MD5: dba9f15e2d75d7b9a46cdb6f52afa437
SHA1: 1c1787dca8af101900bf1e85c83e4973db44efd0
SHA256: 7cfa25c7a2c5c61dc88c48148f0b832ab9d8b84e4f07e3677e65b3f1fc4e9805
SSDeep: 12288:Jlz040llNo5fB2GC8cKZTLZkS9T9wBZ0vJSs/SMZoS596qbm0FJ:Jlz040DGCFK1Lp9CBAJSzMr6IB
Size: 1056768 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2014-12-05 07:41:00
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:928

Mutexes

The following mutexes were created/opened:

RasPbFile
ShimCacheMutex

File activity

No files have been created.

Registry activity

The process %original file name%.exe:928 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 A6 50 93 27 39 66 DA 60 2D 1B 0C E7 F5 9D FD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: ????? ?? BY:?
Product Name: ????? ?? BY:?
Product Version: 1.0.0.0
Legal Copyright: ????? ?? BY:?
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ????? ?? BY:?
Comments: ????? ?? BY:?
Language: Chinese (Simplified, PRC)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

t$(SSh

~%UVW

u$SShe

wininet.dll

kernel32.dll

rasapi32.dll

ADVAPI32.DLL

advapi32.dll

ole32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

{E60056EA-07A8-4bf5-B6F0-DF05DE6FAE1F}

action=loginIn&uid=

hXXp://api.f02.cn:8888/http.do

login_error

https

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

http=

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

hXXp://sms.xudan123.com/do.aspx

&password=

action=user:UserEventAction&event_name_login=

hXXp://VVV.jikesms.com/common/ajax.htm

(*.txt)

C$%cmb

.ppM|

 aZ.mO

%-^

.hk;~

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

]%s<xi

%du2$"

.unOZ

\Microsoft\Network\Connections\pbk\rasphone.pbk

hXXp://VVV.taihuoniao.com/auth/signup

hXXp://VVV.taihuoniao.com/app/site/auth/verify_code?phone=

&password_confirm=

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Referer: hXXp://VVV.taihuoniao.com/auth/signup

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

Host: VVV.taihuoniao.com

hXXp://VVV.taihuoniao.com/auth/do_register

hXXp://VVV.taihuoniao.com/promo/got_bonus

DisconnURL

ConnURL

/userRpm/StatusRpm.htm?Disconnect=

/userRpm/StatusRpm.htm?Connect=

hXXp://pv.sohu.com/cityjson?ie=gb2312

WinHttp.WinHttpRequest.5.1

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

hXXp://VVV.httpsdaili.com/api.asp?key=20141113132850747&getnum=99999

[email protected]

282507606

IP.TXT

192.168.1.1

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

user32.dll

RASAPI32.dll

GetProcessHeap

WinExec

KERNEL32.dll

GetKeyState

GetViewportOrgEx

WINMM.dll

WINSPOOL.DRV

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

OLEAUT32.dll

WS2_32.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

GetCPInfo

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

RegCreateKeyExA

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

1.1.3

;3 #>6.&

'2, / 0&7!4-)1#

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÁ

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

w0Sqaq%0s

qpqa1%5s

',::?;@;@;@;@@[

.bBhpssssssw|

1, 0, 6, 6

(*.*)

1.0.0.0

%original file name%.exe_928_rwx_10027000_00015000:

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ð<

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$<#$#=

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

%-^

.hk;~

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.