MD5: 0c5142c53fa7ac3cd0a138656ac0adb2
SHA1: 3e34ad516fd9dda706aca88a07ee1db4462a1765
SHA256: 275112aecfcaeac5585d8acce9d66db0f03e1497125fba26ae80ceb8a0c60eac
SSDeep: 24576:IY6KJUnzLcjsHvaB0h6QJf cSho pqTsTauXRMe/h1X :zJUnzAjsHSBFQJg0Juh1X
Size: 1217536 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: T.M.S.P
Created at: 2011-03-08 14:46:37
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1584
server.exe:1692
server.exe:320
server.exe:1748

The Trojan injects its code into the following process(es):

MOD_SA~1.EXE:632

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1584 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\server.exe (10010 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\MOD_SA~1.EXE (12408 bytes)

The process MOD_SA~1.EXE:632 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsb3.tmp\System.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb3.tmp\brandingurl.dll (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (4643 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb3.tmp\bassmod.dll (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb3.tmp\music.mod (784 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsl1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb3.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1584 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 9E 69 0F AA 73 40 73 67 99 95 9B AC 17 48 97"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

The process server.exe:1692 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1E 86 76 3D B1 57 87 0D 93 AE E5 7E B3 52 ED 2F"

The process server.exe:320 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D 11 79 2E 69 53 41 5D BB EA F4 87 D2 A3 99 53"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process server.exe:1748 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 9E 1B 78 0B 5B 74 CE 34 C0 B0 ED 1B E3 07 F0"

The process MOD_SA~1.EXE:632 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "89 B7 F1 3C 60 88 F0 BC CA C4 E2 2E 03 B8 DA B4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Microsoft Corporation
Product Name: HD Player
Product Version: 9.00.8112.16421
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE .MUI
Internal Name: Wextract
File Version: 9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: Korean (Korea)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.rsrc

@.reloc

advapi32.dll

wininit.ini

advpack.dll

Software\Microsoft\Windows\CurrentVersion\App Paths

setupapi.dll

setupx.dll

IXPd.TMP

TMP4351$.TMP

FINISHMSG

USRQCMD

ADMQCMD

msdownld.tmp

Invalid parameter passed to C runtime function.

wextract.pdb

PSSSSSSh

RegCloseKey

RegOpenKeyExA

RegQueryInfoKeyA

RegCreateKeyExA

ADVAPI32.dll

GetWindowsDirectoryA

KERNEL32.dll

GDI32.dll

ExitWindowsEx

MsgWaitForMultipleObjects

USER32.dll

_acmdln

_amsg_exit

msvcrt.dll

COMCTL32.dll

VERSION.dll

rundll32.exe %s,InstallHinfSection %s 128 %s

SHELL32.DLL

Software\Microsoft\Windows\CurrentVersion\RunOnce

PendingFileRenameOperations

System\CurrentControlSet\Control\Session Manager\FileRenameOperations

wextract_cleanup%d

%s /D:%s

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"

Command.com /c %s

zcÁ

mod_sa.SA-MP.v0.3x RC1

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\

%X"FA

be`ú

MOD_SA~1.EXE

server.exe

x}f.LG

z-S.Bb

.wA.\

[ÁUE

j%Ufs

hHo.us

l.Yq3

,H%Ud

yß^

k.yur

.EUp"*d

`.gp#[

m{?[%u

rbWP÷

-U6}.7

l%xOrK

\M%Sk

L%dGl

Ð*u

.GXF>

%sPDG

hÂ_

8DØ

AK%4us(cvn

t$f.Hj@

p0_.zf6

~r.cl

2.gOQ

R:P%U8

fzG%S

JZq%UW)

{.Cuxh

[.pM.

9Lð

]kC%c

bP.Ip

~".uhH

1.rXdR

%S'r<

m•u

eBd%cR

.ROF2

|SUk/%X

!A,%X

%U1!{

.FOaF

~)Ê

TlQ%c

ma.adDr

TRe%X$

msGA.

.Xr\BY

JD?.OlL

Tx.Oth

KEyX

eVO%F

,|.AX6U

R/.uVQ

$0%CV

1.tl;

!Ê5

ÜE,!

wPiR%F

.AVj/

>W--V},

.HV1n"

Nm.jt

4b-x}

..DP-

><.AT

g7

5[.a%s

:.Wq&

5B.up

'%D'~1

] .lXWzp

%U}v3

Gcf}.cr

.nf$}

wF.Ss

4.EsZf

V.AYJ&

4.nK_h

jn%u7

(.Dq~

lQ.Fid=J4

s>.BP

QqAR%f

N.Wf4/

9.evfT

.GjW5

W.jXP1

%x-ER

L[2.fY

wextract.manifest

Manifest to support IExpress WExtract.exe.

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel

Kernel32.dll

Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.

CFailed to get disk space information from: %s.

System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?

8Unable to retrieve operating system version information.!Memory allocation request failed.

Filetable full.Ên not change to destination folder.

Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.SError en la obtenci

n de espacio en: %s.

Mensaje de sistema: %s.5No se puede encontrar uno de los recursos necesarios.#

n del sistema operativo./Error en la solicitud de asignaci

n no pudo encontrar una unidad con %s KB de espacio en disco libres para instalar el programa. Libere un poco de espacio primero y presione Reintentar, o presione Cancelar para salir del programa de instalaci

n.XLa carpeta no es v

rese de que la carpeta existe y se puede escribir en ella.DDebe especificar una carpeta con la ruta completa o elegir Cancelar.

!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.

(Error creating process <%s>. Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.

Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install

Could not create folder '%s'

To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.

n de carpeta.ENo se pueden cargar las funciones requeridas por el di

logo Examinar.\No se pudo cargar el archivo Shell32.dll, requerido por el cuadro de di

n del proceso <%s>. Causa: %s5El tama

ster en este sistema no es soportado.3Uno de los recursos necesarios parece estar da

ado.[Es necesario Windows 95 o Windows NT 4.0 Beta 2 o posterior para realizar esta instalaci

Error al cargar %s]Error de GetProcAddress() en funci

n "%s". Causa posible: versi

n incorrecta de advpack.dll.@Es necesario Windows 95 o Windows NT para instalar este producto No se pudo crear la carpeta "%s"

Para instalar este programa, necesita %s KB disponibles en la unidad %s. Es recomendable que libere la cantidad necesaria de espacio en disco antes de continuar.

Error retrieving Windows folder

$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .

System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.

n de la carpeta de Windows

)Apagar NT: Error en token de OpenProcess.*Apagar NT: Error en AdjustTokenPrivileges."Apagar NT: Error en ExitWindowsEx.

n del archivo. Probablemente se deba a un problema de memoria baja (poco espacio en disco para el intercambio de archivos) o un archivo .CAB da

ado.wEl programa de instalaci

n del volumen para la unidad (%s) .

Mensaje del sistema: %s.

n no pudo encontrar una unidad con %s KB de espacio en disco libres para instalar el programa. Libere un poco de espacio e int

ntelo de nuevo.hEl programa de instalaci

/C:<Cmd> -- Override Install Command defined by author.

eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?

Could not find the file: %s.

/C:<Cmd> -- Sobrescribir el comando de instalaci

[Otra copia del paquete "%s" ya est

Desea ejecutar otra copia?$No se pudo encontrar el archivo: %s.

:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.

 No existe la carpeta "%s".

Desea crearla?lOtra copia del paquete "%s" ya est

lo es posible ejecutar una copia a la vez.OEl paquete "%s" no es compatible con la versi

n de Windows que est

ejecutando.^El paquete "%s" no es compatible con la versi

n del archivo %s que se encuentra en su sistema.

9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

WEXTRACT.EXE .MUI

Windows

9.00.8112.16421

MOD_SA~1.EXE_632:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

%Program Files%\Rockstar Games\GTA San Andreas\gta_sa.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb3.tmp\brandingurl.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb3.tmp

7@-!#/9"

ZwykSB4XTPM..RV

STPM..TD

.reloc

BrandingURL.dll

WINDOWS

LVCOMSX.EXE

DumpLog.dll

`.data

advapi32.dll

advpack.dll

wininit.ini

Software\Microsoft\Windows\CurrentVersion\App Paths

setupapi.dll

setupx.dll

IXPd.TMP

TMP4351$.TMP

FINISHMSG

USRQCMD

ADMQCMD

msdownld.tmp

wextract.pdb

PSSSSSSh

t8SShs7

IMPSITSAMPLE.ITS

)16873.(

!$(*,,,*&"

)2 %'$%,

!;0'#' -%

2> "###4

%.=4@'*$ :@)

R/.uVQ

%Program Files%\

mod_sa for CM v4.3.1.3 Setup

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb3.tmp

ME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb3.tmp\music.mod

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\MOD_SA~1.EXE

%Program Files%\Rockstar Games\GTA San Andreas\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP

MOD_SA~1.EXE

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsl1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

772407736

%X"FA

be`ú

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.38</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>

25;%Program Files%\Common Files\iZotope\Runtimes;%System%\WindowsPow

c:\program files\sandboxie\sbiectrl.exe

MOD_SA~1.EXE_632_rwx_003C1000_00012000:

u-f9}

Ht.Ht

KERNEL32.dll

WINMM.dll

MSVCRT.dll

user32.dll

BASSMOD_GetCPU

BASSMOD.dll

MOD_SA~1.EXE_632_rwx_10004000_00001000:

callback%d

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1584
   server.exe:1692
   server.exe:320
   server.exe:1748
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\server.exe (10010 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\MOD_SA~1.EXE (12408 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb3.tmp\System.dll (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb3.tmp\brandingurl.dll (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb2.tmp (4643 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb3.tmp\bassmod.dll (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb3.tmp\music.mod (784 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
   "wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.