Gen.Trojan.Heur.MR.NuZaq4iM4aH_089f96dbbd

by malwarelabrobot on August 31st, 2015 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Trojan.Heur.MR.NuZ@aq4iM4aH (B) (Emsisoft), Gen:Trojan.Heur.MR.NuZ@aq4iM4aH (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, mzpefinder_pcap_file.YR, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 089f96dbbd2aaf08de1f5dafb91ee146
SHA1: 4649e8af86b9b1aec974800884d68e47232b7038
SHA256: c1067c4a69821b7cd207eba6b7fcdba73c0c543baddd4d88e6c86aa4a62338b0
SSDeep: 12288:g3nZMhJ ubN9ZYuDEBeIxO VQsqCEtEA0 uSrRT6l2Ke4Whd1wxMEDsjuUJXobN:g3nZqfbzZYuDEnc cqCEtEA0 BdKe4Wk
Size: 647917 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-02-17 16:55:21
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

Behaviour Description
EmailWorm Worm can send e-mails.


Process activity

The Trojan creates the following process(es):

svch0st.exe:332
%original file name%.exe:1988
WScript.exe:1632
WScript.exe:700

The Trojan injects its code into the following process(es):

wk7b_update.exe:1968

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process svch0st.exe:332 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\16019826[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\14911066[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wk-login[1].htm (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Program Files%\drivers\wk7b.ini (118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ip-data[1].htm (2144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Program Files%\drivers\wk7b_update.exe (9098 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The process %original file name%.exe:1988 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\drivers\$wdd.bat (199 bytes)
%Program Files%\drivers\wk7b.ini (130 bytes)
%Program Files%\drivers\svch0st.exe (19988 bytes)
%Program Files%\drivers\$wdd.vbs (98 bytes)
%Program Files%\drivers\sc.vbs (381 bytes)

The Trojan deletes the following file(s):

%Program Files%\drivers\__tmp_rar_sfx_access_check_519968 (0 bytes)

The process wk7b_update.exe:1968 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\drivers\svch0st.exe (46914 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\Íþ¿ÍÆæ±ø[1].exe (68699 bytes)

The Trojan deletes the following file(s):

%Program Files%\drivers\svch0st.exe (0 bytes)

The process WScript.exe:700 makes changes in the file system.
The Trojan deletes the following file(s):

%Program Files%\drivers\$wdd.bat (0 bytes)
%Program Files%\drivers\$wdd.vbs (0 bytes)
%Program Files%\drivers\sc.vbs (0 bytes)

Registry activity

The process svch0st.exe:332 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 C3 59 07 30 3E DB 60 15 AB 25 69 B9 D7 E5 C0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1988 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE FF A1 0D 59 95 13 01 88 BF A0 21 73 15 E1 21"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"wscript.exe" = "Microsoft (R) Windows Based Script Host"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process wk7b_update.exe:1968 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 1D 65 0E A5 77 5B EA 23 B4 A8 3F 2E 79 35 B7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process WScript.exe:1632 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 0F 3C FB 95 C1 3B 47 02 1A 31 95 64 67 DB C3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\progra~1\drivers]
"$wdd.bat" = "$wdd"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The process WScript.exe:700 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "87 46 A8 01 FD D4 94 A9 AE 46 9A 85 1C 60 6F FC"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\progra~1\drivers]
"SVCH0ST.EXE" = "www.wk7b.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

MD5 File path
16ea8a19663cf76909faeff7e122a219 c:\Program Files\drivers\wk7b_update.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 72754 73216 4.54391 894f17ef0a4e766fe486a080522d2539
.rdata 77824 7221 7680 3.38071 76315cc3ce7c7f34b89c00e96fd3d919
.data 86016 87804 512 2.4627 6f9415022853d8e925bcb178dd62e322
.CRT 176128 16 512 0.152104 d8690a66757c8eeab6988f4a858f4dcd
.rsrc 180224 14048 14336 3.6528 2949e1284c3723af5de5cd5df098fdbb

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3
6a6bccd9f2152490fc5406c43f356cab
ed8af42c61e9c629c8734e28e4cce5f3
40667f8e13fab2dfb391d6e350bee6dd

URLs

URL IP
hxxp://js.users.51.la/14911066.js 113.107.42.34
hxxp://js.users.51.la/16019826.js 113.107.42.34
hxxp://icon.51.la/icon_9.gif 42.236.73.3
web.51.la 222.187.225.122
web2.51.la 119.147.144.50
sys.rradmin.com 221.233.60.44


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request on Unusual Port Possibly Hostile
ET POLICY Unsupported/Fake Windows NT Version 5.0
GPL SHELLCODE x86 NOOP

Traffic

GET /icon_9.gif HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: icon.51.la
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: image/gif
Last-Modified: Fri, 26 May 2006 14:28:04 GMT
Accept-Ranges: bytes
ETag: "0b24a99d080c61:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sun, 30 Aug 2015 09:11:44 GMT
Content-Length: 893
GIF89a0............`..6..4.........f.........................!..NETSCA
PE2.0.....!.......,....0........I..8S.;'.'.cX.dj..hv ...A.5......I.@..
r......vN..G....k...0.....n..XN.{K..>.n>..q..V...9GOaes..r5VW.=2
\.o.......u....$Ik.2..#.............D.9.5.ZD............7.T.9.5.......
........!.......,....-.....].I2........f.H(..v.$6.-..i... ......oW..Z.
`'..._..r.*..V.U..n..NX.5 ....a...b.Z.>...TYR...y...!.......,....-.
...._.I1........&...!.........0...[.....VEc...H Ng.....O2......V..vM.a
:..JM...d}.o..j....kY\...zvxw..!.......,.... .....d.I2........f.H(..v.
.Eb.."...eJ.....X...../RH...S.YS.C.t.B...li...[. ...&l8s..3.M...[|....
.:l~Z{o.....!.......,....-.....o.I1........&...!.U".."....i^.F.U....I.
..F....`9q....#15MI3.d.x,..D....K.m../.. .[.`.K...?Yc*)._.\'.p%\cs.&..
.'..!.......,.... .....j.I2........f.H(...J..J$6.1B.......0..gy..../."
.bD.........T.u%..!.6..bD.\..s5.Y.F....7.V.-imd.f{9r.ayu.....;HTTP/1.1
 200 OK..Cache-Control: no-cache..Content-Type: image/gif..Last-Modifi
ed: Fri, 26 May 2006 14:28:04 GMT..Accept-Ranges: bytes..ETag: "0b24a9
9d080c61:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: S
un, 30 Aug 2015 09:11:44 GMT..Content-Length: 893..GIF89a0............
`..6..4.........f.........................!..NETSCAPE2.0.....!.......,
....0........I..8S.;'.'.cX.dj..hv [email protected]..
.0.....n..XN.{K..>.n>..q..V...9GOaes..r5VW.=2\.o.......u....$Ik.
2..#.............D.9.5.ZD............7.T.9.5...............!.......,..
..-.....].I2........f.H(..v.$6.-..i... ......oW..Z.`'..._..r.*..V.
<<< skipped >>>


GET /16019826.js HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: js.users.51.la
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: max-age=300
Content-Length: 1983
Content-Type: application/x-javascript
Last-Modified: Fri, 07 Aug 2015 04:06:40 GMT
Accept-Ranges: bytes
ETag: "1c165276c6d0d01:2eff"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sun, 30 Aug 2015 08:59:47 GMT
Connection: close
document.write ('<a href="hXXp://VVV.51.la/?16019826" target="_blan
k" title="51.La 网站流量统计ߏ
B;统"><img alt="51.La 网站流量
EDF;计系统" src="hXXp://icon.51.la/icon_9.gif" style
="border:none" /></a>\n');..var a9826tf="51la";var a9826pu=""
;var a9826pf="51la";var a9826su=window.location;var a9826sf=document.r
eferrer;var a9826of="";var a9826op="";var a9826ops=1;var a9826ot=1;var
 a9826d=new Date();var a9826color="";if (navigator.appName=="Netscape"
){a9826color=screen.pixelDepth;} else {a9826color=screen.colorDepth;}.
.try{a9826tf=top.document.referrer;}catch(e){}..try{a9826pu =window.pa
rent.location;}catch(e){}..try{a9826pf=window.parent.document.referrer
;}catch(e){}..try{a9826ops=document.cookie.match(new RegExp("(^| )AJST
AT_ok_pages=([^;]*)(;|$)"));a9826ops=(a9826ops==null)?1: (parseInt(une
scape((a9826ops)[2])) 1);var a9826oe =new Date();a9826oe.setTime(a9826
oe.getTime() 60*60*1000);document.cookie="AJSTAT_ok_pages=" a9826ops  
";path=/;expires=" a9826oe.toGMTString();a9826ot=document.cookie.match
(new RegExp("(^| )AJSTAT_ok_times=([^;]*)(;|$)"));if(a9826ot==null){a9
826ot=1;}else{a9826ot=parseInt(unescape((a9826ot)[2])); a9826ot=(a9826
ops==1)?(a9826ot 1):(a9826ot);}a9826oe.setTime(a9826oe.getTime() 365*2
4*60*60*1000);document.cookie="AJSTAT_ok_times=" a9826ot ";path=/;expi
res=" a9826oe.toGMTString();}catch(e){}..try{if(document.cookie==""){a
9826ops=-1;a9826ot=-1;}}catch(e){}..a9826of=a9826sf;if(a9826pf!=="
<<< skipped >>>


GET /14911066.js HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: js.users.51.la
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: max-age=300
Content-Length: 1985
Content-Type: application/x-javascript
Last-Modified: Fri, 07 Aug 2015 03:47:20 GMT
Accept-Ranges: bytes
ETag: "2b32c3c3d0d01:2eff"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sun, 30 Aug 2015 08:59:46 GMT
Connection: close
document.write ('<a href="hXXp://VVV.51.la/?14911066" target="_blan
k" title="51.La 网站流量统计ߏ
B;统"><img alt="51.La 网站流量
EDF;计系统" src="hXXp://icon.51.la/icon_9.gif" style
="border:none" /></a>\n');..var a1066tf="51la";var a1066pu=""
;var a1066pf="51la";var a1066su=window.location;var a1066sf=document.r
eferrer;var a1066of="";var a1066op="";var a1066ops=1;var a1066ot=1;var
 a1066d=new Date();var a1066color="";if (navigator.appName=="Netscape"
){a1066color=screen.pixelDepth;} else {a1066color=screen.colorDepth;}.
.try{a1066tf=top.document.referrer;}catch(e){}..try{a1066pu =window.pa
rent.location;}catch(e){}..try{a1066pf=window.parent.document.referrer
;}catch(e){}..try{a1066ops=document.cookie.match(new RegExp("(^| )AJST
AT_ok_pages=([^;]*)(;|$)"));a1066ops=(a1066ops==null)?1: (parseInt(une
scape((a1066ops)[2])) 1);var a1066oe =new Date();a1066oe.setTime(a1066
oe.getTime() 60*60*1000);document.cookie="AJSTAT_ok_pages=" a1066ops  
";path=/;expires=" a1066oe.toGMTString();a1066ot=document.cookie.match
(new RegExp("(^| )AJSTAT_ok_times=([^;]*)(;|$)"));if(a1066ot==null){a1
066ot=1;}else{a1066ot=parseInt(unescape((a1066ot)[2])); a1066ot=(a1066
ops==1)?(a1066ot 1):(a1066ot);}a1066oe.setTime(a1066oe.getTime() 365*2
4*60*60*1000);document.cookie="AJSTAT_ok_times=" a1066ot ";path=/;expi
res=" a1066oe.toGMTString();}catch(e){}..try{if(document.cookie==""){a
1066ops=-1;a1066ot=-1;}}catch(e){}..a1066of=a1066sf;if(a1066pf!=="
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

wk7b_update.exe_1968:

.text
`.rdata
@.data
.rsrc
t%SVh
t$(SSh
~%UVW
u$SShe
User32.dll
WinINet.dll
Wininet.dll
urlmon.dll
kernel32.dll
user32.dll
wininet.dll
winmm.dll
ComCtl32.dll
KERNEL32.DLL
Oleacc.dll
OLEACC.DLL
MsgWaitForMultipleObjects
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
DeleteUrlCacheEntryA
URLDownloadToFileA
UrlMkSetSessionOption
EnumWindows
{B6F7542F-B8FE-46a8-9605-98856A687097}
{EB5A8679-6C96-4465-A329-7911418F2582}
WebBrowser
wk7b_update.exe
\wk7b.ini
rasphone.exe -d
/wk-login.asp?banben=3.0&username=
hXXp://
116.208.1.26:8090
sys.rradmin.com:8090
sys.wk7b.com:8090
3598123.exe
http=
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Content-Type: application/x-www-form-urlencoded
wk7b_update.exe
/3.0/ip-data.asp
/3.0/pv-data.asp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
hXXp://VVV.wk7b.com/wk_tx.asp
hXXp://sys.rradmin.com:8090/
ws2_32.dll
Shell.Explorer.2
Winmm.dll
dsound.dll
S@Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.2a1pre) Gecko/20110324 Firefox/4.2a1pre
Mozilla/5.0 (Windows; U; Windows NT 6.1; tr-TR) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
Mozilla/5.0 (Windows; U; Windows NT 6.0) AppleWebKit/533.1 (KHTML, like Gecko) Maxthon/3.0.8.2 Safari/533.1
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; QQDownload 1.7; GTB6.6; TencentTraveler 4.0; SLCC1; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; Media Center PC 6.0; InfoPath.3; MS-RTC LM 8; Zune 4.7)
Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; Alexa Toolbar; .NET CLR 2.0.50727)
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.53 Safari/534.30
Mozilla/4.0 (compatible; MSIE 6.1; Windows XP; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0; Media Center PC 4.0; SLCC1; .NET CLR 3.0.04320)
Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36 SE 2.X MetaSr 1.0
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SV1) ; 360SE)
Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.43 BIDUBrowser/2.x Safari/537.31
Opera/9.80 (Android 4.2.2; Linux; Opera Mobi/ADR-1012211514; U; cn) Presto/2.6.35 Version/10.1
Mozilla/5.0 (Linux;U;Android 4.2.2;zh-cn;I7500 Build FRG83) AppleWebKit/533.1 (KHTML, like Gecko)Version/4.0 Mobile Safari/533.1
Mozilla/5.0 (Linux; U; Android 4.1.2; zh-cn; Coolpad 5890 Build/JZO54K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30; 360browser(securitypay,securityinstalled); 360(android,uppayplugin); 360 Aphone Browser (4.9.0)
Mozilla/5.0 (Android 4.2.2; zh-cn; HTC_DesireS_S510e Build/GRI40) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
Mozilla/5.0 (Android 4.2.2; zh-cn; Build/FRF91) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
Mozilla/5.0 (Linux; U; Android 4.2.2; zh-cn; MI-ONE Plus Build/GINGERBREAD) UC AppleWebKit/534.31 (KHTML, like Gecko) Mobile Safari/534.31
Opera/9.80 (Android 4.2.2; Opera Mini/7.6.32764/28.3234; U; zh) Presto/2.8.119 Version/11.10
Opera/9.80 (Android 4.2.2; Linux; Opera Mobi/ADR-1012221546; U; cn) Presto/2.7.60 Version/10.5
hXXp://VVV.baidu.com
hXXp://VVV.baidu.com/s?cl=3&wd=
hXXp://VVV.google.com/search?complete=1&hl=zh-CN&btnG=Google 搜索&meta=&q=
hXXp://VVV.so.com/s?ie=utf-8&src=360sou_home&q=
hXXps://
onkeydown
&7item.taobao.com/item.htm?id=20282100201
s.taobao.com/search?initiative_id=staobaoz_20130419&q=»ù´¡µçÐÅÐéÄâÖ÷»ú¿Õ¼ä 100MÐÍ
item.htm
?baidu.com,google-analytics.com
hXXp://VVV.wk7b.com/TaskForum.asp?ForumID=19
hXXp://VVV.wk7b.com
hXXp://iframe.ip138.com/ic.asp
hXXp://VVV.wk7b.com/wk_dama.asp
2012-1-1
hXXp://VVV.wk7b.com/wk_soft.asp?userid=
hXXp://VVV.wk7b.com/CreateUser.asp
hXXp://VVV.wk7b.com/wk_help.asp
\wk7b_update.exe
.js"></script>
<script language="javascript" type="text/javascript" src="hXXp://js.users.51.la/14911066.js"></script><script language="javascript" type="text/javascript" src="hXXp://js.users.51.la/
<script language="javascript" type="text/javascript" src="hXXp://js.users.51.la/14911066.js"></script>
hXXp://sys.rradmin.com/tools.asp
ieframe.dll
fNsQL
6=get 7.post 8.sina
Q%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
MSH_SCROLL_LINES_MSG
MSWHEEL_ROLLMSG
ole32.dll
__MSVCRT_HEAP_SELECT
RASAPI32.dll
iphlpapi.dll
SHLWAPI.dll
MPR.dll
WINMM.dll
WS2_32.dll
VERSION.dll
GetProcessHeap
WinExec
KERNEL32.dll
GetKeyState
RegisterHotKey
UnregisterHotKey
SetWindowsHookExA
UnhookWindowsHookEx
EnumChildWindows
USER32.dll
GetViewportOrgEx
GDI32.dll
MSIMG32.dll
WINSPOOL.DRV
RegCloseKey
RegOpenKeyExA
RegCreateKeyA
RegOpenKeyA
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
OLEAUT32.dll
COMCTL32.dll
oledlg.dll
WSOCK32.dll
WININET.dll
ATL.DLL
GetCPInfo
CreateDialogIndirectParamA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
comdlg32.dll
.PAVCException@@
Shell32.dll
Mpr.dll
Advapi32.dll
Gdi32.dll
Kernel32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
.PAVCFileException@@
: %d]
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
.PAVCNotSupportedException@@
out.prn
(*.prn)|*.prn|
%d.%d
%d/%d
%d / %d
Bogus message code %d
(%d-%d):
%ld%c
ReleaseNamedPipe
DisConnectNamedPipe
WriteNamedPipe
ReadNamedPipe
ConnectNamedPipe
ListenNamedPipe
CreateNamedPipe
\\.\mailslot\
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
%s\%s.lnk
Software\Microsoft\Windows\CurrentVersion\Run
%d%d%d
rundll32.exe shell32.dll,
1.1.3
;3 #>6.&
'2, / 0&7!4-)1#
SERVER_PORT_SECURE
SERVER_PORT
REMOTE_PORT
HTTPS_SERVER_SUBJECT
HTTPS_SERVER_ISSUER
HTTPS_SECRETKEYSIZE
HTTPS_KEYSIZE
HTTPS
HTTP_HeaderName
CERT_SUBJECT
CERT_SERVER_SUBJECT
CERT_SERVER_ISSUER
CERT_SERIALNUMBER
CERT_SECRETKEYSIZE
CERT_KEYSIZE
CERT_ISSUER
CERT_FLAGS
CERT_COOKIE
AUTH_PASSWORD
ALL_HTTP
(*.htm;*.html)|*.htm;*.html
.PAVCOleException@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
zcÁ
right-curly-bracket
left-curly-bracket
0123456789
C:\progra~1\drivers\wk7b_update.exe
#include "l.chs\afxres.rc" // Standard components
(*.*)
3.0.0.0
VVV.wk7b.com
[email protected]


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    svch0st.exe:332
    %original file name%.exe:1988
    WScript.exe:1632
    WScript.exe:700

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\16019826[1].js (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\14911066[1].js (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wk-login[1].htm (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
    %Program Files%\drivers\wk7b.ini (118 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ip-data[1].htm (2144 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    %Program Files%\drivers\wk7b_update.exe (9098 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    %Program Files%\drivers\$wdd.bat (199 bytes)
    %Program Files%\drivers\svch0st.exe (19988 bytes)
    %Program Files%\drivers\$wdd.vbs (98 bytes)
    %Program Files%\drivers\sc.vbs (381 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\Íþ¿ÍÆæ±ø[1].exe (68699 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now