MD5: fe346dcb4b431ed264148a2a1d64b8d1
SHA1: 44360015a0e98ab839addbe69c30bd348649784b
SHA256: b1a34baba9b98e72adaa66bc256a38583354600f786bc17b244e39f041e99108
SSDeep: 24576:gy621jVmT6E2C5sTX6Ocse2MAb9MG8Bty1Q8B3anvt5Rm8YO:giVmT6E2O9SMG8nKQCAbKO
Size: 1241600 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-01-25 11:57:44
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):

%original file name%.exe:2956

The Trojan injects its code into the following process(es):

data.dat:2528

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2956 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\data.dat (50 bytes)

The process data.dat:2528 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bea.tmp (5873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\link[1].htm (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\ad[1].jpg (6073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bda.tmp (7971 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bfb.tmp (1425 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bea.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bda.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bfb.tmp (0 bytes)

Registry activity

The process data.dat:2528 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\data_RASMANCS]
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\data_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\data_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\data_RASAPI32]
"EnableConsoleTracing" = "0"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\data_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\data_RASAPI32]
"FileTracingMask" = "4294901760"
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\data_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://fuckcs.com/link.htm	209.73.153.38
hxxp://fuckcs.com/ad.jpg	209.73.153.38

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /link.htm HTTP/1.1

Accept: */*

Referer: hXXp://fuckcs.com/link.htm

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: fuckcs.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 41

Content-Type: text/html

Last-Modified: Fri, 25 Nov 2016 13:26:06 GMT

Accept-Ranges: bytes

ETag: "a010f0791f47d21:135d"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Thu, 16 Feb 2017 00:03:57 GMT
hXXp://169re.com|hXXp://fuckcs.com/ad.jpg....


GET /ad.jpg HTTP/1.1

Accept: */*

Referer: hXXp://fuckcs.com/ad.jpg

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: fuckcs.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 23376

Content-Type: image/jpeg

Last-Modified: Sun, 20 Nov 2016 16:07:09 GMT

Accept-Ranges: bytes

ETag: "7cb3d2254843d21:135d"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Thu, 16 Feb 2017 00:03:57 GMT
......Exif..MM.*............... ......................................
.................................................(...........1........
...2...........i............. .......-....'..-....'.Adobe Photoshop CS
6 (Windows).2016:11:22 00:06:11.............0221......................
.............<...............................n...........v.(.......
..............~...................H.......H.........XICC_PROFILE......
HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.................
......-HP  ................................................cprt...P...
3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@.
...dmnd...T...pdmdd........vued...L....view.......$lumi........meas...
....$tech...0....rTRC...<....gTRC...<....bTRC...<....text....
Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-
2.1............sRGB IEC61966-2.1......................................
............XYZ .......Q........XYZ ................XYZ ......o...8...
..XYZ ......b.........XYZ ......$.........desc........IEC hXXp://VVV.i
ec.ch............IEC hXXp://VVV.iec.ch................................
..............desc........IEC 61966-2.1 Default RGB colour space - sRG
B............IEC 61966-2.1 Default RGB colour space - sRGB............
..........desc.......,Reference Viewing Condition in IEC61966-2.1.....
......,Reference Viewing Condition in IEC61966-2.1....................
......view.........._...............\.....XYZ .....L.V.P...W..meas....
............................sig ....CRT curv......................
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

GetProcessHeap

KERNEL32.dll

EnumChildWindows

USER32.dll

SHLWAPI.dll

ShellExecuteA

SHELL32.dll

GDI32.dll

MSVCRT.dll

WINMM.dll

MTMwKCFeX14hKUVkaXQoIV5fXiEp0ruhokY5zbjK07 qudijrEYxMNe80MS/qrnYXHJcblxyXG62/qGitPK/qtPOz7fU2bXju/fXosjr087Pt6Oow7vTzs 31PXDtNeiyOujv6OpXHJcblxyXG7I/aGixL/HsM7S1rvFqsHL0rvQqdb3wfe1xLXYzbzNuMrTo6yxyMjnybPErs 1wdCjrLvws7XVvqOsusu7 bXYyrLDtLXEoaPDv7j2tdjNvL6vsuzNwbfLtcTXsLG4tPrC67a8srvSu9H5o6zNprfRyrG85LXEo6y689D41NnU9rzTsMlcclxuXHJcbsvEoaLPwtTYoaLS4rz7t7TAobXY1rdodHRwOi8vZnVja2NzLmMoIV5fXiEp1qez1jVF0 nA1rOho6jM7MzdxqXF5LK71qez1qOpINans9a52calyM66zsSjyr3KudPDt723qCDPyNTL0NDTzs 3IMi7uvPU2rTyv6q4qNb6ILXju/fXosjrIMzhyr7Xosjrs8m5piC9 NPOz7ewtEY5v6rG9M24ytMgRjEwuKjW te80McoIV5fXiEpV1RXaW5kb3d8Q1NHT824ytMr17zQxDEuMA0K

MTQwKCFeX14hKV9FTF9QaWNCb3goIV5fXiEpTkVXSU1BR0VfMSghXl9eISlXVFdpbmRvd3wwfENTR0/NuMrTK9e80MQxLjAoIV5fXiEpV1RXaW5kb3d8Q1NHT824ytMr17zQxDEuMA0K

zsLcsMzhyr58XyZffDQ4fF8mX3zKudPDx u52LHVybG2vtC70Lt8XyZffHxfJl98

winver.exe

hXXp://

hXXps://

user32.dll

ntdll.dll

shlwapi.dll

shell32.dll

kernel32.dll

program internal error number is %d.

:"%s"

:"%s".

1.1.3

;3 #>6.&

'2, / 0&7!4-)1#

.xy&E=c

U$C%c

mP%S3

,O..ho

.ETB^N

O?u.hG

%Scq2@W

.fsax(

N.ul4

.Jjr}'H"

/C%cM

P.UB5

!.yyF

XC^ L%uM

]G%xV

%SDK4

SQlW

G-6%S

eU.gU

.vSNq

5OudP

R(%X=

.FX"_

*%d\&

;Z.mfuj

M:\wW

].RxZ

g%U8Y

M*.rK

59\G%SY

K..Yk{

aL&

.%D'@G

(&%2U

L.qg6

ce_%D

%C@0H

@s .sk5

`.sge#V]

ANH.aQ

;%c&!

\.HH^

*$:%d

%xYs]

[.PX{p

D0.cSxu

.NNR'

7J.yT

%XQn@

rz.yIL

EcT%x#

W.XZ~

..Xc&

2u.eKITFBp

.yk (Di

D.gbQP

GBj%c

}&-4}v

%s;7*

0%x@w

%C^L:

Õ6m*

ccu.md!dd

.Lpr4

m%sBt

5.ch*

tn!ay%F

2.kKX

I %d)

.aEd(

fTpe

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

.nGA$;P

.ZRY][

.bOLK

, #&')*)

-0-(0%()(

^E%cO(

%UMU3"

version="1.0.0.0"

name="Company.Product.Name"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

{7BF80980-BF32-101A-8BBB-00AA00300CAB}

0.1.0.0

Bundle.exe

data.dat_2528:

.text

`.rdata

@.data

.rsrc

t$(SSh

~%UVW

u$SShe

Bv.SCv

wininet.dll

kernel32.dll

ntdll.dll

user32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

UnhookWindowsHookEx

MsgWaitForMultipleObjects

SetWindowsHookExA

EnumWindows

ShellExecuteA

hXXp://fuckcs.com/link.htm

Wp.Iw

A.zkt@

5p|%U

ù'p

oO.wm]b

L.qg6

ce_%D

%C@0H

@s .sk5

.njvX

ANH.aQ

;%c&!

\.HH^

*$:%d

%xYs]

[.PX{p

D0.cSxu

.NNR'

7J.yT

%XQn@

rz.yIL

EcT%x#

W.XZ~

..Xc&

2u.eKITFBp

.yk (Di

D.gbQP

GBj%c

}&-4}v

%s;7*

0%x@w

%C^L:

Õ6m*

ccu.md!dd

f%.Vy

5r.KV}b

5.ch*

y.MMO}

tn!ay%F

2.kKX

I %d)

.aEd(

fTpe

.LLbX

https

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

http=

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

gdi32.dll

\game.dll

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

hXXp://fuckcs.com

%d&&'

123456789

00003333

deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

inflate 1.1.3 Copyright 1995-1998 Mark Adler

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

RASAPI32.dll

GetProcessHeap

WinExec

KERNEL32.dll

GetKeyState

GetViewportOrgEx

WINMM.dll

WINSPOOL.DRV

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

WS2_32.dll

WININET.dll

GetCPInfo

CreateDialogIndirectParamA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

RegCreateKeyExA

%x.tmp

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

.PAVCException@@

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

1.1.3

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÁ

c:\data.dat

#include "l.chs\afxres.rc" // Standard components

1, 0, 6, 6

- Skin.dll

(*.*)

1.0.0.0

(hXXp://VVV.eyuyan.com)

data.dat_2528_rwx_10000000_0003F000:

`.rsrc

L$(h%f

SSh0j

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ð<

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$<#$#=

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1, 0, 6, 6

- Skin.dll

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:2956
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\data.dat (50 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bea.tmp (5873 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\link[1].htm (41 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\ad[1].jpg (6073 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bda.tmp (7971 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68bfb.tmp (1425 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.