MD5: 4d16c46a8633eacb8a7eb43e1abc8ed3
SHA1: 14e980eef7ebd62f31889cfa335b14e93f59e297
SHA256: 40bb28de749d30c3188d227e6b3f171ce40831e87930b8f6fb1415f6dbab4021
SSDeep: 24576:a/DBjBbgRhn04iOMzl3TEjr/bMNlB V hawK8jSJwriXIbsF5x/PouH5yMAUJDei:a/FBbFRjabMVbxKESJ iYWpgUcmJQDm
Size: 1789952 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-06-06 10:57:06
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

cacls.exe:504
cacls.exe:1552
cacls.exe:1460
cacls.exe:1636
cacls.exe:480
attrib.exe:308
attrib.exe:1676
attrib.exe:340
attrib.exe:828
qudongrensheng.dat:1552

The Trojan injects its code into the following process(es):

wscntmx.exe:496
%original file name%.exe:464

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process wscntmx.exe:496 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\b.bat (255 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cj[1].txt (5527 bytes)
%System%\drivers\etc\hosts.ics (18190 bytes)
%System%\drivers\etc\hosts (17655 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
C:\a.bat (356 bytes)

The process %original file name%.exe:464 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jbc[1].gif (22591 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\swz[1].gif (3978 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gg[1].png (8891 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gua[2].gif (20562 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (1004 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\js[2].gif (30383 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\941pojie[1].htm (1595 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\2014052276129177[2].gif (832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bgnav[1].gif (853 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (247 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\zs[1].jpg (49159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\6330cf46f68cd2c7c40a422626d1cb30[1] (2857 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (511 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[3].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6330cf46f68cd2c7c40a422626d1cb30[1].png (362 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\046bt[1].gif (2605 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (14652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1gg[1].png (28985 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgh[3].gif (1871 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lszwg[1].htm (1777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgheader[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1gg[2].png (28003 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\gg[1].png (5593 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1gg[1].png (29443 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\top[1].png (9019 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (745 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (4402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\js[1].gif (22469 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgnav[1].gif (117 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bgheader[1].gif (742 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bgtitle[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jbc[1].gif (28161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\6330cf46f68cd2c7c40a422626d1cb30[1].png (2782 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\icon[1].png (409 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\icon[1].png (409 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\gif008[1].gif (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gif008[1].gif (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\swz[1].gif (9999 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jbc[1].gif (32881 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\046bt[1].gif (1587 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\style[1].css (1911 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lszwg[1].htm (1599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic2[1].gif (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gua[1].gif (25772 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7f114.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\zsf[3].gif (37248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\icon[1].png (409 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\zs[1].jpg (37417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\top[1].png (9091 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[1].gif (2329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\zs[1].jpg (35465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jiaqun[1].htm (256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\logo[1].gif (1765 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\zsf[2].gif (32993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gua[1].gif (22637 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\swz[1].gif (9253 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (1911 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgnav[2].gif (117 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\zsf[1].gif (38279 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lhr[1].gif (38889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (1506 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\top[1].png (10189 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic2[1].gif (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6330cf46f68cd2c7c40a422626d1cb30[1] (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bg[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\js[1].gif (34828 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\2014052276129177[1].gif (832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lhr[2].gif (42863 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].php (1475 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bgheader[1].gif (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (330 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gif008[1].gif (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgh[2].gif (2615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[3].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logo[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lhr[1].gif (32715 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bgtitle[2].gif (853 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lszwg[1] (1441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bg[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\046bt[1].gif (2688 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2014052276129177[1].gif (832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bg[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[2].php (4300 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\group[1].png (442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgh[1].gif (2665 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gg[1].png (10352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\group[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bgtitle[1].gif (916 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[2].gif (43 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\gif008[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\6330cf46f68cd2c7c40a422626d1cb30[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jbc[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\zs[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\logo[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\zsf[2].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gua[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgh[2].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[2].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\swz[1].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gg[1].png (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\js[2].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgnav[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\2014052276129177[2].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lszwg[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lhr[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\6330cf46f68cd2c7c40a422626d1cb30[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pic1[1].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\top[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bg[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\6330cf46f68cd2c7c40a422626d1cb30[1] (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\046bt[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\group[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\icon[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lszwg[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1gg[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\group[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bgtitle[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pic2[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7f114.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bgheader[1].gif (0 bytes)

The process qudongrensheng.dat:1552 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hao123_res.tmp (35 bytes)

Registry activity

The process cacls.exe:504 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 35 8F 77 E9 28 CC 57 64 E9 3C 07 CB 74 86 66"

The process cacls.exe:1552 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 43 B5 F9 BC 42 A7 E0 B2 AA 63 DE D8 63 E8 C2"

The process cacls.exe:1460 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 19 A1 39 3C 61 68 83 F9 E2 90 70 D3 60 19 72"

The process cacls.exe:1636 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C B8 46 53 AB 01 F3 D1 C5 0C 1D 4E FE 63 9A 36"

The process cacls.exe:480 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A 9E A6 D4 97 FC 97 60 3E 3A 0D 77 D2 19 E8 C8"

The process attrib.exe:308 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A 2C A9 DF E7 BC DC 9B 76 79 55 A3 F7 50 12 E1"

The process attrib.exe:1676 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 6F B8 45 2C 72 5C 57 E9 96 D8 A3 FD 78 16 36"

The process attrib.exe:340 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 C8 77 B7 27 3B A7 62 88 8F 59 0F 45 A9 4C 67"

The process attrib.exe:828 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 88 A4 9C 06 D1 2A 1A AB 3E CC 5D 67 94 63 64"

The process wscntmx.exe:496 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "83 CF D0 25 8B 15 56 65 23 1D 4E 30 33 4E 4B E3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wscntmx" = "D:\\wscntmx.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:464 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC BE 09 5E 69 3B 7B 32 E7 66 55 4C D7 D2 A9 FD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process qudongrensheng.dat:1552 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "24 51 D5 EC 37 C5 D8 77 A4 E7 61 09 72 EA B2 95"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\WinHelp32\Parameters]
"ServiceDll" = "%System%\ackwpw.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"krnlsrvc" = "WinHelp32"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\WinHelp32\Parameters]
"seRVicemAIN" = "RunDllEntry"

[HKLM\System\CurrentControlSet\Services\WinHelp32]
"Description" = "Windows Help System for X32 windows desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 65537 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://jc.941pojie.com/tc.txt	183.60.111.247
hxxp://jc.941pojie.com/	183.60.111.247
hxxp://jc.941pojie.com/cj.txt	183.60.111.247
hxxp://gogozz1pj.huihaowy.com/	183.56.169.162
hxxp://jc.941pojie.com/jiaqun.htm	183.60.111.247
hxxp://jc.941pojie.com/css/style.css	183.60.111.247
hxxp://jc.941pojie.com/img/gif008.gif	183.60.111.247
hxxp://jc.941pojie.com/img/zsf.gif	183.60.111.247
hxxp://ssd.tcdn.qq.com/wpa/images/group.png
hxxp://jc.941pojie.com/img/lhr.gif	183.60.111.247
hxxp://c.split.cnzz.com/stat.php?id=5076676&show=pic2
hxxp://c.split.cnzz.com/core.php?web_id=5076676&show=pic2&t=z
hxxp://z3.cnzz.com/stat.htm?id=5076676&r=&lg=en-us&ntime=none&cnzz_eid=37904339-1410443283-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1891023438
hxxp://z3.cnzz.com/stat.htm?id=5076676&r=&lg=en-us&ntime=none&cnzz_eid=155029651-1410443284-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=112051369
hxxp://c.split.cnzz.com/stat.php?id=1253112259&web_id=1253112259
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=333037092
hxxp://icon.cnzz.com/img/pic2.gif	42.156.162.7
hxxp://c.split.cnzz.com/stat.php?id=3325108&show=pic1
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1036514576
hxxp://c.split.cnzz.com/core.php?web_id=1253112259&t=z
hxxp://c.split.cnzz.com/core.php?web_id=3325108&show=pic1&t=z
hxxp://z7.cnzz.com/stat.htm?id=1253112259&r=&lg=en-us&ntime=none&cnzz_eid=804168892-1410443284-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined&h=1&rnd=999258932	42.156.140.20
hxxp://jc.941pojie.com/img/jbc.gif	183.60.111.247
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=895496844
hxxp://icon.cnzz.com/img/pic1.gif	42.156.162.7
hxxp://pcookie.split.cnzz.com/app.gif?&cna=FZaYDMFxExICAcGK9Ofx zPB
hxxp://pcookie.split.cnzz.com/app.gif?&cna=FZaYDIcbkhwCAcGK9OeiMQ4z
hxxp://z6.cnzz.com/stat.htm?id=3325108&r=&lg=en-us&ntime=none&cnzz_eid=839872230-1410443285-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=763793005
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=2071775127
hxxp://z6.cnzz.com/stat.htm?id=3325108&r=&lg=en-us&ntime=none&cnzz_eid=665276032-1410443285-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=129590043
hxxp://jc.941pojie.com/img/js.gif	183.60.111.247
hxxp://img.webscan.360.cn/status/pai/hash/6330cf46f68cd2c7c40a422626d1cb30	220.181.158.213
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1532175039
hxxp://jc.941pojie.com/img/swz.gif	183.60.111.247
hxxp://jc.941pojie.com/img/gua.gif	183.60.111.247
hxxp://hm.e.shifen.com/h.js?c8a6515c967e27925a2fd6685fe9963c
hxxp://jc.941pojie.com/img/2014052276129177.gif	183.60.111.247
hxxp://hm.e.shifen.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=1926352316&si=c8a6515c967e27925a2fd6685fe9963c&st=1&v=1.0.63&lv=1&tt=开心快乐每一天！
hxxp://jc.941pojie.com/img/046bt.gif	183.60.111.247
hxxp://jc.941pojie.com/img/icon.png	183.60.111.247
hxxp://static.n.shifen.com/hmt/icon/21.gif
hxxp://jc.941pojie.com/img/zs.jpg	183.60.111.247
hxxp://c.split.cnzz.com/stat.php?id=1253024109&web_id=1253024109
hxxp://c.split.cnzz.com/core.php?web_id=1253024109&t=z
hxxp://jc.941pojie.com/img/bg.gif	183.60.111.247
hxxp://z8.cnzz.com/stat.htm?id=1253024109&r=http://cctv-6.padonline.net:5566/&lg=en-us&ntime=none&cnzz_eid=none&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1415649696	42.156.140.21
hxxp://jc.941pojie.com/img/bgheader.gif	183.60.111.247
hxxp://jc.941pojie.com/img/bgnav.gif	183.60.111.247
hxxp://jc.941pojie.com/img/bgh.gif	183.60.111.247
hxxp://jc.941pojie.com/img/gg.png	183.60.111.247
hxxp://jc.941pojie.com/img/1gg.png	183.60.111.247
hxxp://jc.941pojie.com/img/下载.jpg	183.60.111.247
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1153140611
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1784473045
hxxp://z3.cnzz.com/stat.htm?id=5076676&r=http://www.941pojie.com/&lg=en-us&ntime=1410443284&cnzz_eid=155029651-1410443284-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1501372725
hxxp://jc.941pojie.com/img/top.png	183.60.111.247
hxxp://z6.cnzz.com/stat.htm?id=3325108&r=http://www.941pojie.com/&lg=en-us&ntime=1410443285&cnzz_eid=665276032-1410443285-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=752433526
hxxp://jc.941pojie.com/img/logo.gif	183.60.111.247
hxxp://jc.941pojie.com/img/bgtitle.gif	183.60.111.247
hxxp://hm.baidu.com/h.js?c8a6515c967e27925a2fd6685fe9963c	61.135.185.140
hxxp://www.lszwg.com/img/js.gif	183.60.111.247
hxxp://www.941pojie.com/img/bgnav.gif	183.60.111.247
hxxp://www.lszwg.com/img/icon.png	183.60.111.247
hxxp://www.lszwg.com/img/下载.jpg	183.60.111.247
hxxp://eiv.baidu.com/hmt/icon/21.gif	115.239.211.92
hxxp://www.941pojie.com/img/gif008.gif	183.60.111.247
hxxp://www.941pojie.com/img/zsf.gif	183.60.111.247
hxxp://s19.cnzz.com/stat.php?id=1253024109&web_id=1253024109	1.99.192.16
hxxp://www.lszwg.com/img/jbc.gif	183.60.111.247
hxxp://www.941pojie.com/img/logo.gif	183.60.111.247
hxxp://s85.cnzz.com/stat.php?id=3325108&show=pic1	1.99.192.16
hxxp://c.cnzz.com/core.php?web_id=3325108&show=pic1&t=z	42.156.140.11
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1784473045	42.120.219.171
hxxp://pcookie.cnzz.com/app.gif?&cna=FZaYDMFxExICAcGK9Ofx zPB	42.120.219.171
hxxp://www.941pojie.com/img/bgtitle.gif	183.60.111.247
hxxp://www.941pojie.com/	183.60.111.247
hxxp://www.941pojie.com/img/gg.png	183.60.111.247
hxxp://www.lszwg.com/img/top.png	183.60.111.247
hxxp://www.941pojie.com/img/jbc.gif	183.60.111.247
hxxp://c.cnzz.com/core.php?web_id=1253024109&t=z	42.156.140.11
hxxp://zs25.cnzz.com/stat.htm?id=5076676&r=&lg=en-us&ntime=none&cnzz_eid=155029651-1410443284-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=112051369	42.156.140.16
hxxp://www.lszwg.com/img/lhr.gif	183.60.111.247
hxxp://www.941pojie.com/img/swz.gif	183.60.111.247
hxxp://c.cnzz.com/core.php?web_id=1253112259&t=z	42.156.140.11
hxxp://c.cnzz.com/core.php?web_id=5076676&show=pic2&t=z	42.156.140.11
hxxp://www.lszwg.com/img/swz.gif	183.60.111.247
hxxp://www.941pojie.com/img/lhr.gif	183.60.111.247
hxxp://www.lszwg.com/img/bgtitle.gif	183.60.111.247
hxxp://www.lszwg.com/img/bgnav.gif	183.60.111.247
hxxp://www.lszwg.com/img/1gg.png	183.60.111.247
hxxp://www.lszwg.com/img/bg.gif	183.60.111.247
hxxp://www.lszwg.com/img/gif008.gif	183.60.111.247
hxxp://www.941pojie.com/img/js.gif	183.60.111.247
hxxp://www.lszwg.com/img/046bt.gif	183.60.111.247
hxxp://www.lszwg.com/img/bgh.gif	183.60.111.247
hxxp://zs25.cnzz.com/stat.htm?id=5076676&r=http://www.941pojie.com/&lg=en-us&ntime=1410443284&cnzz_eid=155029651-1410443284-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1501372725	42.156.140.16
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=895496844	42.120.219.171
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1153140611	42.120.219.171
hxxp://www.941pojie.com/img/gua.gif	183.60.111.247
hxxp://www.941pojie.com/img/046bt.gif	183.60.111.247
hxxp://hzs2.cnzz.com/stat.htm?id=3325108&r=http://www.941pojie.com/&lg=en-us&ntime=1410443285&cnzz_eid=665276032-1410443285-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=752433526	42.156.140.19
hxxp://www.lszwg.com/img/bgheader.gif	183.60.111.247
hxxp://hm.baidu.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=1926352316&si=c8a6515c967e27925a2fd6685fe9963c&st=1&v=1.0.63&lv=1&tt=开心快乐每一天！	61.135.185.140
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=333037092	42.120.219.171
hxxp://www.941pojie.com/img/bg.gif	183.60.111.247
hxxp://www.941pojie.com/img/top.png	183.60.111.247
hxxp://www.lszwg.com/	183.60.111.247
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1036514576	42.120.219.171
hxxp://www.941pojie.com/img/bgheader.gif	183.60.111.247
hxxp://www.941pojie.com/css/style.css	183.60.111.247
hxxp://www.lszwg.com/css/style.css	183.60.111.247
hxxp://www.941pojie.com/img/2014052276129177.gif	183.60.111.247
hxxp://s25.cnzz.com/stat.php?id=5076676&show=pic2	1.99.192.16
hxxp://hzs2.cnzz.com/stat.htm?id=3325108&r=&lg=en-us&ntime=none&cnzz_eid=665276032-1410443285-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=129590043	42.156.140.19
hxxp://www.941pojie.com/img/1gg.png	183.60.111.247
hxxp://www.941pojie.com/img/bgh.gif	183.60.111.247
hxxp://pub.idqqimg.com/wpa/images/group.png	103.7.30.59
hxxp://s13.cnzz.com/stat.php?id=1253112259&web_id=1253112259	1.99.192.16
hxxp://www.lszwg.com/img/logo.gif	183.60.111.247
hxxp://www.lszwg.com/img/gg.png	183.60.111.247
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=2071775127	42.120.219.171
hxxp://www.941pojie.com/img/zs.jpg	183.60.111.247
hxxp://www.lszwg.com/img/zs.jpg	183.60.111.247
hxxp://www.lszwg.com/img/zsf.gif	183.60.111.247
hxxp://hzs2.cnzz.com/stat.htm?id=3325108&r=&lg=en-us&ntime=none&cnzz_eid=839872230-1410443285-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=763793005	42.156.140.19
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1532175039	42.120.219.171
hxxp://www.941pojie.com/img/icon.png	183.60.111.247
hxxp://www.lszwg.com/img/gua.gif	183.60.111.247
hxxp://pcookie.cnzz.com/app.gif?&cna=FZaYDIcbkhwCAcGK9OeiMQ4z	42.120.219.171
hxxp://www.941pojie.com/img/下载.jpg	183.60.111.247
hxxp://www.lszwg.com/img/2014052276129177.gif	183.60.111.247
hxxp://zs25.cnzz.com/stat.htm?id=5076676&r=&lg=en-us&ntime=none&cnzz_eid=37904339-1410443283-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1891023438	42.156.140.16
qqqggg777444.jyjaj.com	183.56.169.162
941pojie.meibu.net	112.228.25.244
cctv-6.padonline.net	183.56.169.162
a510sf.010aimei.com	61.174.41.254

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request on Unusual Port Possibly Hostile

Traffic

GET /stat.htm?id=5076676&r=&lg=en-us&ntime=none&cnzz_eid=155029651-1410443284-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=112051369 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: zs25.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.1

Date: Thu, 11 Sep 2014 13:48:04 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Tue, 28 May 2013 02:57:17 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /app.gif?&cna=FZaYDIcbkhwCAcGK9OeiMQ4z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.lszwg.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate