MD5: 931dd74534e998a3bdb1b1cb4c3d1e5d
SHA1: e7679d1c678766f5747071510e6eb010a565b654
SHA256: fbbdbe11200905aab369b593495a75d4c9b052ba98424570a1ada802226e7fcb
SSDeep: 24576:qkTrY7yaFzgKrJMoTYRN17lGw9ov Z4b010YuDXmc2acmcKOmfZ:qgMVJTMl5Q t1b2XU5KOK
Size: 1986560 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC50, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, Armadillov171, UPolyXv05_v6
Company: Slimware Utilities, Inc.
Created at: 2016-11-10 13:34:57
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:3800
cleaner.exe:3004

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:3800 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\UPUpdata\cleaner.exe (50 bytes)

Registry activity

The process cleaner.exe:3004 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cleaner]
"DisplayName" = "cleaner 1.0.1"
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\UPUpdata\cleaner.exe"

"URLInfoAbout" = "www.cleaner.com"
"Publisher" = "cleaner"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cleaner" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\UPUpdata\cleaner.exe"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: UInstall
Product Name: UInstall
Product Version: 1.0.0.0
Legal Copyright: UInstall Network Technology Co., Ltd.
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: UInstall
Comments: UInstall
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://y2.zsocms.net/reportInstallaa.aspx?XUzcecWrtGZ2qJO7XNhLwVrUc/NZNt6wBjC6OXUxB7oBi37FkxEnjaLsbVNHdz8VR801RjfSPc6TnntNbekbiMtOTKJa952WyJBjs3jNmh888KfPlm2PH5mK/lPzF22M4077qpime93gDkEgXKZKGtVm09OB/1YXVULgzkVBR84=	192.126.112.118
hxxp://y2.zsocms.net/reportInstallaa.aspx?XUzcecWrtGZ2qJO7XNhLwVrUc/NZNt6wBjC6OXUxB7qp64iy1g4YK/giEpgYnBIGfDfletBR4HGbwo7z37 7yPpd2e9TkYUS6M8JF60hgaebx5EWRLkv/AOMVgJsL4DaveQuVbSzysHKc uSSkO5GOjPwTwkqMKl0ux0p2pNIcI=	192.126.112.118

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /reportInstallaa.aspx?XUzcecWrtGZ2qJO7XNhLwVrUc/NZNt6wBjC6OXUxB7oBi37FkxEnjaLsbVNHdz8VR801RjfSPc6TnntNbekbiMtOTKJa952WyJBjs3jNmh888KfPlm2PH5mK/lPzF22M4077qpime93gDkEgXKZKGtVm09OB/1YXVULgzkVBR84= HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Language: zh-CN

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MATP; .NET4.0C; .NET4.0E)

Host: y2.zsocms.net

HTTP/1.1 200 OK

Date: Mon, 21 Nov 2016 23:45:15 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 4.0.30319

Cache-Control: private

Content-Length: 0
....


GET /reportInstallaa.aspx?XUzcecWrtGZ2qJO7XNhLwVrUc/NZNt6wBjC6OXUxB7qp64iy1g4YK/giEpgYnBIGfDfletBR4HGbwo7z37 7yPpd2e9TkYUS6M8JF60hgaebx5EWRLkv/AOMVgJsL4DaveQuVbSzysHKc uSSkO5GOjPwTwkqMKl0ux0p2pNIcI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Language: zh-CN

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MATP; .NET4.0C; .NET4.0E)

Host: y2.zsocms.net

HTTP/1.1 200 OK

Date: Mon, 21 Nov 2016 23:45:15 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 4.0.30319

Cache-Control: private

Content-Length: 0

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

t$(SSh

|$D.tm

~%UVW

u$SShe

kernel32.dll

Kernel32.dll

ole32.dll

GetProcessHeap

neeNNNNNNNNdd.keAT

!#$%'''%'%%$#"

!'hhgmwusdC***.EErt

.WG9UU2

SU%uSc

iX.fx

(kOY;Z .Id

,mSGY

.Bka7

Local\Microsoft\Windows\Temporary Internet Files\

Software\Microsoft\Windows\CurrentVersion\Run\cleaner

Software\Microsoft\Windows\CurrentVersion\Uninstall\

1.0.1

\URLInfoAbout

htt

p://

y2.zsocms.n

et/jihuo123.a

spx?

@\\.\PhysicalDrive0

\\.\PHYSICALDRIVE

\\.\SCSI

\\.\SMARTVSD

user32.dll

0-0-0-0-0-0

var key = CryptoJS.enc.Utf8.parse("0102030405060708");

var iv = CryptoJS.enc.Utf8.parse('0102030405060708');

var decrypt = CryptoJS.AES.decrypt(srcs, key, { iv: iv,mode:CryptoJS.mode.CBC});

return CryptoJS.enc.Utf8.stringify(encrypted).toString();

var srcs = CryptoJS.enc.Utf8.parse(word);

var encrypted = CryptoJS.AES.encrypt(srcs, key, { iv: iv,mode:CryptoJS.mode.CBC});

return encrypted.toString();

var key = CryptoJS.enc.Utf8.parse("vjcklzjvlkiofqwn3i9023j-v2-129dz");

var iv = CryptoJS.enc.Utf8.parse('2lfn2fn2v98v0n;2');

CryptoJS v3.1.2

code.google.com/p/crypto-js

code.google.com/p/crypto-js/wiki/License

var CryptoJS=CryptoJS||function(h,r){var k={},l=k.lib={},n=function(){},f=l.Base={extend:function(a){n.prototype=this;var b=new n;a&&b.mixIn(a);b.hasOwnProperty("init")||(b.init=function(){b.$super.init.apply(this,arguments)});b.init.prototype=b;b.$super=this;return b},create:function(){var a=this.extend();a.init.apply(a,arguments);return a},init:function(){},mixIn:function(a){for(var b in a)a.hasOwnProperty(b)&&(this[b]=a[b]);a.hasOwnProperty("toString")&&(this.toString=a.toString)},clone:function(){return this.init.prototype.extend(this)}},

j=l.WordArray=f.extend({init:function(a,b){a=this.words=a||[];this.sigBytes=b!=r?b:4*a.length},toString:function(a){return(a||s).stringify(this)},concat:function(a){var b=this.words,d=a.words,c=this.sigBytes;a=a.sigBytes;this.clamp();if(c%4)for(var e=0;e<a;e  )b[c e>>>2]|=(d[e>>>2]>>>24-8*(e%4)&255)<<24-8*((c e)%4);else if(65535<d.length)for(e=0;e<a;e =4)b[c e>>>2]=d[e>>>2];else b.push.apply(b,d);this.sigBytes =a;return this},clamp:function(){var a=this.words,b=this.sigBytes;a[b>>>2]&=4294967295<<

32-8*(b%4);a.length=h.ceil(b/4)},clone:function(){var a=f.clone.call(this);a.words=this.words.slice(0);return a},random:function(a){for(var b=[],d=0;d<a;d =4)b.push(4294967296*h.random()|0);return new j.init(b,a)}}),m=k.enc={},s=m.Hex={stringify:function(a){var b=a.words;a=a.sigBytes;for(var d=[],c=0;c<a;c  ){var e=b[c>>>2]>>>24-8*(c%4)&255;d.push((e>>>4).toString(16));d.push((e&15).toString(16))}return d.join("")},parse:function(a){for(var b=a.length,d=[],c=0;c<b;c =2)d[c>>>3]|=parseInt(a.substr(c,

2),16)<<24-4*(c%8);return new j.init(d,b/2)}},p=m.Latin1={stringify:function(a){var b=a.words;a=a.sigBytes;for(var d=[],c=0;c<a;c  )d.push(String.fromCharCode(b[c>>>2]>>>24-8*(c%4)&255));return d.join("")},parse:function(a){for(var b=a.length,d=[],c=0;c<b;c  )d[c>>>2]|=(a.charCodeAt(c)&255)<<24-8*(c%4);return new j.init(d,b)}},t=m.Utf8={stringify:function(a){try{return decodeURIComponent(escape(p.stringify(a)))}catch(b){throw Error("Malformed UTF-8 data");}},parse:function(a){return p.parse(unescape(encodeURIComponent(a)))}},

q=l.BufferedBlockAlgorithm=f.extend({reset:function(){this._data=new j.init;this._nDataBytes=0},_append:function(a){"string"==typeof a&&(a=t.parse(a));this._data.concat(a);this._nDataBytes =a.sigBytes},_process:function(a){var b=this._data,d=b.words,c=b.sigBytes,e=this.blockSize,f=c/(4*e),f=a?h.ceil(f):h.max((f|0)-this._minBufferSize,0);a=f*e;c=h.min(4*a,c);if(a){for(var g=0;g<a;g =e)this._doProcessBlock(d,g);g=d.splice(0,a);b.sigBytes-=c}return new j.init(g,c)},clone:function(){var a=f.clone.call(this);

a._data=this._data.clone();return a},_minBufferSize:0});l.Hasher=q.extend({cfg:f.extend(),init:function(a){this.cfg=this.cfg.extend(a);this.reset()},reset:function(){q.reset.call(this);this._doReset()},update:function(a){this._append(a);this._process();return this},finalize:function(a){a&&this._append(a);return this._doFinalize()},blockSize:16,_createHelper:function(a){return function(b,d){return(new a.init(d)).finalize(b)}},_createHmacHelper:function(a){return function(b,d){return(new u.HMAC.init(a,

d)).finalize(b)}}});var u=k.algo={};return k}(Math);

var CryptoJS=CryptoJS||function(u,p){var d={},l=d.lib={},s=function(){},t=l.Base={extend:function(a){s.prototype=this;var c=new s;a&&c.mixIn(a);c.hasOwnProperty("init")||(c.init=function(){c.$super.init.apply(this,arguments)});c.init.prototype=c;c.$super=this;return c},create:function(){var a=this.extend();a.init.apply(a,arguments);return a},init:function(){},mixIn:function(a){for(var c in a)a.hasOwnProperty(c)&&(this[c]=a[c]);a.hasOwnProperty("toString")&&(this.toString=a.toString)},clone:function(){return this.init.prototype.extend(this)}},

r=l.WordArray=t.extend({init:function(a,c){a=this.words=a||[];this.sigBytes=c!=p?c:4*a.length},toString:function(a){return(a||v).stringify(this)},concat:function(a){var c=this.words,e=a.words,j=this.sigBytes;a=a.sigBytes;this.clamp();if(j%4)for(var k=0;k<a;k  )c[j k>>>2]|=(e[k>>>2]>>>24-8*(k%4)&255)<<24-8*((j k)%4);else if(65535<e.length)for(k=0;k<a;k =4)c[j k>>>2]=e[k>>>2];else c.push.apply(c,e);this.sigBytes =a;return this},clamp:function(){var a=this.words,c=this.sigBytes;a[c>>>2]&=4294967295<<

32-8*(c%4);a.length=u.ceil(c/4)},clone:function(){var a=t.clone.call(this);a.words=this.words.slice(0);return a},random:function(a){for(var c=[],e=0;e<a;e =4)c.push(4294967296*u.random()|0);return new r.init(c,a)}}),w=d.enc={},v=w.Hex={stringify:function(a){var c=a.words;a=a.sigBytes;for(var e=[],j=0;j<a;j  ){var k=c[j>>>2]>>>24-8*(j%4)&255;e.push((k>>>4).toString(16));e.push((k&15).toString(16))}return e.join("")},parse:function(a){for(var c=a.length,e=[],j=0;j<c;j =2)e[j>>>3]|=parseInt(a.substr(j,

2),16)<<24-4*(j%8);return new r.init(e,c/2)}},b=w.Latin1={stringify:function(a){var c=a.words;a=a.sigBytes;for(var e=[],j=0;j<a;j  )e.push(String.fromCharCode(c[j>>>2]>>>24-8*(j%4)&255));return e.join("")},parse:function(a){for(var c=a.length,e=[],j=0;j<c;j  )e[j>>>2]|=(a.charCodeAt(j)&255)<<24-8*(j%4);return new r.init(e,c)}},x=w.Utf8={stringify:function(a){try{return decodeURIComponent(escape(b.stringify(a)))}catch(c){throw Error("Malformed UTF-8 data");}},parse:function(a){return b.parse(unescape(encodeURIComponent(a)))}},

q=l.BufferedBlockAlgorithm=t.extend({reset:function(){this._data=new r.init;this._nDataBytes=0},_append:function(a){"string"==typeof a&&(a=x.parse(a));this._data.concat(a);this._nDataBytes =a.sigBytes},_process:function(a){var c=this._data,e=c.words,j=c.sigBytes,k=this.blockSize,b=j/(4*k),b=a?u.ceil(b):u.max((b|0)-this._minBufferSize,0);a=b*k;j=u.min(4*a,j);if(a){for(var q=0;q<a;q =k)this._doProcessBlock(e,q);q=e.splice(0,a);c.sigBytes-=j}return new r.init(q,j)},clone:function(){var a=t.clone.call(this);

a._data=this._data.clone();return a},_minBufferSize:0});l.Hasher=q.extend({cfg:t.extend(),init:function(a){this.cfg=this.cfg.extend(a);this.reset()},reset:function(){q.reset.call(this);this._doReset()},update:function(a){this._append(a);this._process();return this},finalize:function(a){a&&this._append(a);return this._doFinalize()},blockSize:16,_createHelper:function(a){return function(b,e){return(new a.init(e)).finalize(b)}},_createHmacHelper:function(a){return function(b,e){return(new n.HMAC.init(a,

e)).finalize(b)}}});var n=d.algo={};return d}(Math);

(function(){var u=CryptoJS,p=u.lib.WordArray;u.enc.Base64={stringify:function(d){var l=d.words,p=d.sigBytes,t=this._map;d.clamp();d=[];for(var r=0;r<p;r =3)for(var w=(l[r>>>2]>>>24-8*(r%4)&255)<<16|(l[r 1>>>2]>>>24-8*((r 1)%4)&255)<<8|l[r 2>>>2]>>>24-8*((r 2)%4)&255,v=0;4>v&&r 0.75*v<p;v  )d.push(t.charAt(w>>>6*(3-v)&63));if(l=t.charAt(64))for(;d.length%4;)d.push(l);return d.join("")},parse:function(d){var l=d.length,s=this._map,t=s.charAt(64);t&&(t=d.indexOf(t),-1!=t&&(l=t));for(var t=[],r=0,w=0;w<

l;w  )if(w%4){var v=s.indexOf(d.charAt(w-1))<<2*(w%4),b=s.indexOf(d.charAt(w))>>>6-2*(w%4);t[r>>>2]|=(v|b)<<24-8*(r%4);r  }return p.create(t,r)},_map:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /="}})();

(function(u){function p(b,n,a,c,e,j,k){b=b (n&a|~n&c) e k;return(b<<j|b>>>32-j) n}function d(b,n,a,c,e,j,k){b=b (n&c|a&~c) e k;return(b<<j|b>>>32-j) n}function l(b,n,a,c,e,j,k){b=b (n^a^c) e k;return(b<<j|b>>>32-j) n}function s(b,n,a,c,e,j,k){b=b (a^(n|~c)) e k;return(b<<j|b>>>32-j) n}for(var t=CryptoJS,r=t.lib,w=r.WordArray,v=r.Hasher,r=t.algo,b=[],x=0;64>x;x  )b[x]=4294967296*u.abs(u.sin(x 1))|0;r=r.MD5=v.extend({_doReset:function(){this._hash=new w.init([1732584193,4023233417,2562383102,271733878])},

_doProcessBlock:function(q,n){for(var a=0;16>a;a  ){var c=n a,e=q[c];q[c]=(e<<8|e>>>24)&16711935|(e<<24|e>>>8)&4278255360}var a=this._hash.words,c=q[n 0],e=q[n 1],j=q[n 2],k=q[n 3],z=q[n 4],r=q[n 5],t=q[n 6],w=q[n 7],v=q[n 8],A=q[n 9],B=q[n 10],C=q[n 11],u=q[n 12],D=q[n 13],E=q[n 14],x=q[n 15],f=a[0],m=a[1],g=a[2],h=a[3],f=p(f,m,g,h,c,7,b[0]),h=p(h,f,m,g,e,12,b[1]),g=p(g,h,f,m,j,17,b[2]),m=p(m,g,h,f,k,22,b[3]),f=p(f,m,g,h,z,7,b[4]),h=p(h,f,m,g,r,12,b[5]),g=p(g,h,f,m,t,17,b[6]),m=p(m,g,h,f,w,22,b[7]),

E,15,b[50]),m=s(m,g,h,f,r,21,b[51]),f=s(f,m,g,h,u,6,b[52]),h=s(h,f,m,g,k,10,b[53]),g=s(g,h,f,m,B,15,b[54]),m=s(m,g,h,f,e,21,b[55]),f=s(f,m,g,h,v,6,b[56]),h=s(h,f,m,g,x,10,b[57]),g=s(g,h,f,m,t,15,b[58]),m=s(m,g,h,f,D,21,b[59]),f=s(f,m,g,h,z,6,b[60]),h=s(h,f,m,g,C,10,b[61]),g=s(g,h,f,m,j,15,b[62]),m=s(m,g,h,f,A,21,b[63]);a[0]=a[0] f|0;a[1]=a[1] m|0;a[2]=a[2] g|0;a[3]=a[3] h|0},_doFinalize:function(){var b=this._data,n=b.words,a=8*this._nDataBytes,c=8*b.sigBytes;n[c>>>5]|=128<<24-c2;var e=u.floor(a/

4294967296);n[(c 64>>>9<<4) 15]=(e<<8|e>>>24)&16711935|(e<<24|e>>>8)&4278255360;n[(c 64>>>9<<4) 14]=(a<<8|a>>>24)&16711935|(a<<24|a>>>8)&4278255360;b.sigBytes=4*(n.length 1);this._process();b=this._hash;n=b.words;for(a=0;4>a;a  )c=n[a],n[a]=(c<<8|c>>>24)&16711935|(c<<24|c>>>8)&4278255360;return b},clone:function(){var b=v.clone.call(this);b._hash=this._hash.clone();return b}});t.MD5=v._createHelper(r);t.HmacMD5=v._createHmacHelper(r)})(Math);

(function(){var u=CryptoJS,p=u.lib,d=p.Base,l=p.WordArray,p=u.algo,s=p.EvpKDF=d.extend({cfg:d.extend({keySize:4,hasher:p.MD5,iterations:1}),init:function(d){this.cfg=this.cfg.extend(d)},compute:function(d,r){for(var p=this.cfg,s=p.hasher.create(),b=l.create(),u=b.words,q=p.keySize,p=p.iterations;u.length<q;){n&&s.update(n);var n=s.update(d).finalize(r);s.reset();for(var a=1;a<p;a  )n=s.finalize(n),s.reset();b.concat(n)}b.sigBytes=4*q;return b}});u.EvpKDF=function(d,l,p){return s.create(p).compute(d,

CryptoJS.lib.Cipher||function(u){var p=CryptoJS,d=p.lib,l=d.Base,s=d.WordArray,t=d.BufferedBlockAlgorithm,r=p.enc.Base64,w=p.algo.EvpKDF,v=d.Cipher=t.extend({cfg:l.extend(),createEncryptor:function(e,a){return this.create(this._ENC_XFORM_MODE,e,a)},createDecryptor:function(e,a){return this.create(this._DEC_XFORM_MODE,e,a)},init:function(e,a,b){this.cfg=this.cfg.extend(b);this._xformMode=e;this._key=a;this.reset()},reset:function(){t.reset.call(this);this._doReset()},process:function(e){this._append(e);return this._process()},

finalize:function(e){e&&this._append(e);return this._doFinalize()},keySize:4,ivSize:4,_ENC_XFORM_MODE:1,_DEC_XFORM_MODE:2,_createHelper:function(e){return{encrypt:function(b,k,d){return("string"==typeof k?c:a).encrypt(e,b,k,d)},decrypt:function(b,k,d){return("string"==typeof k?c:a).decrypt(e,b,k,d)}}}});d.StreamCipher=v.extend({_doFinalize:function(){return this._process(!0)},blockSize:1});var b=p.mode={},x=function(e,a,b){var c=this._iv;c?this._iv=u:c=this._prevBlock;for(var d=0;d<b;d  )e[a d]^=

c[d]},q=(d.BlockCipherMode=l.extend({createEncryptor:function(e,a){return this.Encryptor.create(e,a)},createDecryptor:function(e,a){return this.Decryptor.create(e,a)},init:function(e,a){this._cipher=e;this._iv=a}})).extend();q.Encryptor=q.extend({processBlock:function(e,a){var b=this._cipher,c=b.blockSize;x.call(this,e,a,c);b.encryptBlock(e,a);this._prevBlock=e.slice(a,a c)}});q.Decryptor=q.extend({processBlock:function(e,a){var b=this._cipher,c=b.blockSize,d=e.slice(a,a c);b.decryptBlock(e,a);x.call(this,

e,a,c);this._prevBlock=d}});b=b.CBC=q;q=(p.pad={}).Pkcs7={pad:function(a,b){for(var c=4*b,c=c-a.sigBytes%c,d=c<<24|c<<16|c<<8|c,l=[],n=0;n<c;n =4)l.push(d);c=s.create(l,c);a.concat(c)},unpad:function(a){a.sigBytes-=a.words[a.sigBytes-1>>>2]&255}};d.BlockCipher=v.extend({cfg:v.cfg.extend({mode:b,padding:q}),reset:function(){v.reset.call(this);var a=this.cfg,b=a.iv,a=a.mode;if(this._xformMode==this._ENC_XFORM_MODE)var c=a.createEncryptor;else c=a.createDecryptor,this._minBufferSize=1;this._mode=c.call(a,

this,b&&b.words)},_doProcessBlock:function(a,b){this._mode.processBlock(a,b)},_doFinalize:function(){var a=this.cfg.padding;if(this._xformMode==this._ENC_XFORM_MODE){a.pad(this._data,this.blockSize);var b=this._process(!0)}else b=this._process(!0),a.unpad(b);return b},blockSize:4});var n=d.CipherParams=l.extend({init:function(a){this.mixIn(a)},toString:function(a){return(a||this.formatter).stringify(this)}}),b=(p.format={}).OpenSSL={stringify:function(a){var b=a.ciphertext;a=a.salt;return(a?s.create([1398893684,

1701076831]).concat(a).concat(b):b).toString(r)},parse:function(a){a=r.parse(a);var b=a.words;if(1398893684==b[0]&&1701076831==b[1]){var c=s.create(b.slice(2,4));b.splice(0,4);a.sigBytes-=16}return n.create({ciphertext:a,salt:c})}},a=d.SerializableCipher=l.extend({cfg:l.extend({format:b}),encrypt:function(a,b,c,d){d=this.cfg.extend(d);var l=a.createEncryptor(c,d);b=l.finalize(b);l=l.cfg;return n.create({ciphertext:b,key:c,iv:l.iv,algorithm:a,mode:l.mode,padding:l.padding,blockSize:a.blockSize,formatter:d.format})},

decrypt:function(a,b,c,d){d=this.cfg.extend(d);b=this._parse(b,d.format);return a.createDecryptor(c,d).finalize(b.ciphertext)},_parse:function(a,b){return"string"==typeof a?b.parse(a,this):a}}),p=(p.kdf={}).OpenSSL={execute:function(a,b,c,d){d||(d=s.random(8));a=w.create({keySize:b c}).compute(a,d);c=s.create(a.words.slice(b),4*c);a.sigBytes=4*b;return n.create({key:a,iv:c,salt:d})}},c=d.PasswordBasedCipher=a.extend({cfg:a.cfg.extend({kdf:p}),encrypt:function(b,c,d,l){l=this.cfg.extend(l);d=l.kdf.execute(d,

b.keySize,b.ivSize);l.iv=d.iv;b=a.encrypt.call(this,b,c,d.key,l);b.mixIn(d);return b},decrypt:function(b,c,d,l){l=this.cfg.extend(l);c=this._parse(c,l.format);d=l.kdf.execute(d,b.keySize,b.ivSize,c.salt);l.iv=d.iv;return a.decrypt.call(this,b,c,d.key,l)}})}();

(function(){for(var u=CryptoJS,p=u.lib.BlockCipher,d=u.algo,l=[],s=[],t=[],r=[],w=[],v=[],b=[],x=[],q=[],n=[],a=[],c=0;256>c;c  )a[c]=128>c?c<<1:c<<1^283;for(var e=0,j=0,c=0;256>c;c  ){var k=j^j<<1^j<<2^j<<3^j<<4,k=k>>>8^k&255^99;l[e]=k;s[k]=e;var z=a[e],F=a[z],G=a[F],y=257*a[k]^16843008*k;t[e]=y<<24|y>>>8;r[e]=y<<16|y>>>16;w[e]=y<<8|y>>>24;v[e]=y;y=16843009*G^65537*F^257*z^16843008*e;b[k]=y<<24|y>>>8;x[k]=y<<16|y>>>16;q[k]=y<<8|y>>>24;n[k]=y;e?(e=z^a[a[a[G^z]]],j^=a[a[j]]):e=j=1}var H=[0,1,2,4,8,

16,32,64,128,27,54],d=d.AES=p.extend({_doReset:function(){for(var a=this._key,c=a.words,d=a.sigBytes/4,a=4*((this._nRounds=d 6) 1),e=this._keySchedule=[],j=0;j<a;j  )if(j<d)e[j]=c[j];else{var k=e[j-1];j%d?6<d&&4==j%d&&(k=l[k>>>24]<<24|l[k>>>16&255]<<16|l[k>>>8&255]<<8|l[k&255]):(k=k<<8|k>>>24,k=l[k>>>24]<<24|l[k>>>16&255]<<16|l[k>>>8&255]<<8|l[k&255],k^=H[j/d|0]<<24);e[j]=e[j-d]^k}c=this._invKeySchedule=[];for(d=0;d<a;d  )j=a-d,k=d%4?e[j]:e[j-4],c[d]=4>d||4>=j?k:b[l[k>>>24]]^x[l[k>>>16&255]]^q[l[k>>>

8&255]]^n[l[k&255]]},encryptBlock:function(a,b){this._doCryptBlock(a,b,this._keySchedule,t,r,w,v,l)},decryptBlock:function(a,c){var d=a[c 1];a[c 1]=a[c 3];a[c 3]=d;this._doCryptBlock(a,c,this._invKeySchedule,b,x,q,n,s);d=a[c 1];a[c 1]=a[c 3];a[c 3]=d},_doCryptBlock:function(a,b,c,d,e,j,l,f){for(var m=this._nRounds,g=a[b]^c[0],h=a[b 1]^c[1],k=a[b 2]^c[2],n=a[b 3]^c[3],p=4,r=1;r<m;r  )var q=d[g>>>24]^e[h>>>16&255]^j[k>>>8&255]^l[n&255]^c[p  ],s=d[h>>>24]^e[k>>>16&255]^j[n>>>8&255]^l[g&255]^c[p  ],t=

d[k>>>24]^e[n>>>16&255]^j[g>>>8&255]^l[h&255]^c[p  ],n=d[n>>>24]^e[g>>>16&255]^j[h>>>8&255]^l[k&255]^c[p  ],g=q,h=s,k=t;q=(f[g>>>24]<<24|f[h>>>16&255]<<16|f[k>>>8&255]<<8|f[n&255])^c[p  ];s=(f[h>>>24]<<24|f[k>>>16&255]<<16|f[n>>>8&255]<<8|f[g&255])^c[p  ];t=(f[k>>>24]<<24|f[n>>>16&255]<<16|f[g>>>8&255]<<8|f[h&255])^c[p  ];n=(f[n>>>24]<<24|f[g>>>16&255]<<16|f[h>>>8&255]<<8|f[k&255])^c[p  ];a[b]=q;a[b 1]=s;a[b 2]=t;a[b 3]=n},keySize:8});u.AES=p._createHelper(d)})();

WinHttp.WinHttpRequest.5.1

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MATP; .NET4.0C; .NET4.0E)

Adobe Photoshop CC 2015 (Windows)

2016:11:02 17:28:16

urlTEXT

MsgeTEXT

hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmp:CreateDate="2016-11-02T17:28:16 08:00" xmp:MetadataDate="2016-11-02T17:28:16 08:00" xmp:ModifyDate="2016-11-02T17:28:16 08:00" xmpMM:InstanceID="xmp.iid:7e70061f-41cb-1f49-be3a-d2a475ef5096" xmpMM:DocumentID="adobe:docid:photoshop:ace149e0-a0de-11e6-a85c-a068e3682b52" xmpMM:OriginalDocumentID="xmp.did:0326d588-e2dc-064b-ad9f-3c07b38950a5" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:0326d588-e2dc-064b-ad9f-3c07b38950a5" stEvt:when="2016-11-02T17:28:16 08:00" stEvt:softwareAgent="Adobe Photoshop CC 2015 (Windows)"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:7e70061f-41cb-1f49-be3a-d2a475ef5096" stEvt:when="2016-11-02T17:28:16 08:00" stEvt:softwareAgent="Adobe Photoshop CC 2015 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <photoshop:TextLayers> <rdf:Bag> <rdf:li photoshop:LayerName="Quick Clean" photoshop:LayerText="Quick Clean"/> <rdf:li photoshop:LayerName="Quick Clean" photoshop:LayerText="Quick Clean"/> <rdf:li photoshop:LayerName="cleaning cookies" photoshop:LayerText="cleaning cookies"/> <rdf:li photoshop:LayerName="cleaning JunkFile" photoshop:LayerText="cleaning JunkFile"/> <rdf:li photoshop:LayerName="cleaning mark" photoshop:LayerText="cleaning mark"/> </rdf:Bag> </photoshop:TextLayers> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>

IEC hXXp://VVV.iec.ch

.IEC 61966-2.1 Default RGB colour space - sRGB

CRT curv

,.BB1

k^td%XY

2016:11:02 19:31:31

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmp:CreateDate="2016-11-02T19:31:31 08:00" xmp:MetadataDate="2016-11-02T19:31:31 08:00" xmp:ModifyDate="2016-11-02T19:31:31 08:00" xmpMM:InstanceID="xmp.iid:c7c77740-5a81-ba49-a91b-59c2ce0a9862" xmpMM:DocumentID="adobe:docid:photoshop:e0192e4a-a0ef-11e6-a85c-a068e3682b52" xmpMM:OriginalDocumentID="xmp.did:59fab3de-61ea-bd47-a6df-b3c4afdcb634" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:59fab3de-61ea-bd47-a6df-b3c4afdcb634" stEvt:when="2016-11-02T19:31:31 08:00" stEvt:softwareAgent="Adobe Photoshop CC 2015 (Windows)"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:c7c77740-5a81-ba49-a91b-59c2ce0a9862" stEvt:when="2016-11-02T19:31:31 08:00" stEvt:softwareAgent="Adobe Photoshop CC 2015 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <photoshop:TextLayers> <rdf:Bag> <rdf:li photoshop:LayerName="Quick Clean" photoshop:LayerText="Quick Clean"/> <rdf:li photoshop:LayerName="Quick Clean" photoshop:LayerText="Quick Clean"/> <rdf:li photoshop:LayerName="cleaning cookies" photoshop:LayerText="cleaning cookies"/> <rdf:li photoshop:LayerName="cleaning JunkFile" photoshop:LayerText="cleaning JunkFile"/> <rdf:li photoshop:LayerName="cleaning mark" photoshop:LayerText="cleaning mark"/> </rdf:Bag> </photoshop:TextLayers> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>

2016:11:02 19:31:05

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmp:CreateDate="2016-11-02T19:31:05 08:00" xmp:MetadataDate="2016-11-02T19:31:05 08:00" xmp:ModifyDate="2016-11-02T19:31:05 08:00" xmpMM:InstanceID="xmp.iid:8e95c104-38e5-e449-981f-059f6dc48734" xmpMM:DocumentID="adobe:docid:photoshop:d74078a4-a0ef-11e6-a85c-a068e3682b52" xmpMM:OriginalDocumentID="xmp.did:9506ed0a-89b8-4f4a-a4d8-b28c02301b88" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:9506ed0a-89b8-4f4a-a4d8-b28c02301b88" stEvt:when="2016-11-02T19:31:05 08:00" stEvt:softwareAgent="Adobe Photoshop CC 2015 (Windows)"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:8e95c104-38e5-e449-981f-059f6dc48734" stEvt:when="2016-11-02T19:31:05 08:00" stEvt:softwareAgent="Adobe Photoshop CC 2015 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <photoshop:TextLayers> <rdf:Bag> <rdf:li photoshop:LayerName="Quick Clean" photoshop:LayerText="Quick Clean"/> <rdf:li photoshop:LayerName="Quick Clean" photoshop:LayerText="Quick Clean"/> <rdf:li photoshop:LayerName="cleaning cookies" photoshop:LayerText="cleaning cookies"/> <rdf:li photoshop:LayerName="cleaning JunkFile" photoshop:LayerText="cleaning JunkFile"/> <rdf:li photoshop:LayerName="cleaning mark" photoshop:LayerText="cleaning mark"/> </rdf:Bag> </photoshop:TextLayers> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>

2016:11:02 17:30:01

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmp:CreateDate="2016-11-02T17:30:01 08:00" xmp:MetadataDate="2016-11-02T17:30:01 08:00" xmp:ModifyDate="2016-11-02T17:30:01 08:00" xmpMM:InstanceID="xmp.iid:a353d074-d408-6a48-90b3-a3bb202feaaa" xmpMM:DocumentID="adobe:docid:photoshop:e86e583d-a0de-11e6-a85c-a068e3682b52" xmpMM:OriginalDocumentID="xmp.did:3a2d5ff0-3c7e-d14c-80c2-9ad748e8b818" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:3a2d5ff0-3c7e-d14c-80c2-9ad748e8b818" stEvt:when="2016-11-02T17:30:01 08:00" stEvt:softwareAgent="Adobe Photoshop CC 2015 (Windows)"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:a353d074-d408-6a48-90b3-a3bb202feaaa" stEvt:when="2016-11-02T17:30:01 08:00" stEvt:softwareAgent="Adobe Photoshop CC 2015 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <photoshop:TextLayers> <rdf:Bag> <rdf:li photoshop:LayerName="Quick Clean" photoshop:LayerText="Quick Clean"/> <rdf:li photoshop:LayerName="Quick Clean" photoshop:LayerText="Quick Clean"/> <rdf:li photoshop:LayerName="cleaning cookies" photoshop:LayerText="cleaning cookies"/> <rdf:li photoshop:LayerName="cleaning JunkFile" photoshop:LayerText="cleaning JunkFile"/> <rdf:li photoshop:LayerName="cleaning mark" photoshop:LayerText="cleaning mark"/> </rdf:Bag> </photoshop:TextLayers> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

WinExec

GetWindowsDirectoryA

KERNEL32.dll

GetKeyState

USER32.dll

GetViewportOrgEx

GDI32.dll

WINMM.dll

WINSPOOL.DRV

RegCloseKey

RegOpenKeyExA

RegCreateKeyA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

OLEAUT32.dll

COMCTL32.dll

WS2_32.dll

GetCPInfo

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

RegCreateKeyExA

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

\\.\Scsi0:

\\.\PhysicalDrive0

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

msscript.ocx

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÁ

C:\Users\"%CurrentUserName%"\AppData\Roaming\UPUpdata\cleaner.exe

#include "l.chs\afxres.rc" // Standard components

-\\192.168.0.130\Canon MF4700 Series UFRII LT

(*.*)

1.0.0.0

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:3800
   cleaner.exe:3004

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Roaming\UPUpdata\cleaner.exe (50 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "cleaner" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\UPUpdata\cleaner.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.