MD5: 160cf3fa4e0e5d10692bd015c53ed13f
SHA1: a0e0cfaa762974659006e0c1e3dd70f43197e37d
SHA256: 42239ca96ca534d3f9b25b8252a7b83ac5c541f0a782e705a73e294d03a59ffd
SSDeep: 49152:ODmH0TLiiJAtlcy74vWrO544QuGU4JCI0pWyzc UtF4616JjWivHTopfbHS9ED:O5 Wy7Gu4lGU4iWyYPIE6xWivEjwED
Size: 2875392 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, ACProtect141
Company: no certificate found
Created at: 2015-05-02 17:57:44
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

attrib.exe:1032
attrib.exe:1984
attrib.exe:1468
attrib.exe:1108
qudongrensheng.dat:544
cacls.exe:560
cacls.exe:612
cacls.exe:2008
cacls.exe:348
cacls.exe:1944

The Trojan injects its code into the following process(es):

%original file name%.exe:484
wscntmx.exe:1824

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:484 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\drivers\etc\lmhosts.sam (3 bytes)
%System%\drivers\etc\protocol (799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\game[1].htm (22808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style[1].css (13923 bytes)
%System%\drivers\etc\networks (407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\click[1].htm (25 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso.hcjd56[1].txt (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\click[1].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bg[1].jpg (71058 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso.hcjd56[2].txt (313 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@25ucf145.hbgyzs[1].txt (174 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\title-bg[1].jpg (1889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cba2d.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\game[1].js (911 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jiaqun[1].htm (252 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\25ucf145.hbgyzs[1].htm (1600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\count2[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\soso.hcjd56[1].htm (740 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tee5_net_logo[1].jpg (11887 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@25ucf145.hbgyzs[2].txt (330 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (3856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\footer[1].jpg (5653 bytes)
%System%\drivers\etc\services (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\count1[1].gif (715 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bg[2].jpg (63412 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@25ucf145.hbgyzs[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cba2d.tmp (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@soso.hcjd56[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bg[1].jpg (0 bytes)

The process wscntmx.exe:1824 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cj[1].txt (8116 bytes)
C:\b.bat (255 bytes)
%System%\drivers\etc\hosts.ics (17013 bytes)
C:\a.bat (356 bytes)
%System%\drivers\etc\hosts (16478 bytes)

The process qudongrensheng.dat:544 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hao123_res.tmp (35 bytes)

Registry activity

The process attrib.exe:1032 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 8F 74 14 4C 53 90 B8 9C 60 60 3B 44 C6 9E D5"

The process attrib.exe:1984 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 31 87 A9 8A 32 66 A0 FB F8 22 65 A2 84 67 65"

The process attrib.exe:1468 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C 7D F1 11 97 CB 6F 8B D7 09 A4 16 B2 D2 94 76"

The process attrib.exe:1108 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D C4 5B 49 6D 0E CF 6A 01 51 B7 E9 EA 48 46 28"

The process %original file name%.exe:484 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1430578664"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 49 A0 23 73 12 21 2B B3 AF 2F 79 10 EA 24 83"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process wscntmx.exe:1824 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 86 5F 39 3B EA 53 82 53 24 0A 3E 51 76 7D 09"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wscntmx" = "D:\\wscntmx.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process qudongrensheng.dat:544 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F6 DF 87 BE 57 BE D0 53 5E 34 21 9D D2 92 29 78"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\WinHelp32\Parameters]
"ServiceDll" = "%System%\ackwpw.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"krnlsrvc" = "WinHelp32"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\WinHelp32\Parameters]
"seRVicemAIN" = "RunDllEntry"

[HKLM\System\CurrentControlSet\Services\WinHelp32]
"Description" = "Windows Help System for X32 windows desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process cacls.exe:560 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 89 66 14 F1 E9 A3 0C EE 35 C8 B0 03 D3 EC 4E"

The process cacls.exe:612 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "85 D2 BD 72 64 50 8E 59 BF 04 B6 20 54 6C 3B 4D"

The process cacls.exe:2008 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 91 67 FA 1A 1D 0B 8D E3 6F 48 DA F3 82 64 21"

The process cacls.exe:348 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB ED BB 7E 90 9A AA 56 26 62 1F E5 09 67 BB 0E"

The process cacls.exe:1944 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "97 22 8E 60 71 6B 62 45 04 7A E7 15 BA FD AA F1"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 65537 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://cj.941pojie.com/tc.txt	23.234.40.36
hxxp://cj.941pojie.com/zy.txt	23.234.40.36
hxxp://cj.941pojie.com/jiaqun.htm	23.234.40.36
hxxp://cj.941pojie.com/cxbt.txt	23.234.40.36
hxxp://cj.941pojie.com/cj.txt	23.234.40.36
hxxp://count46.51yes.com/click.aspx?id=460737107&logo=1	61.147.124.247
hxxp://count46.51yes.com/count1.gif	61.147.124.247
hxxp://count46.51yes.com/sa.htm?id=460737107&refe=&location=http://soso.hcjd56.com:88/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)	61.147.124.247
hxxp://count26.51yes.com/click.aspx?id=261222598&logo=2	61.147.125.67
hxxp://count26.51yes.com/count2.gif	61.147.125.67
hxxp://count26.51yes.com/sa.htm?id=261222598&refe=http://soso.hcjd56.com:88/&location=http://25ucf145.hbgyzs.com:83/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)	61.147.125.67
hxxp://jc.941pojie.com/cj.txt	23.234.40.36
hxxp://jc.941pojie.com/jiaqun.htm	23.234.40.36
25ucf145.hbgyzs.com	115.231.174.114
pub.idqqimg.com	103.7.30.184
soso.hcjd56.com	115.231.174.114
941pojie.meibu.net	112.251.255.39

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0
ET POLICY HTTP Request on Unusual Port Possibly Hostile

Traffic

GET /sa.htm?id=261222598&refe=http://soso.hcjd56.com:88/&location=http://25ucf145.hbgyzs.com:83/&color=32x&resolution=1276x846&returning=0&language=en-us&ua=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://25ucf145.hbgyzs.com:83/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count26.51yes.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 26 May 2015 02:34:13 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Length: 0
HTTP/1.1 200 OK..Date: Tue, 26 May 2015 02:34:13 GMT..Server: Microsof
t-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 1.1.4322..Cache-Co
ntrol: private..Content-Length: 0..

GET /click.aspx?id=460737107&logo=1 HTTP/1.1

Accept: */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 26 May 2015 02:31:49 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Type: text/html; charset=gb2312

Content-Length: 1777
..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(
endstr==-1) endstr=document.cookie.length;return document.cookie.subst
ring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.
length;var clen=document.cookie.length;var i=0;var j;while(i<clen) 
{j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=d
ocument.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..functio
n cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*360
00;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz
=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie
="cck_lasttime=" yesctime "; expires="   y_e.toGMTString()    "; path=
/";document.cookie="cck_count=0; expires="   y_e.toGMTString()    "; p
ath=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_c
ount");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y
_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctim
e "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count
=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var
 yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' esc
ape(document.location) '&color=' screen.colorDepth 'x&resolution=' scr
een.width 'x' screen.height '&returning=' cc_k() '&language=' navigato
r.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('
<a href="hXXp://countt.51yes.com/index.aspx?id=460737107" target=_b
lank><img width=20 height=20 border=0 hspace=0 vspace=0 src=
<<< skipped >>>

GET /count1.gif HTTP/1.1

Accept: */*

Referer: hXXp://soso.hcjd56.com:88/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count46.51yes.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 715

Content-Type: image/gif

Last-Modified: Thu, 07 Apr 2005 17:25:22 GMT

Accept-Ranges: bytes

ETag: "02d4c7963bc51:371b"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Tue, 26 May 2015 02:31:48 GMT
GIF89a.....~........n...............................B.....x..[.....(c.
...........................RS....wv...................Y.....~{....'...
........|........A.................ie.Z[.__..g.M.................v..sr
.`^.....................................>{.............&r....'.....
.........F......g.O.....lo.^..jj..........NN.............n...s........
.........m...................S..$~................!.....~.,...........
.~......stY..i..E@Tr9]9x~SM.4[z).V.R~JK*..W:0...0..nmA5&..Gy..%..^a?\.
11D>..k-...-%3NC..=d(.~Hg...L:3?o...}..~Ol....w4p}}(. .{.@.<.8..
..l(..p0a...<^....N...5L..1.....i)..@C...D`0B...!.....!..;.`P..A.5.
D..Qf...;. pa!...f..2b"......`A....8......R.M.`..F....(>`.. ....N.x
.HF...jx.s.F.1...H2.....#....;HTTP/1.1 200 OK..Content-Length: 715..Co
ntent-Type: image/gif..Last-Modified: Thu, 07 Apr 2005 17:25:22 GMT..A
ccept-Ranges: bytes..ETag: "02d4c7963bc51:371b"..Server: Microsoft-IIS
/6.0..X-Powered-By: ASP.NET..Date: Tue, 26 May 2015 02:31:48 GMT..GIF8
9a.....~........n...............................B.....x..[.....(c.....
.......................RS....wv...................Y.....~{....'.......
....|........A.................ie.Z[.__..g.M.................v..sr.`^.
....................................>{.............&r....'.........
.....F......g.O.....lo.^..jj..........NN.............n...s............
.....m...................S..$~................!.....~.,............~..
....stY..i..E@Tr9]9x~SM.4[z).V.R~JK*..W:0...0..nmA5&..Gy..%..^a?\.11D&
gt;..k-...-%3NC..=d(.~Hg...L:3?o...}..~Ol....w4p}}(. .{.@.<.8..
<<< skipped >>>

GET /click.aspx?id=261222598&logo=2 HTTP/1.1

Accept: */*

Referer: hXXp://25ucf145.hbgyzs.com:83/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: count26.51yes.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 26 May 2015 02:34:12 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 1.1.4322

Cache-Control: private

Content-Type: text/html; charset=gb2312

Content-Length: 1777
..function y_gVal(iz)..{var endstr=document.cookie.indexOf(";",iz);if(
endstr==-1) endstr=document.cookie.length;return document.cookie.subst
ring(iz,endstr);}..function y_g(name)..{var arg=name "=";var alen=arg.
length;var clen=document.cookie.length;var i=0;var j;while(i<clen) 
{j=i alen;if(document.cookie.substring(i,j)==arg) return y_gVal(j);i=d
ocument.cookie.indexOf(" ",i) 1;if(i==0) break;}return null;}..functio
n cc_k()..{var y_e=new Date();var y_t=93312000;var yesvisitor=1000*360
00;var yesctime=y_e.getTime();y_e.setTime(y_e.getTime() y_t);var yesiz
=document.cookie.indexOf("cck_lasttime");if(yesiz==-1){document.cookie
="cck_lasttime=" yesctime "; expires="   y_e.toGMTString()    "; path=
/";document.cookie="cck_count=0; expires="   y_e.toGMTString()    "; p
ath=/";return 0;}else{var y_c1=y_g("cck_lasttime");var y_c2=y_g("cck_c
ount");y_c1=parseInt(y_c1);y_c2=parseInt(y_c2);y_c3=yesctime-y_c1;if(y
_c3>yesvisitor){y_c2=y_c2 1;document.cookie="cck_lasttime=" yesctim
e "; expires=" y_e.toGMTString() "; path=/";document.cookie="cck_count
=" y_c2 "; expires=" y_e.toGMTString() "; path=/";}return y_c2;}}..var
 yesdata;..yesdata='&refe=' escape(document.referrer) '&location=' esc
ape(document.location) '&color=' screen.colorDepth 'x&resolution=' scr
een.width 'x' screen.height '&returning=' cc_k() '&language=' navigato
r.systemLanguage '&ua=' escape(navigator.userAgent);..document.write('
<a href="hXXp://countt.51yes.com/index.aspx?id=261222598" target=_b
lank><img width=20 height=20 border=0 hspace=0 vspace=0 src=
<<< skipped >>>

GET /count2.gif HTTP/1.1

Accept: */*