConsolidation.Com
PremierMortgageCompany.Com
PremierLender.Com
NorthstarLoans.Com
NewJerseyLending.Com
MBAloans.Com
MBAFinancing.Com
Lowest-Quotes.Com
Legalstuff.Com
InvestmentGrowth.Com
HardFunds.Com
Fhahomeloan.Com
Fastinsurancequotes.Com
CompleteLending.Com
Party.biz
FirstDate.biz
Blinddates.biz
OnlineCam.org
Romanticpoems.net
OnlineDates.net
Hot4U.net
Freedates.net
Flings.net
CanadianSingles.net
AttractWomen.info
VirtualWebcam.com
SpanishDates.com
RomanticUniverse.com
RomanticNights.com
Romanticideas.com
RomanticDesires.com
PremierPersonals.com
PersonalAdz.com
PCdate.com
OurChatrooms.com
Online-Loves.com
Miami-Singles.com
MatureMatches.com
Lovescents.com
LoversTalk.com
LoverChat.com
LoveLiasons.com
LoveHints.com
LoveCelebrations.com
JoeRomance.com
IntouchDating.com
IntimateCams.com
Internetdatingsites.com
InteractiveRomance.com
IncredibleDates.com
IdealLover.com
HotPartner.com
Hotcamchat.com
HispanicLovers.com
Heavenlyromance.com
HeavenlyMatches.com
Heavenlydates.com
GreaterLove.com
Friendlydates.com
Friendlydate.com
Eurointro.com
DeeperLove.com
DatefinderUK.com
Creativedating.com
Connectsingles.com
ChristianRomances.com
ChristianDatingAgency.com
Chinese-Women.com
ChicPersonals.com
Chatroomtalk.com
Chatpartner.com
Chatattack.com
Chatalittle.com
BelovedNet.com
VoiceChat.biz
Singlesdating.biz
Romantic.biz
RealWomen.biz
PhotoPersonals.biz
LiveWebcams.biz
Hardbodies.biz
Chatting.biz
Chatcam.biz
AdultPersonals.biz
VideoDating.org
RomanceChat.org
PhoneChat.org
LatinDating.org
Icqchat.net
SexySingles.info
RomanticIdeas.info
MeetPeople.info
LoveYou.info
TrueRomantics.com
SeductivePassion.com
PremierChat.com
PlatinumSingles.com
PlatinumLovers.com
PassionateLovers.com
Meetlocalpeople.com
InternetChats.com
HotJews.com
HeavenlySingles.com
Freelivecamz.com
EligibleSingles.com
DistanceDating.com
BlinddateChat.com
BeautyPersonals.com
BeautyDating.com
AbsoluteMatch.com
3Dchatrooms.com
WholesaleDistributor.biz
WhiteWedding.biz
UpstartStartups.com
Transacts.net
TexasRestaurants.com
Startups.info
Startups.biz
StartupNetwork.com
SmarterJobs.com
Sixfigurebusiness.com
Safebiz.com
Resumez.com
ResumeResource.com
Restaurantsupply.biz
RepairBusiness.com
Relocationservices.biz
RefundProcessing.com
Realtimecommerce.com
RealPlans.com
QualityPromotions.com
ProjectManagers.biz
Profits.biz
PremierLingerie.com
Placement.biz
OvernightDelivery.net
Ourprofessionals.com
Onlineprofessional.com
Onlinecopywriting.com
Online-Billing.com
Newresumes.com
MissBiz.com
MerchantSolutions.biz
Merchantnow.com
MBAloans.com
MassageBusiness.com
Legalbusiness.com
Leadprofits.com
Killerbiz.com
Joblistings.biz
InteractivePromotion.com
InstantInvoice.com
IndustrialEngineer.net
Incorporates.net
ImportingBusiness.com
Ideasforbusiness.com
HospitalityJobs.net
HomesInspector.com
HighTechStaffing.com
Healthcarestaffing.biz
Goodbiz.net
Globalmerchant.com
Gatormoving.com
FreelanceSearch.com
FreeBusiness.info
Floridapromotions.com
Executivejobs.biz
Environmentalbiz.com
Enhanceinternational.com
Engineeringclasses.com
Employmentscreenings.com
EcommerceServices.biz
Driveprofits.com
Distinguishedresumes.com
Dieticians.biz
Detectives.biz
Dentisthotline.com
Delivertoday.com
Daycarebiz.com
Compustaffing.com
Compensated.com
Civilengineer.net
Centralbiz.com
Caribbeanbiz.com
Cardservices.net
Cardmerchants.com
BusinessPromotions.net
Businessmba.com
Businessmarketresearch.com
Businessleads.biz
Buildingcontractors.biz
Building-Construction.com
Brewcompany.com
Boostbiz.com
AdvertisingServices.net
XangoBusiness.com
Workbooks.biz
WeddingConsultant.biz
TranslationSystem.com
TimeManagement.biz
TechnicalColleges.info
StructuresEngineering.com
Researchers.biz
RemodelingRepairs.com
NoniDistributor.com
MBAclasses.com
MarketingAbility.com
LandscapeDesigns.biz
GovernmentContracts.biz
GeotechEngineering.com
GeneralContractors.net
FocusedAdvertising.com
EngineeringDegree.org
Dropships.net
Construction-Work.com
ConfidentWomen.com
BathroomRemodeling.biz
ZFK.net
ZBO.com
YLU.net
YFR.net
wwo.biz
WUH.net
WTU.biz
WOI.biz
WLB.info
WCY.net
WCG.info
VUY.net
VTJ.net
VRI.info
VBK.biz
vaa.biz
UTC.biz
URE.biz
UNY.net
UFL.biz
UDU.info
UDS.info
TJL.com
SWV.biz
SUO.biz
STK.info
SQM.net
SPO.biz
SNB.biz
SHC.info
SGK.net
RZP.net
RXG.info
RWH.net
RVC.info
RTY.net
RTY.biz
RPD.biz
RNB.biz
RLR.net
RKN.biz
rfn.biz
RCD.info
PZO.net
PRT.info
PNP.info
PBD.info
OUX.com
OUC.info
OTD.net
ORS.info
ONJ.info
OLB.net
OFD.biz
NWR.info
nno.biz
nfn.biz
MTR.biz
MRF.biz
MOO.biz
MIF.biz
MFP.biz
MEU.info
MDZ.biz
LYO.net
LTN.org
LTI.biz
LRE.info
LNS.info
LNK.info
LLA.biz
LBY.net
KOB.info
KJP.net
JMD.net
JIW.net
JHT.net
IVY.biz
IMA.biz
IKO.info
IGN.info
IBL.info
HRJ.net
HRA.biz
HFO.org
GWN.biz
GTW.biz
GKW.net
GJM.org
FPT.biz
FCU.info
EWZ.net
EUL.biz
EPX.net
EPP.biz
EPO.biz
EME.biz
ECJ.biz
EBZ.net
EBJ.net
DPS.biz
DMD.biz
DLW.info
DFP.info
DBZ.info
DBB.biz
CTE.biz
CTD.info
CRO.biz
CRI.biz
CKT.info
CHM.biz
CCP.org
CAG.biz
BUH.info
BTJ.info
BST.biz
BSD.biz
BPH.net
BOT.biz
BNA.biz
BLA.biz
BHS.biz
BDL.biz
BDJ.net
BDH.info
BBH.biz
AWU.biz
AWL.biz
AVU.net
ASJ.biz
AMW.info
AFL.biz
ADL.biz
ADF.biz
ACM.biz
DJU.info
HCK.info
APU.info
HKR.info
WTG.info
ILF.info
TUH.biz
MKP.biz
MDV.biz
RJI.biz
GFC.biz
BYN.org
MAY.biz
RON.biz
PIG.biz
CFE.biz
WTK.biz
OPK.biz
OKL.biz
PTM.biz
FPR.biz
SNN.biz
BOH.biz
-----------------------------------------------

CHECKSUMS:
-----------------------------------------------
MD5:         7c465804af52a271de14022cee4163ef
SHA1:         3609b8325010aa5a8c243b04d9bead834baf68f5
-----------------------------------------------

POSSIBLE BEHAVIORS:
-----------------------------------------------
Possible HTTP Client: Score: 3
Possible SMTP Client: Score: 4
-----------------------------------------------

A/V INFO:
-----------------------------------------------
SCANNER: VScanner                      VIRUS: Unknown, file is "suspicious"
SCANNER: AVG                           VIRUS: No virus found.
SCANNER: ClamAV                        VIRUS: No virus found.
SCANNER: BDC                           VIRUS: No virus found.
-----------------------------------------------

PE INFO:
-----------------------------------------------
SECT:      .text      269686          0x00000200 <- 0x00001000
SECT:      .rdata     94452           0x00042000 <- 0x00043000
SECT:      .data      26744           0x00059200 <- 0x0005B000
SECT:      .mackt     4096            0x00060000 <- 0x00062000

[kernel32.dll]
     LoadLibraryA
     GetProcAddress
     GetCurrentProcessId
     GetLastError
     FileTimeToSystemTime
     CompareStringW
     CompareStringA
     FlushFileBuffers
     CloseHandle
     CreateFileA
     ReadFile
     WriteConsoleW
     GetConsoleOutputCP
     WriteConsoleA
     SetStdHandle
     RtlUnwind
     RaiseException
     GetCommandLineA
     HeapFree
     GetVersionExA
     HeapAlloc
     GetProcessHeap
     GetStartupInfoA
     TerminateProcess
     GetCurrentProcess
     UnhandledExceptionFilter
     SetUnhandledExceptionFilter
     IsDebuggerPresent
     GetSystemTimeAsFileTime
     GetTimeFormatA
     GetDateFormatA
     GetModuleHandleA
     TlsGetValue
     TlsAlloc
     TlsSetValue
     TlsFree
     InterlockedIncrement
     RestoreLastError
     GetCurrentThreadId
     InterlockedDecrement
     ExitProcess
     WriteFile
     GetStdHandle
     GetModuleFileNameA
     FreeEnvironmentStringsA
     GetEnvironmentStrings
     FreeEnvironmentStringsW
     WideCharToMultiByte
     GetEnvironmentStringsW
     LockResource
     GetFileType
     DeleteCriticalSection
     HeapDestroy
     HeapCreate
     VirtualFree
     QueryPerformanceCounter
     GetTickCount
     LeaveCriticalSection
     EnterCriticalSection
     VirtualAlloc
     HeapReAlloc
     GetCPInfo
     GetACP
     GetOEMCP
     Sleep
     GetTimeZoneInformation
     HeapSize
     InitializeCriticalSection
     MultiByteToWideChar
     GetLocaleInfoA
     SetFilePointer
     GetConsoleCP
     GetConsoleMode
     LCMapStringA
     LCMapStringW
     GetStringTypeA
     GetStringTypeW
     SetEnvironmentVariableA

[user32.dll]
     PostQuitMessage
     DefWindowProcA
     CreateWindowExA
     ShowWindow
     UpdateWindow
     LoadCursorA
     RegisterClassExA
     SetTimer
     GetMessageA
     TranslateMessage
     DispatchMessageA
     KillTimer
-----------------------------------------------

-------------------------------------------------------------
jose nazario, ph.d.     <jose at arbor.net>
security researcher, office of the CTO,  arbor networks
v: (734) 821 1427 	      http://asert.arbornetworks.com/