MD5: d43f17e2c2dbeb0532b317c28db5f6e7
SHA1: 2896eafe5b11ff4da20b6d981c458e3e8467a949
SHA256: 59200bb1f408e68e52f3a0b2109caffea31847ce6dfec83a35dcb249b8a136dc
SSDeep: 6144:s183qncF488uUyZILgdHsRfDXLb6OYm3ol F D wmspf/5sGsM7ojPUloinpNK2p:n6ncJ7IC THLF4gF72sDM7ojoocO
Size: 475592 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Mezaa
Created at: 2009-12-06 00:53:24
Analyzed on: WindowsXPESX SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):
No processes have been created.
The Application injects its code into the following process(es):

%original file name%.exe:1860

Mutexes

The following mutexes were created/opened:

ShimCacheMutex
DBWinMutex
SendoriUpgrade

File activity

The process %original file name%.exe:1860 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn7E.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MZA_up_install.exe (314473 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn7E.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn7E.tmp\DynNSIS.dll (15375 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn7E.tmp\blowfish.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\config.ini (223 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn7E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\config.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh7D.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1860 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 89 3D A4 A9 C2 A9 BF 4C 9C D1 25 65 1C 8F F9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Mezaa
Product Name: Mezaa
Product Version:
Legal Copyright: (c) Mezaa All rights reserved.
Legal Trademarks:
Original Filename:
Internal Name: MZAAppSetup-3.0.0.exe
File Version: 3.0.0.0
File Description: Mezaa
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://d24n8jcd5iaqcl.cloudfront.net/upgrade/3_0_1/config.ini
hxxp://d24n8jcd5iaqcl.cloudfront.net/upgrade/3_0_1/MZAAppSetup-3.0.1.exe
hxxp://cdn.mezaa.com/upgrade/3_0_1/MZAAppSetup-3.0.1.exe	54.230.38.229
hxxp://cdn.mezaa.com/upgrade/3_0_1/config.ini	54.230.38.229

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Executable served from Amazon S3

Traffic

GET /upgrade/3_0_1/config.ini HTTP/1.0

Host: cdn.mezaa.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 223

Connection: close

Date: Tue, 04 Nov 2014 15:33:29 GMT

Last-Modified: Thu, 24 Jul 2014 00:40:27 GMT

ETag: "48f1485b2cbafc48bfb2c43c413ae8bb"

Accept-Ranges: bytes

Server: AmazonS3

Age: 6898

X-Cache: Hit from cloudfront

Via: 1.1 f546d9284285510be4df384663e7934f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _fgwbqJw-QSJ6NkReZF8SF46DnJcLIMi4UfV46byi4Sr6NTuAbwOag==
[hgfdrt]..hhgh="322vff8bSKPeytElvGEw2wmEmJtD31XH"..jhgf=Z3qnRGOGA7Amna
/4xIvPiv7ABO6pKYj7..ijhg=Ilj5TzlblF8 LdCbM5fb6Ks8WXXoo97ID2aQ2yaPpwrXX
5eBO0P4Pw==..fdes=WP4yv39WBhM=..mngt=XdQQwOGxHo1ZLV7/TVUAPg==..NoLoadP
artners=0..

GET /upgrade/3_0_1/MZAAppSetup-3.0.1.exe HTTP/1.0

Host: cdn.mezaa.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 3792872

Connection: close

Date: Wed, 05 Nov 2014 22:18:11 GMT

Last-Modified: Wed, 23 Jul 2014 23:52:31 GMT

ETag: "b79751ed29555cfbd5eee5fc3df98424"

Accept-Ranges: bytes

Server: AmazonS3

Age: 6898

X-Cache: Hit from cloudfront

Via: 1.1 38725119ff70beb3d62fd652f133ae0b.cloudfront.net (CloudFront)

X-Amz-Cf-Id: XfyTlsIFHUuHf75pH_jrOVguS7alnRPgDpbmUc14uCzwdqQH3IiUtw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L...d.
.K.................d..........^5............@.........................
.@.......?:..................................................}........
....9.................................................................
.............................text....c.......d.................. ..`.r
data...............h..............@[email protected]...........|..........
[email protected]....... ...........................rsrc....}.......~....
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected][email protected]...\.@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
[email protected]...`[email protected]
....E..9}[email protected].}[email protected]..
[email protected][email protected] [email protected].@._^3.
[.....L$....C...Si.....VW.T.....tO.q.3.;5..C.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..C.r._^[...U..QQ.U.SV..i....
<<< skipped >>>

The Application connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

GetAsyncKeyState

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

logging set to %d

settings logging to %d

created uninstaller: %d, "%s"

WriteReg: error creating key "%s\%s"

WriteReg: error writing into "%s\%s" "%s"

WriteRegBin: "%s\%s" "%s"="%s"

WriteRegDWORD: "%s\%s" "%s"="0xx"

WriteRegExpandStr: "%s\%s" "%s"="%s"

WriteRegStr: "%s\%s" "%s"="%s"

DeleteRegKey: "%s\%s"

DeleteRegValue: "%s\%s" "%s"

WriteINIStr: wrote [%s] %s=%s in %s

CopyFiles "%s"->"%s"

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d

Error registering DLL: Could not load %s

Error registering DLL: %s not found in %s

Exec: failed createprocess ("%s")

Exec: success ("%s")

Exec: command="%s"

ExecShell: success ("%s": file:"%s" params:"%s")

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d

Exch: stack < %d elements

RMDir: "%s"

MessageBox: %d,"%s"

Delete: "%s"

File: wrote %d to "%s"

File: skipped: "%s" (overwriteflag=%d)

File: error creating "%s"

File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"

Rename failed: %s

Rename on reboot: %s

Rename: %s

IfFileExists: file "%s" does not exist, jumping %d

IfFileExists: file "%s" exists, jumping %d

CreateDirectory: "%s" created

CreateDirectory: can't create "%s" - a file already exists

CreateDirectory: can't create "%s" (err=%d)

CreateDirectory: "%s" (%d)

SetFileAttributes: "%s":X

Sleep(%d)

detailprint: %s

Call: %d

Aborting: "%s"

Jump: %d

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

install.log

%u.%u%s%s

Skipping section: "%s"

Section: "%s"

New install of "%s" to "%s"

RegDeleteKeyExA

RMDir: RemoveDirectory failed("%s")

RMDir: RemoveDirectory on Reboot("%s")

RMDir: RemoveDirectory("%s")

RMDir: RemoveDirectory invalid input("%s")

Delete: DeleteFile failed("%s")

Delete: DeleteFile on Reboot("%s")

Delete: DeleteFile("%s")

%s=%s

*?|<>/":

invalid registry key

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

x%c

~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn7E.tmp\DynNSIS.dll

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn7E.tmp\DynNSIS.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn7E.tmp

ication Data\Mezaa\config.mezaa

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn7E.tmp\DynNSIS.dll

Mezaa v3.0.0.

8 8$8(8,8

3%3U3

2#2)22292[2

<"<&<*<.<2<6<:<

2!2%2 2/25292

8 8@8`8|8

RegEnumKeyExA

RegQueryInfoKeyA

RPCRT4.dll

WS2_32.dll

CertFindCertificateInStore

CertGetNameStringA

CryptMsgGetParam

CRYPT32.dll

GetCPInfo

GetProcessHeap

DynNSIS.dll

DoCompletePurgePass

canReport

getSmallHTTP

zcÁ

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

; ;$;(;,;

9-9}9

= =$=(=,=0=4=8=

< <$<(<,<

'.Pyer%

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unable to close due to unfinished backup operation

unknown database: %s

rH .Od

LR]Q.Te

;%)1#%1)5%

731=;1

7%s`bv6

ep.Ta

Mezaa v3.0.0 Setup

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\config.ini

config.ini

Agree to continue. You must accept the agreement to install Mezaa v3.0.0.

pped: "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn7E.tmp\DynNSIS.dll" (overwriteflag=1)

tmp\DynNSIS.dll"

Mezaa v3.0.0 Setup

%original file name%.exe

11020101

_0_1/MZAAppSetup-3.0.1.exe

c:\%original file name%.exe

%Program Files%\Mezaa

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh7D.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

hXXp://cdn.mezaa.com/

upgrade/3_0_1/MZAAppSetup-3.0.1.exe

3.0.1

1114316

705298899

)-.Yln

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

3.0.0.0

MZAAppSetup-3.0.0.exe

%original file name%.exe_1860_rwx_10004000_00001000:

callback%d

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Application file.
   
3. Delete or disinfect the following files created/modified by the Application:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\nsn7E.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\MZA_up_install.exe (314473 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn7E.tmp\NSISdl.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn7E.tmp\DynNSIS.dll (15375 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn7E.tmp\blowfish.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\config.ini (223 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.