Norman Scanner Engine 5.83.  7
Sandbox 05.83, dated  3/10-2005

Your message ID (for later reference): 20051110-300

nepenthes-a0b988ed0ca3e79dfaff25d8c3320dd6-jacfg2.exe : [SANDBOX] contains a security risk - W32/Spybot.gen3 (Signature: W32/Pinfi.A)
 [ General information ]
    * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
    * Creating several executable files on hard-drive.
    * **Locates window "NULL [class mIRC]" on desktop.
    * File length:       275418 bytes.

 [ Changes to filesystem ]
    * Creates file C:\WINDOWS\TEMP\wda0890.tmp.
    * Creates file C:\WINDOWS\SYSTEM32\jacfg2.exe.
    * Creates file C:\WINDOWS\TEMP\cda0890.tmp.
    * Deletes file 1.

 [ Changes to registry ]
    * Creates value "JA Cfg Util v2"="jacfg2.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
    * Creates value "JA Cfg Util v2"="jacfg2.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices".
    * Creates value "JA Cfg Util v2"="jacfg2.exe" in key "HKCU\Software\Microsoft\Windows\CurrentVersion\Run".

 [ Changes to system settings ]
    * Creates WindowsHook monitoring call windows procecdures activity.

 [ Network services ]
    * Connects to "101.231.217.201" on port 445 (IP).
    * Connects to "201.217.231.101" on port 445 (TCP).
    * Connects to "110.98.191.209" on port 445 (IP).
    * Connects to "209.191.98.110" on port 445 (TCP).
    * Connects to "101.159.94.102" on port 445 (IP).
    * Connects to "102.94.159.101" on port 445 (TCP).
    * Connects to "110.12.176.60" on port 445 (IP).
    * Connects to "60.176.12.110" on port 445 (TCP).
    * Connects to "101.4.173.222" on port 445 (IP).
    * Connects to "222.173.4.101" on port 445 (TCP).
    * Connects to "110.188.177.40" on port 445 (IP).
    * Connects to "40.177.188.110" on port 445 (TCP).
    * Connects to "101.101.253.165" on port 445 (IP).
    * Connects to "165.253.101.101" on port 445 (TCP).
    * Connects to "110.132.209.219" on port 445 (IP).
    * Connects to "219.209.132.110" on port 445 (TCP).
    * Connects to "101.200.5.231" on port 445 (IP).
    * Connects to "231.5.200.101" on port 445 (TCP).
    * Connects to "110.44.81.77" on port 445 (IP).
    * Connects to "77.81.44.110" on port 445 (TCP).
    * Connects to "101.26.104.136" on port 445 (IP).
    * Connects to "136.104.26.101" on port 445 (TCP).
    * Connects to "110.238.144.139" on port 445 (IP).
    * Connects to "139.144.238.110" on port 445 (TCP).
    * Connects to "101.143.116.43" on port 445 (IP).
    * Connects to "43.116.143.101" on port 445 (TCP).
    * Connects to "110.193.219.156" on port 445 (IP).
    * Connects to "156.219.193.110" on port 445 (TCP).
    * Connects to "101.244.119.26" on port 445 (IP).
    * Connects to "26.119.244.101" on port 445 (TCP).
    * Connects to "110.106.103.203" on port 445 (IP).
    * Connects to "203.103.106.110" on port 445 (TCP).
    * Connects to "101.84.13.103" on port 445 (IP).
    * Connects to "103.13.84.101" on port 445 (TCP).
    * Connects to "110.66.155.141" on port 445 (IP).
    * Connects to "141.155.66.110" on port 445 (TCP).
    * Connects to "101.90.208.211" on port 445 (IP).
    * Connects to "211.208.90.101" on port 445 (TCP).
    * Connects to "110.27.126.2" on port 445 (IP).
    * Connects to "2.126.27.110" on port 445 (TCP).
    * Connects to "101.157.204.81" on port 445 (IP).
    * Connects to "81.204.157.101" on port 445 (TCP).
    * Connects to "110.182.6.206" on port 445 (IP).
    * Connects to "206.6.182.110" on port 445 (TCP).
    * Connects to "101.211.79.249" on port 445 (IP).
    * Connects to "249.79.211.101" on port 445 (TCP).
    * Connects to "110.80.100.236" on port 445 (IP).
    * Connects to "236.100.80.110" on port 445 (TCP).
    * Connects to "101.226.197.191" on port 445 (IP).
    * Connects to "191.197.226.101" on port 445 (TCP).
    * Connects to "110.68.232.99" on port 445 (IP).
    * Connects to "99.232.68.110" on port 445 (TCP).
    * Connects to "101.215.255.35" on port 445 (IP).
    * Connects to "35.255.215.101" on port 445 (TCP).
    * Connects to "110.51.100.93" on port 445 (IP).
    * Connects to "93.100.51.110" on port 445 (TCP).
    * Connects to "101.42.166.55" on port 445 (IP).
    * Connects to "55.166.42.101" on port 445 (TCP).
    * Connects to "110.171.199.62" on port 445 (IP).
    * Connects to "62.199.171.110" on port 445 (TCP).
    * Connects to "101.77.116.7" on port 445 (IP).
    * Connects to "7.116.77.101" on port 445 (TCP).
    * Connects to "110.55.148.168" on port 445 (IP).
    * Connects to "168.148.55.110" on port 445 (TCP).
    * Connects to "101.72.40.93" on port 445 (IP).
    * Connects to "93.40.72.101" on port 445 (TCP).
    * Sends data stream (92 bytes) to remote address "124.168.146.30", port 32955.
    * Connects to "101.176.26.92" on port 445 (IP).
    * Connects to "92.26.176.101" on port 445 (TCP).
    * Connects to "101.237.213.40" on port 445 (IP).
    * Connects to "40.213.237.101" on port 445 (TCP).
    * Connects to "94.154.148.27" on port 445 (IP).
    * Connects to "27.148.154.94" on port 445 (TCP).
    * Connects to "101.229.106.241" on port 445 (IP).
    * Connects to "241.106.229.101" on port 445 (TCP).
    * Connects to "94.58.126.145" on port 445 (IP).
    * Connects to "145.126.58.94" on port 445 (TCP).
    * Connects to "101.195.136.150" on port 445 (IP).
    * Connects to "150.136.195.101" on port 445 (TCP).
    * Connects to "94.26.69.116" on port 445 (IP).
    * Connects to "116.69.26.94" on port 445 (TCP).
    * Connects to "101.86.186.43" on port 445 (IP).
    * Connects to "43.186.86.101" on port 445 (TCP).
    * Connects to "94.30.26.126" on port 445 (IP).
    * Connects to "126.26.30.94" on port 445 (TCP).
    * Connects to "101.56.169.182" on port 445 (IP).

 [ Security issues ]
    * Possible backdoor functionality [Authenticate] port 113.

 [ Process/window information ]
    * Creates a mutex JA002.
    * Will automatically restart after boot (I'll be back...).
    * Enumerates running processes.

 [ Signature Scanning ]
    * C:\WINDOWS\TEMP\wda0890.tmp (176128 bytes) : Pinfi.A.
    * C:\WINDOWS\SYSTEM32\jacfg2.exe (275418 bytes) : W32/Pinfi.A.
    * C:\WINDOWS\TEMP\cda0890.tmp (176128 bytes) : Pinfi.A.


(C) 2004 Norman ASA. All Rights Reserved.
The material presented is distributed by Norman ASA as an information source only.
Sent by removed@email.com to sandbox.


Received 10.Nov 2005 at 06.33 - processed 10.Nov 2005 at 06.38.