Download Link: hxxp://search4top.net/MSPCA32.cab

File Name: MSPCA32.cab

File Info:
File size: 58280 bytes
MD5...: 927859db8e6e58fe14b1f9248f74da0c
SHA1..: 80061b51522b5e305cffc791892787797dbb5eb0
SHA256: 18572fa3713f64c92d246f20eee910287403b7d472c12ed3ca4d98cf4bb43a8f
SHA512: 959c4cc25c58d3adb895ab88c6574077d9a98f67020dac4dfe9f83bb88fe0f73
c77517ff64462b170a5801c02d2ac842bf2cff8eca9f65a83d7a386fa113ef03
packers: UPX

Archive preview
Modified Size Ratio CRC32 File name
12/26/2007 5:33:46 PM 374 B INSTALA.inf
12/27/2007 8:31:18 PM 61 KB MSPCA32.dll

File Name: MSPCA32.dll

VirusTotal Result: 9/32 (28.13%)
AntiVir 7.6.0.85 2008.04.11 TR/Bocata.62976
Ikarus T3.1.1.26 2008.04.13 Trojan.Bocata.62976
Norman 5.80.02 2008.04.12 W32/Dialer.CBLJ
Panda 9.0.0.4 2008.04.12 Adware/Search4Top
Prevx1 V2 2008.04.13 ADWARE.BHO
Sophos 4.28.0 2008.04.13 Mal/Emogen-G
Sunbelt 3.0.1041.0 2008.04.12 Trojan.Bocata.6
Symantec 10 2008.04.13 Dialer.Mostrar
Webwasher-Gateway 6.6.2 2008.04.11 Trojan.Bocata.62976

File size: 62976 bytes
MD5...: 64461d4daf64258e8435ae6a74993970
SHA1..: c5be18cb7f77a2f1d424daa66c9e7ee2137a8fc4
SHA256: db51b4c38a5fb4164791c7f835b7dd66487224a606d7a072de7d85a2625442e2
SHA512: 363266e44d3d6f6b71b66f280cec4b1e7916d3268223fc48e84bce031c728852
fa6b722a7556e47385e19b8f9e8bae586a8ba6d66d94a6a3e6e10118e6faf1f5
PEiD..: -
PE Structure information:
Base Data:
Entry Point Address.: 0x10029d50
Time Date Stamp.....: 0x47754f05 (Fri Dec 28 19:31:17 2007)
Machine Type.......: 0x14c (I386)

PE Header
Signature: 00004550
Machine: 014C - Intel 386
Number of sections: 0003
Time/Date stamp: 47754F05
Pointer to symbol table: 00000000
Number of symbols: 00000000
Size of optional header: 00E0
Characteristics: 210E
Magic: 010B
Linker version (major): 06
Linker version (minor): 00
Size of code: 0000B000
Size of initialized data: 00005000
Size of uninitialized data: 0001E000
Address of entry point: 00029D50
Base of code: 0001F000
Base of data: 0002A000
Image base: 10000000
Section alignment: 00001000
File alignment: 00000200
OS version (major): 0004
OS version (minor): 0000
Image version (major): 0000
Image version (minor): 0000
Sub system version (major): 0004
Sub system version (minor): 0000
Win32 version: 00000000
Size of image: 0002F000
Size of headers: 00001000
Checksum: 00000000
Sub system: 0002 - Windows graphical user interface (GUI) subsystem
DLL characteristics: 0000
Size of stack reserve: 00100000
Size of stack commit: 00001000
Size of heap reserve: 00100000
Size of heap commit: 00001000
Loader flags: 00000000
Number of RVA: 00000010

PE Sections
Section VirtSize VirtAddr PhysSize PhysAddr Flags
UPX0 0001E000 00001000 00000000 00000400 E0000080
UPX1 0000B000 0001F000 0000B000 00000400 E0000040
.rsrc 00005000 0002A000 00004200 0000B400 C0000040


Import table (libraries: 7)
KERNEL32.DLL (imports: 3)
LoadLibraryA, GetProcAddress, VirtualProtect
ADVAPI32.dll (imports: 1)
RegOpenKeyA
ole32.dll (imports: 1)
CoTaskMemFree
OLEAUT32.dll (imports: 1)
#2
SHLWAPI.dll (imports: 1)
SHDeleteKeyA
USER32.dll (imports: 1)
SetTimer
WS2_32.dll (imports: 1)
#111
Export table (names: 5, functions: 5)
#0 - DllCanUnloadNow, #1 - DllGetClassObject, #2 - DllRegisterServer, #3 - DllUnregisterServer, #4 - MSPCA32

Unpackig with UPX:
File size Ratio Format Name
-------------------- ------ ----------- -----------
155648 <- 62976 40.46% win32/pe MSPCA32.dll

PE Sections
Section VirtSize VirtAddr PhysSize PhysAddr Flags
.text 00013C3C 00001000 00014000 00001000 60000020
.rdata 00001D0A 00015000 00002000 00015000 40000040
.data 00006134 00017000 00006000 00017000 C0000040
.idata 00001284 0001E000 00002000 0001D000 C0000040
.rsrc 00004BD9 00020000 00005000 0001F000 40000040
.reloc 000015B4 00025000 00002000 00024000 42000040

File System Activity:
CREATE C:\WINDOWS\system32\SET43.tmp
CREATE C:\WINDOWS\system32\MSPCA32.dll
WRITE C:\WINDOWS\system32\SET43.tmp
OPEN E:\infected\mspca32 extracted\instala.inf
OPEN E:\Infected\MSPCA32 Extracted\MSPCA32.dll
OPEN C:\WINDOWS\system32\SET43.tmp
OPEN C:\WINDOWS\system32\MSPCA32.dll
OPEN C:\WINDOWS\System32\ShimEng.dll
READ C:\WINDOWS\system32\MSPCA32.dll
SET INFORMATION C:\WINDOWS\system32\SET43.tmp
DELETE C:\WINDOWS\system32\SET43.tmp

Registry Values Changed:
HKCU\Software\Microsoft\Search Assistant\ACMru\5603 ---> C:\WINDOWS\system32\MSPCA32.dll
HKLM\Software\Microsoft\Search Assistant\ACMru\5603 ---> C:\WINDOWS\system32\MSPCA32.dll