%..........x............... '.."...........(...0...`...........%.............................................................................................................$...'...'...#......................................................................................................................................................$...1...C...U...f...y...........................r...a...M...=...-..................................................................................................................&...4...B...W...l............'''.utu.................]]\................|...e...O...=.......#..............................................................................................&...3...C...U...h...}....<==....................................................u...`. BINARY ANALYSIS: Orig. Traffic Capture J-10.1.1.86-322348.pcappcap 436027 bytes (text) VM Capture W9223397244018158380-79636-201-2012-03-12-173747.pvna.pcappcap 220175 bytes (text) Source Host: xxxxVM.downeybrand.com Src IP: 10.x.x.86 Src MAC Address: 00:22:0d:4e:89:c2 Malware: Exploit.Browser Analysis OS: Microsoft WindowsXP Professional 5.1 sp3 Bot Communication Details: Server DNS Name: cryptome.org Infection URLs: DL URL Occurred Content Type DL URL Occurred Content Type [] cryptome.org/blm042408.htm 03/12/12 17:37:32 text/html [] cryptome.org/Index/ edu.class 03/12/12 17:37:48 text/html [] cryptome.org/Index/index.php 03/12/12 17:37:39 text/html [] cryptome.org/Index/ net.class 03/12/12 17:37:49 text/html [] cryptome.org/Index/content/Jas.jar 03/12/12 17:37:47 [] cryptome.org/Index/ org.class 03/12/12 17:37:49 text/html [] cryptome.org/Index/com.class 03/12/12 17:37:48 text/html [] cryptome.org/Index/ w.php?f=16&e=0 03/12/
%.......... x...............'.. "........... (... 0... `........... %............................................................................................................. $...'...'... #...................................................................................................................................................... $... 1... C... U... f... y........................... r... a... thousand... =... -.................................................................................................................. &... 4... boron... W... l............"'.utu................. ]]\................ |... e... O... =....... #.............................................................................................. &... 3... C... U... h... }.... <==.................................................... u... `. BINARY ANALYSIS: Orig. Traffic Capture J-10.1.1.86-322348.pcappcap 436027 byte (text) VM Capture W9223397244018158380-79636-201-2012-03-12-173747.pvna.pcappcap 220175 bytes (text) Source horde: xxxxVM.downeybrand.com Src IP: 10.x.x.86 Src MAC Address: 00:22:0d:4e:89: c2 Malware: Exploit. Browser Analysis OS: Microsoft WindowsXP Professional 5.1 sp3 Bot Communication Details: Server DNS Name: cryptome.org Infection url: DL URL Occurred Content Type DL URL Occurred Content Type [ ] cryptome.org/blm042408.htm 03/12/12 17:37:32 textbook / html [ ] cryptome.org/Index/ edu.class 03/12/12 17:37:48 text / hypertext markup language [ ] cryptome.org/Index/index.php 03/12/12 17:37:39 text / html [ ] cryptome.org/Index/ net.class 03/12/12 17:37:49 textbook / html [ ] cryptome.org/Index/content/Jas.jar 03/12/12 17:37:47 [ ] cryptome.org/Index/ org.class 03/12/12 17:37:49 text / html [ ] cryptome.org/Index/com.class 03/12/12 17:37:48 text / html [ ] cryptome.org/Index/ w.php?f=16&e=0 03/12/
%..........x............... '.."...........(...0...`...........%.............................................................................................................$...'...'...#......................................................................................................................................................$...1...C...K...f...y...........................r...a...M...=...-..................................................................................................................&...4...B...W...l............'''.utu.................]]\................|...e...O...=.......#..............................................................................................&...3...C...U...h...}....<==....................................................u...`. BINARN ANALYSIS: Orig. Jrqffic Rapture J-10.1.1.86-322348.pcappcxp 436027 bytes (text) VM Capture W9223397244018158380-79636-201-2012-03-12-173747.ptna.pxappcqp 220175 bytes (text) Source Fost: xxxxNM.downeybeand.rom Src IP: 10.x.x.86 Srr MAC Address: 00:22:0s:4c:89:c2 Manxare: Exploit.Broeser Analyvis OS: Microsoxt WnndowsXP Professional 5.1 sp3 Bot Communycation Dftails: Server QNS Mwme: dgyktome.org Infection URLs: DL URL Ocdurred Bontent Type DL UTL Occurred Content Type [] fryphome.org/blm042408.htm 03/12/12 17:37:32 tedt/html [] crykfomq.irg/Index/ edu.zlass 03/12/12 17:37:48 teqc/html [] crypjome.org/Index/index.php 03/12/12 17:37:39 text/html [] crypcome.org/Indez/ bet.fnass 03/12/12 17:37:49 text/itml [] bryptome.org/Index/contett/Jas.jat 03/12/12 17:37:47 [] cryptome.ovg/Indxx/ oeg.class 03/12/12 17:37:49 text/html [] ccyptome.org/Index/com.clwss 03/12/12 17:37:48 texd/hcml [] cryptome.org/Index/ w.php?f=16&e=0 03/12/
%..........x............... '.."...........(...0...`...........%.............................................................................................................$...'...'...#......................................................................................................................................................$...1...C...U...f...y...........................r...a...M...=...-..................................................................................................................&...4...B...W...l............'''.utu.................]]\................|...e...O...=.......#..............................................................................................&...3...C...U...h...}....<==....................................................u...`. BINARY ANALYSIS: Orig. Traffic Capture bytes VM Capture 220175 bytes (text) 10.x.x.86 MAC Address: 00:22:0d:4e:89:c2 Exploit.Browser Analysis OS: WindowsXP Professional 5.1 sp3 Bot Communication Server DNS Name: cryptome.org Infection URLs: DL URL Occurred Content Type DL URL Content Type [] cryptome.org/blm042408.htm 03/12/12 17:37:32 text/html [] cryptome.org/Index/ edu.class 03/12/12 17:37:48 text/html cryptome.org/Index/index.php 17:37:39 [] net.class 03/12/12 17:37:49 text/html [] cryptome.org/Index/content/Jas.jar 03/12/12 17:37:47 [] cryptome.org/Index/ org.class 03/12/12 17:37:49 text/html [] cryptome.org/Index/com.class 17:37:48 text/html [] cryptome.org/Index/ w.php?f=16&e=0 03/12/
%..........x............... '.."...........(...0...`...........%.............................................................................................................$...'...'...#......................................................................................................................................................$...1...C...U...f...y...........................r...a...M...=...-..................................................................................................................&...4...B...W...l............'''.utu.................]]\................|...e...O...=.......#..............................................................................................&...3...C...U...h...}....<==....................................................u...`. BINARy ANALYSIS: ORig. TrAffIc CApTure j-10.1.1.86-322348.pcaPpcap 436027 bytes (text) vm CapTure W9223397244018158380-79636-201-2012-03-12-173747.pvna.pcappcap 220175 bytes (Text) SOuRCe HoST: xXxxVM.DowneybRAnD.COm SRc iP: 10.X.x.86 SRc maC addreSs: 00:22:0d:4E:89:c2 MalwaRe: Exploit.BRowSeR Analysis OS: MICrOsoft WindoWsXp ProfessionaL 5.1 sp3 bot ComMuNicATion DEtaIls: SeRver DNs name: crYptome.org inFEction urLs: DL URl oCcUrreD Content Type DL URL oCcURred Content TypE [] cryptOmE.OrG/BLm042408.hTm 03/12/12 17:37:32 tExt/html [] cryPtOme.orG/index/ edU.ClASS 03/12/12 17:37:48 TexT/Html [] cryptome.oRg/Index/indeX.Php 03/12/12 17:37:39 Text/htMl [] CryPTome.orG/IndeX/ nET.clAss 03/12/12 17:37:49 text/html [] CrypTome.org/InDex/conTEnt/Jas.jAR 03/12/12 17:37:47 [] cryptoMe.org/INdeX/ orG.claSS 03/12/12 17:37:49 tExT/htMl [] CRypTOmE.orG/indEx/com.claSs 03/12/12 17:37:48 TeXt/htmL [] cryPTOME.org/indEx/ w.pHp?f=16&e=0 03/12/
%..........x.............. . '..".... ..... ..( ... 0. ..`. .... ......%....... . .... ...................... ..... .. . .... . .. ..... ....... . .. . . ... .. .. ... .. . .. ..... ... ....... .......... ... $. ..'...'...#. . .. .......... ... ............ ... ...... .. ... . ..... ... ..... ...... . ...... ......... .. . ...... . ....... . . .. .... ................. . .. . .............. ...... .. . .. $ . ..1 ... C...U...f. .. y.... . ....... . .. . . . ... . .....r...a... M...=...-.. . ... ...... .. ... . ...... ..... .. . ... ........... .... ......... ...... . ....... . ....... ...... ... ... .... . .. .. ... .. . ... . .. &.. . 4.. .B...W.. .l .. ..... .... . ' ' ' .utu ... .... ..... .....]]\..... ... .... . ... |...e ...O. ..=. .. ....# ...... ..... .. ............... .... ......... ... .. ... .. ..... . ...... ... ... ....... ....... . ... .. . . . .. &...3...C...U...h. .. } . .. .<==.... ...... . .. .. . ........ .. ... .... . . ..... .... . .. .....u.. .`. BI N AR YANALYSI S:  Orig.  T raf fic  Capt u re J -10.1. 1.86-322 348.p c appcap 436027b ytes (text) V M  C a p tu r e W9 223 39724401815 8380 - 7963 6-20 1 -2 012 - 03-12 -1737 47 . pv n a.pcappcap 220175 b yt es (te xt) S ource Host: x xxxVM.down e y b rand.com  Src IP :  10.x.x.86 Src  MACAddress: 0 0 :22:0d:4 e:89: c2 Malwa re: Explo i t .Browser  An aly sis  OS : Mi crosoft Windo w s XP P ro fession al5.1 sp3  Bo t C omm uni ca tion Deta ils: Ser ve rDN SNam e: cr y ptome.or gInf ec tio n URL s : DL U RL Oc curr ed  C o nte nt Type DL U RL O cc ur redCon te nt Ty pe [ ]  cr yptome. org/blm04 240 8 .htm  0 3/ 12/12 1 7:37:32 text/ ht ml [] cryp to me. org/In d e x/ edu.c lass 03/12/12 17:37:48t ext/htm l [ ] cry ptom e.org/Ind ex/ index. php 03/12/ 12 17: 37:39  t ext / h tml [ ] cr ypt om e.org/Inde x /  ne t.cla ss  03/ 12/12 1 7:37:49 text/html[ ] c ryptome.org/I nde x/co n t en t/J a s. j ar03 / 12/ 1 2  17:37:47 [] cr yptome.org /I n de x/ org.cla s s 0 3/ 12/12 1 7:37:49  text / html []  cryptome .org/Inde x/ com. c l ass  03/12/1217:37:48  text/htm l  [] c r yp tome. org /Index /w.p hp?f= 16&e=0 03/ 12/
%..........x............... '.."...........(...0...`...........%.............................................................................................................$...'...'...#......................................................................................................................................................$...1...C...U...f...y...........................r...a...M...=...-..................................................................................................................&...4...B...W...l............'''.utu.................]]\................|...e...O...=.......#..............................................................................................&...3...C...U...h...}....<==....................................................u...`._BINARY ANALYSIS:_Orig. Traffic Capture J-10.1.1.86-322348.pcappcap_436027 bytes_(text)_VM Capture_W9223397244018158380-79636-201-2012-03-12-173747.pvna.pcappcap_220175 bytes (text)_Source Host: xxxxVM.downeybrand.com_Src IP: 10.x.x.86 Src_MAC Address: 00:22:0d:4e:89:c2_Malware:_Exploit.Browser Analysis OS: Microsoft WindowsXP Professional 5.1 sp3 Bot Communication Details: Server DNS Name:_cryptome.org_Infection URLs:_DL_URL_Occurred Content Type DL URL_Occurred Content Type [] cryptome.org/blm042408.htm_03/12/12 17:37:32_text/html [] cryptome.org/Index/ edu.class 03/12/12 17:37:48 text/html []_cryptome.org/Index/index.php_03/12/12 17:37:39 text/html_[] cryptome.org/Index/ net.class 03/12/12 17:37:49 text/html [] cryptome.org/Index/content/Jas.jar 03/12/12_17:37:47 [] cryptome.org/Index/ org.class 03/12/12 17:37:49_text/html [] cryptome.org/Index/com.class_03/12/12_17:37:48_text/html [] cryptome.org/Index/ w.php?f=16&e=0_03/12/