Gen.Trojan.Heur.VP2.cmKfaeHTyEob_9f24ccadb1

by malwarelabrobot on April 15th, 2015 in Malware Descriptions.

Trojan.Win32.Pasta.cfo (Kaspersky), Gen:Trojan.Heur.VP2.cmKfaeHTyEob (B) (Emsisoft), Gen:Trojan.Heur.VP2.cmKfaeHTyEob (AdAware), mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 9f24ccadb125d7230e093854856cb8b3
SHA1: c2fa93efa13a0d5a87d92852145f9e03119f5e9c
SHA256: 76ba5781a4dec15b84d1703de5de3aee6743bf0ad94363b9ad4a93f530e6bb2f
SSDeep: 768:tPaxdvbcJB7OkbnM6sWtqOlOun4JxI4sHxgkbGhJIgf9Mm79 d2e:JkvbcJB7Okbu9unt3HGkShJIWMm7Mse
Size: 40448 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2009-03-19 08:40:47
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

cpcad.exe:1300
smsso.exe:568
shuaweb.exe:256

The Trojan injects its code into the following process(es):

%original file name%.exe:1648

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process cpcad.exe:1300 makes changes in the file system.
The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@kaspersky[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@aaa[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@twitter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@microsoft[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@abmr[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@rambler[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@atdmt[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@adnxs[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@adgear[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yandex[3].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yandex[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msn[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yandex[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tns-counter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[2].txt (0 bytes)

The process %original file name%.exe:1648 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\FunshionInstall_C9518.exe (282758 bytes)
%WinDir%\shuaweb.exe (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\FunshionInstall_C9518[1].exe (563886 bytes)
%WinDir%\cpcad.exe (65 bytes)
%WinDir%\smsso.exe (24 bytes)

Registry activity

The process cpcad.exe:1300 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 DF F9 8F 93 85 A1 12 E9 41 A9 73 AE A3 3E C4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process smsso.exe:568 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 73 35 7B E7 B1 74 50 C1 6A 71 4C 2D 49 59 89"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.hacker520.com/"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"HomePage" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"smsso.exe" = "%WinDir%\smsso.exe"

The process shuaweb.exe:256 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 28 E2 3B CD E8 7F CC FA E5 FD CB 49 DF 63 47"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1648 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 29 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD F8 32 58 6F 1E 14 66 DC 43 EE 34 0E 5C B6 CD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5 File path
9ff43f877410f78d938696e8ec2b7166 c:\WINDOWS\cpcad.exe
802aaa1b075cf97734d5db4678d4a607 c:\WINDOWS\shuaweb.exe
86ddd2219788ae1dd7450d928293fcf2 c:\WINDOWS\smsso.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Microsoft Corporation
Product Name: Microsoft? Windows? Operating System
Product Version: 1.00
Legal Copyright: Microsoft Corporation
Legal Trademarks: Microsoft Corporation
Original Filename: HuTuXia090319.exe
Internal Name: HuTuXia090319
File Version: 1.00
File Description: Windows NT Session Manager
Comments:
Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX0 4096 163840 0 0 d41d8cd98f00b204e9800998ecf8427e
UPX1 167936 36864 36352 5.41283 19a588137156aa769b378acbc6898f41
.rsrc 204800 4096 3072 2.34038 23019afce06583b6a1f85bc23d9e6af0

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://partner.funshion.com/partner/download.php?id=9518 114.66.198.50
hxxp://down.fspcdn.com/software/download.php?id=9518&f=FunshionInstall3.0.3.68.exe
hxxp://neirong.funshion.com/software/download.php?id=9518&f=FunshionInstall3.0.3.68.exe 221.204.189.12
www.xiuzhe.com 113.10.139.46


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected

Traffic

GET /partner/download.php?id=9518 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partner.funshion.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Date: Mon, 13 Apr 2015 23:29:26 GMT
Server: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.7k PHP/5.1.6
X-Powered-By: PHP/5.1.6
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
location: hXXp://neirong.funshion.com/software/download.php?id=9518&f=FunshionInstall3.0.3.68.exe
Content-Length: 0
Connection: close
Content-Type: text/html



GET /software/download.php?id=9518&f=FunshionInstall3.0.3.68.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: neirong.funshion.com


HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Mon, 13 Apr 2015 23:29:27 GMT
Content-Type: application/octet-stream
Connection: keep-alive
X-Powered-By: PHP/5.2.14
Cache-Control: must-revalidate, post-check=0, pre-check=0
Content-Description: File Transfer
Content-Length: 9693688
Content-Disposition: attachment; filename=FunshionInstall_C9518.exe
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$...........F...F...
F...O.s.G...).\.B...]|i.c...]|].....O.t.C...]|\.....O.d.[...F.......]|
X.....]|l.G...]|m.G...F.`.G...]|j.G...RichF...........................
PE..L.....#U............................b.............@...............
...........`[email protected]......|4.......@..
................................................................@.....
.......................................text...^.......................
.... ..`.rdata...Z.......\..................@[email protected]...`....`...x...N
[email protected][email protected].......
.@......................@[email protected][email protected]..
......................................................................
......................................................................
......................................................................
............................................U.......4.....aL.3...$0...
S.].VW.}..\$ ....L...S...iT..h..D.....J.3...`.M...D$.u ..`[email protected]
[email protected])9t$.t.V....J......_^[.
.$0...3..R.....]....Bg..95`.M.......95\.M...y......`L..B...`L....HJJ..
x..|$.......u .....VS........;.t.SP.L$..8......HJJ..|$.......|$.j\W.j.
.....;.u...... .......`L..P...`L....x..TJJ..|$......u!.....j.S........
..t.SP.L$.........TJJ..|$.......|$..N..t$$.T$..5.....j9RW..P.J.P..T.J.
Ph`JJ.j..D$Th....P.(....G...$.H........J........P.B....D$$....H...
<<< skipped >>>






The Trojan connects to the servers at the folowing location(s):







%original file name%.exe_1648:




.rsrc
s.dll
urlm
URLDownloadTo
VB5!6&vb6chs.dll
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
urlmon
URLDownloadToFileA
GetWindowsDirectoryA
EnumWindows
VBA6.DLL
.text
`.data
MSVBVM60.DLL
ShuaWeb
SHDocVwCtl.WebBrowser
PostWeb
NetWeb
ieframe.dll
WebBrowser
wininet.dll
\%System%\ieframe.oca
advapi32.dll
WebBrowser1
K.DO}
KERNEL32.DLL
\Program Files\Avant Browser\avant.exe
explorer.exe
\Program Files\Funshion Online\Funshion\Funshion.exe
cpcad.exe
smsso.exe
shuaweb.exe
wscript.shell
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
hXXp://partner.funshion.com/partner/download.php?id=9518
FunshionInstall_C9518.exe
Funshion 1.5.2.15 Beta
\Program Files\IESuper\iesuper.dll
hXXp://u.heima8.com/pv/dl.htm?adid=20033&sid=0010089
setup_iesuper_0010089.exe
\Program Files\Internet Explorer\iexplore.exe
hXXp://spcode.baidu.com/spcode/spClick?tn=hacker520_sp&ctn=0&styleid=1502&tourl=hXXp://VVV.avantbrowser.cn/checkupdate/ui/download/download.aspx?prodid=17
setup.exe
hXXp:///
@isual Studio\VB98\C2.EXE.Man
Microsoft.XMLHTTP
hXXp://VVV.xiuzhe.com/list.txt
\WinBadao.ini
hXXp://VVV.lanse8.com.cn/post/post.asp?
Windows Internet Explorer
\Cookies\*.txt
CPCAD.exe
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\HomePage
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
hXXp://VVV.hacker520.com/
smss.exe
hXXp://VVV.xiuzhe.com/ShuaWeb.txt
\Program Files\Internet Explorer\iexplore.exe
Shua.exe
Windows NT Session Manager
Microsoft? Windows? Operating System
HuTuXia090319.exe

%original file name%.exe_1648_rwx_00401000_00030000:




VB5!6&vb6chs.dll
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
urlmon
URLDownloadToFileA
GetWindowsDirectoryA
EnumWindows
VBA6.DLL
.text
`.data
.rsrc
MSVBVM60.DLL
ShuaWeb
SHDocVwCtl.WebBrowser
PostWeb
NetWeb
ieframe.dll
WebBrowser
wininet.dll
\%System%\ieframe.oca
advapi32.dll
WebBrowser1
\Program Files\Avant Browser\avant.exe
explorer.exe
\Program Files\Funshion Online\Funshion\Funshion.exe
cpcad.exe
smsso.exe
shuaweb.exe
wscript.shell
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
hXXp://partner.funshion.com/partner/download.php?id=9518
FunshionInstall_C9518.exe
Funshion 1.5.2.15 Beta
\Program Files\IESuper\iesuper.dll
hXXp://u.heima8.com/pv/dl.htm?adid=20033&sid=0010089
setup_iesuper_0010089.exe
\Program Files\Internet Explorer\iexplore.exe
hXXp://spcode.baidu.com/spcode/spClick?tn=hacker520_sp&ctn=0&styleid=1502&tourl=hXXp://VVV.avantbrowser.cn/checkupdate/ui/download/download.aspx?prodid=17
setup.exe
hXXp:///
@isual Studio\VB98\C2.EXE.Man
Microsoft.XMLHTTP
hXXp://VVV.xiuzhe.com/list.txt
\WinBadao.ini
hXXp://VVV.lanse8.com.cn/post/post.asp?
Windows Internet Explorer
\Cookies\*.txt
CPCAD.exe
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\HomePage
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
hXXp://VVV.hacker520.com/
smss.exe
hXXp://VVV.xiuzhe.com/ShuaWeb.txt
\Program Files\Internet Explorer\iexplore.exe
Shua.exe

cpcad.exe_1300:




.text
`.data
.rsrc
MSVBVM60.DLL
ShuaWeb
SHDocVwCtl.WebBrowser
PostWeb
NetWeb
VB5!6&vb6chs.dll
ieframe.dll
WebBrowser
GetWindowsDirectoryA
wininet.dll
EnumWindows
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
\%System%\ieframe.oca
advapi32.dll
VBA6.DLL
C:\DOCUMF
hXXp:///
@isual Studio\VB98\C2.EXE.Man
Microsoft.XMLHTTP
hXXp://VVV.xiuzhe.com/list.txt
\WinBadao.ini
hXXp://VVV.lanse8.com.cn/post/post.asp?
\Program Files\Internet Explorer\iexplore.exe
Windows Internet Explorer
\Cookies\*.txt
FunshionInstall_C9518[1].exe
FUNSHI~1.EXE
CPCAD.exe

smsso.exe_568:




.text
`.data
.rsrc
MSVBVM60.DLL
WebBrowser1
SHDocVwCtl.WebBrowser
VB5!6&vb6chs.dll
ieframe.dll
WebBrowser
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
\%System%\ieframe.oca
VBA6.DLL
hXXp:///
wscript.shell
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\HomePage
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
hXXp://VVV.hacker520.com/
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
smss.exe

shuaweb.exe_256:




.text
`.data
.rsrc
MSVBVM60.DLL
WebBrowser1
SHDocVwCtl.WebBrowser
VB5!6&vb6chs.dll
ieframe.dll
WebBrowser
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
\%System%\ieframe.oca
GetWindowsDirectoryA
VBA6.DLL
Microsoft.XMLHTTP
hXXp://VVV.xiuzhe.com/ShuaWeb.txt
\Program Files\Internet Explorer\iexplore.exe
Windows Internet Explorer
\Program Files\Internet Explorer\iexplore.exe
Shua.exe






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    cpcad.exe:1300
    smsso.exe:568
    shuaweb.exe:256
    

    2. 

  2. Delete the original Trojan file.
    3. 

  3. Delete or disinfect the following files created/modified by the Trojan:
    

    %WinDir%\FunshionInstall_C9518.exe (282758 bytes)
    %WinDir%\shuaweb.exe (36 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\FunshionInstall_C9518[1].exe (563886 bytes)
    %WinDir%\cpcad.exe (65 bytes)
    %WinDir%\smsso.exe (24 bytes)
    

    4. 

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "smsso.exe" = "%WinDir%\smsso.exe"
    

    5. 

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    6. 

  6. Reboot the computer.
    7. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now