MD5: 33d3c84e95bc47988f2499766bcf9162
SHA1: d18fa27254d2dd5c9489646521af603d0bb586a7
SHA256: 1047f7755fc8f404b8c335128bbb1141a87e4e9c2b31ac49265d49f07507f1df
SSDeep: 24576:EjFCSOffy0UxcnNkgtpbctqf6IqJrEUMOmjPUj4:EjFCJUxiftpoZRJrEUnmjP
Size: 1482752 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC50, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, Armadillov171, UPolyXv05_v6
Company: no certificate found
Created at: 2015-04-28 17:57:59
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:484

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:484 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\50[1].jpg (73 bytes)
%Documents and Settings%\%current user%\Application Data\Áè¸ç¸¨Öú\9ifz.exe (1632 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qzone.qq[1].htm (8977 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cgi_get_portrait[1].htm (129 bytes)
%Documents and Settings%\%current user%\Application Data\Áè¸ç¸¨Öú\dlcore.dll (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1027663760[1].htm (22283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\getonline[1].htm (12 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\getonline[1].htm (0 bytes)

Registry activity

The process %original file name%.exe:484 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 59 6B 9D 7F 6A 10 BB 79 07 8C 94 5C F0 C8 84"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://q.qlogo.cn/headimg_dl?bs=qq&dst_uin=1027663760&src_uin=1027663760&fid=1027663760&spec=40&url_enc=0&referer=bu_interface&term_type=PC
hxxp://qqshow-user.tencent.com/1027663760/10/	58.251.139.139
hxxp://a1165.b.akamai.net/
hxxp://webproxy-sz.qplus.com/getonline?Type=1&1027663760:
hxxp://users.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?get_nick=1&uins=1027663760	194.146.191.112
hxxp://q3.qlogo.cn/headimg_dl?bs=qq&dst_uin=1027663760&src_uin=1027663760&fid=1027663760&spec=40&url_enc=0&referer=bu_interface&term_type=PC	1.113.192.15
hxxp://g.cnc.qzone.qq.com/cgi-bin/friendshow/cgi_get_visitor_simple?uin=1027663760	1.103.192.18
hxxp://user.qzone.qq.com/1027663760?ptlang=2052	194.146.191.104
hxxp://webpresence.qq.com/getonline?Type=1&1027663760:	103.7.30.103
hxxp://qzone.qq.com/	1.105.192.18
hxxp://qlogo3.store.qq.com/qzone/1027663760/1027663760/50	37.29.0.112

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0

Traffic

GET / HTTP/1.1

Accept: */*

Referer: hXXp://g.cnc.qzone.qq.com/cgi-bin/friendshow/cgi_get_visitor_simple?uin=1027663760

Accept-Language: zh-cn

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Cache-Control: no-cache

Host: qzone.qq.com

HTTP/1.1 200 OK

Server: org-imgcache

Last-Modified: Wed, 20 May 2015 02:49:50 GMT

Content-Type: text/html

Location: hXXp://qzone.qq.com/index.html

ETag: "555bf64e-8c34"

Cache-Control: max-age=600

Date: Mon, 08 Jun 2015 06:19:50 GMT

Transfer-Encoding:  chunked

Connection: keep-alive

Connection: Transfer-Encoding
00008C34..<!doctype html>..<html>...<head>....<me
ta charset="UTF-8" />....<meta http-equiv="content-type" content
="text/html; charset=UTF-8" />....<meta http-equiv="X-UA-Compati
ble" content="IE=edge">....<title>QQ......-..................
.........</title>....<meta name="keywords" content="QQ...... 
Qzone ............ ......QQ......  QQ......  QQ......" />....<me
ta name="description" content="QQ......(Qzone)........................
............QQ........................................................
......................................................................
..................................................................QQ..
......................................................................
......................................................................
..........." />....<link rel="apple-touch-icon" href="hXXp://qzo
nestyle.gtimg.cn/qzone/v8/index/touch-icon-ipad-retina.png">....<
;link rel="apple-touch-icon" sizes="76x76" href="hXXp://qzonestyle.gti
mg.cn/qzone/v8/index/touch-icon-ipad.png">....<link rel="apple-t
ouch-icon" sizes="120x120" href="hXXp://qzonestyle.gtimg.cn/qzone/v8/i
ndex/touch-icon-iphone-retina.png">....<link rel="apple-touch-ic
on" sizes="152x152" href="hXXp://qzonestyle.gtimg.cn/qzone/v8/index/to
uch-icon-ipad-retina.png">....<link rel="icon" sizes="any" mask 
href="hXXp://qzonestyle.gtimg.cn/qzone/v8/img/Qzone.svg">....<me
ta name="theme-color" content="#FFC028">....<script type="te
<<< skipped >>>

GET /cgi-bin/friendshow/cgi_get_visitor_simple?uin=1027663760 HTTP/1.1

Accept: */*

Referer: hXXp://g.cnc.qzone.qq.com/cgi-bin/friendshow/cgi_get_visitor_simple?uin=1027663760

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: g.cnc.qzone.qq.com

Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily

Server: QZHTTP-2.38.18

Content-Encoding: gzip

Content-Type: text/html

Location: hXXp://qzone.qq.com

Date: Mon, 08 Jun 2015 06:19:49 GMT

Transfer-Encoding:  chunked

Connection: keep-alive

Connection: Transfer-Encoding

Set-Cookie: qzone_check=; EXPIRES=Fri, 02-Jan-1970 00:00:00 GMT; PATH=/; DOMAIN=qq.com

Set-Cookie: _qz_referrer=; expires=Mon, 26 Jul 1997 05:00:00 GMT; PATH=/; DOMAIN=qq.com
0000000A..............00000000..

GET /1027663760?ptlang=2052 HTTP/1.1

Accept: */*

Referer: hXXp://user.qzone.qq.com/1027663760?ptlang=2052

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: user.qzone.qq.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: QZHTTP-2.38.18

X-Frame-Options: SAMEORIGIN

X-UA-Compatible: IE=Edge

Last-Modified: Mon, 08 Jun 2015 06:19:54 GMT

Cache-Control: max-age=0, no-transform, proxy-revalidate

Content-Type: text/html; charset=utf-8

Date: Mon, 08 Jun 2015 06:19:55 GMT

Transfer-Encoding:  chunked

Connection: keep-alive

Connection: Transfer-Encoding

Set-Cookie: qzone_check=; EXPIRES=Fri, 02-Jan-1970 00:00:00 GMT; PATH=/; DOMAIN=qq.com

Set-Cookie: _qz_referrer=; expires=Mon, 26 Jul 1997 05:00:00 GMT; PATH=/; DOMAIN=qq.com

Set-Cookie: rv2=80104B63807AC267E197218EB32EB7B5D911532979C6DC8651; PATH=/; DOMAIN=qq.com;

Set-Cookie: property20=2DB2D252FA309516759C00D97B075A48BF8C561223F148053B62D7207C68FC12F74C72BD993768CE; PATH=/; DOMAIN=qq.com;
0000B853................................................<!DOCTYPE H
TML>..<html lang="zh-cn" class="skin-dark pg-profile">..<h
ead>..<noscript><meta http-equiv="refresh" content="0; url
=hXXp://os.qzs.qq.com/qzone/v6/troubleshooter/noscript.html" /><
/noscript>..<meta charset="UTF-8" />..<meta http-equiv="co
ntent-type" content="text/html; charset=UTF-8" />..<title>...
............ VVV.9ifz.org [hXXp://ling9ifz.qzone.qq.com]</title>
..<meta name="keywords" content="QQ......,......,............,.....
.......,QQ......,QQ......" />.....<meta name="description" conte
nt="" />..<link rel="apple-touch-icon" href="hXXp://qzonestyle.g
timg.cn/qzone/v8/index/touch-icon-ipad-retina.png">..<link rel="
apple-touch-icon" sizes="76x76" href="hXXp://qzonestyle.gtimg.cn/qzone
/v8/index/touch-icon-ipad.png">..<link rel="apple-touch-icon" si
zes="120x120" href="hXXp://qzonestyle.gtimg.cn/qzone/v8/index/touch-ic
on-iphone-retina.png">..<link rel="apple-touch-icon" sizes="152x
152" href="hXXp://qzonestyle.gtimg.cn/qzone/v8/index/touch-icon-ipad-r
etina.png">..<link rel="icon" sizes="any" mask href="hXXp://qzon
estyle.gtimg.cn/qzone/v8/img/Qzone.svg">..<meta name="theme-colo
r" content="#FFC028">.........<script type="text/javascript">
.....    .var g_domain = "qq.com";..    ..    document.domain=g_domain
;..    var _s_=new Date(),g_T={},siDomain="os.qzonestyle.gtimg.cn",img
cacheDomain="os.qzs." g_domain,g_iUin=1027663760,g_iLoginUin=0;g_T
<<< skipped >>>

GET /headimg_dl?bs=qq&dst_uin=1027663760&src_uin=1027663760&fid=1027663760&spec=40&url_enc=0&referer=bu_interface&term_type=PC HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: q3.qlogo.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: ImgHttp3.0.0

Connection: keep-alive

Content-Type: image/jpeg

Content-Length: 876

Last-Modified: Wed, 03 Jun 2015 14:25:27 GMT

Cache-Control: max-age=2592000

X-Delay: 25147 us

X-Info: real data

X-Cpt: filename=0

User-ReturnCode:0

Size: 876

chid: 0

fid: 0

X-Region: sz

X-RtFlag: 1
......JFIF.....`.`......Exif.....C....................................
.%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((
((((((((((((((((((((((((((((......(.(.."..............................
.......... ...........................!1.Aa..".#Qq....................
....................................!A............?..;.\q..KqIB.6T...r
}N...b...%......4......{....s.".. .....x.-Q..V....P.H;..o....\b.6|.srk
,&....`...J.....c.dy......a........i!.....Q.3..q.qt...#.WC.....1.....*
....m.Q(qgA*Rv...r.cN.IM.G...ZYS..Kz.Ro......g1..Em.... %..mi.B.R.....
....w.wL...Y../.[G.b.y.g.O .........>.'9..Q..#...?...V#./*{.Xi._0..
...........n..W..F..{.m..lm....G.0.$(->O"..}...\..%byD..H.I.DF..-..
.2<(.c`.%.\@.m.O$....u.d.XI.l...=.N.B....%;H).vI.Z.2,]>........t
6..........*:.......u.X9....]......q. ......d......o}..a...aE......(.H
.A#.{[email protected]_.k^.hy|.HQ....F.\[email protected]/1.1 200 OK..Serve
r: ImgHttp3.0.0..Connection: keep-alive..Content-Type: image/jpeg..Con
tent-Length: 876..Last-Modified: Wed, 03 Jun 2015 14:25:27 GMT..Cache-
Control: max-age=2592000..X-Delay: 25147 us..X-Info: real data..X-Cpt:
 filename=0..User-ReturnCode:0..Size: 876..chid: 0..fid: 0..X-Region: 
sz..X-RtFlag: 1........JFIF.....`.`......Exif.....C...................
..................%...#... , #&')*)..-0-(0%()(...C...........(...(((((
(((((((((((((((((((((((((((((((((((((((((((((......(.(..".............
........................... ...........................!1.Aa..".#Qq...
.....................................................!A...........
<<< skipped >>>

GET /qzone/1027663760/1027663760/50 HTTP/1.1

Accept: */*

Referer: hXXp://qlogo3.store.qq.com/qzone/1027663760/1027663760/50

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: qlogo3.store.qq.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 06:19:41 GMT

Server: PWS/8.1.20.9

X-Px: ms h0-s1136.v0-mow ( h0-s1145.v0-mow), ms h0-s1145.v0-mow ( h0-s1530.p21-nrt), rf-ht h0-s1530.p21-nrt ( origin)

Cache-Control: max-age=600

Expires: Mon, 08 Jun 2015 06:29:42 GMT

Age: 0

Content-Length: 2167

Content-Type: image/jpeg

Last-Modified: Thu, 30 Apr 2015 01:43:21 GMT

Connection: keep-alive
......JFIF.....&.&.....C..............................................
......................C...............................................
........................2.2..........................................6
............................!1"AQa..q.23..#BCRs.......................
..............0........................!1..AQq...#2a...."B............
...?.. 6|[email protected]|.U{.e.F....w.j..i...1\HC......'.*'$
..I..V1.b4m......5-..:.\..i...Z...z.^.....`KE...P...Z9C..B.t)'.p{.F}..
.....!.E..&\[email protected]}...:..V.0. [email protected]...\.Q...e*..?.G..Q.I..Y..
....lM...Fq......A...f.l{>....U..E....!..N.Oo>...i.F.t(~$...cu.]
.V..5:[email protected]._.....,..1..T.....s....>...w&...$DO...m.'.<
...3w...o.....).sQ.........7..M......3\.r.6"t.d@..?.$...%...%...6#.d.6
(......b.....)...._.*7--.'.S.a......g..?mG..j.bh.....)...=.;...m.E#.#.
..T.P....Mr......B.....Y...m.. $.u....W"c%xB.....^./..|d.sC...1i..E..#
....Q...`aD.3.G.........z.Z..{......[.F.U.2..}......vg..:d..F%...a..#.
*.9.....Nj....... IS$...<I..k7..r......~.5kX......5fe.\.-.JSi["!J.R
...?......bd.....y...m8.?.}.?.8.1...wx.....}.e ...:.a.../f..>...Z..
......).~.P.#Qi.....!:`R.7V......^..7%..V.....X?...rr...V.....}......U
..[....2])[email protected].}..P.(v....j...).`.S........%.#...p....K
.4.?.F X.........v...>...U;....w....A.G...H!..00;A.......)W...Sc...
S..Z.S...... ....kE......).W..2-P/..'...C Sk....eC.qJ.'.....M;.. .....
Z..W>.w.JJ.J.H.2;i....(..Y.......!...:Zv9..R...!#........J......P..
.........T....$..P...L0....R.'...G~........h.u.V....%..... h...mje
<<< skipped >>>

GET /fcg-bin/cgi_get_portrait.fcg?get_nick=1&uins=1027663760 HTTP/1.1

Accept: */*

Referer: hXXp://users.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?get_nick=1&uins=1027663760

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: users.qzone.qq.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: QZHTTP-2.37.1

Cache-Control: max-age=86400

Content-Type: text/html

Date: Mon, 08 Jun 2015 06:19:51 GMT

Content-Length: 129

Connection: keep-alive
portraitCallBack({"1027663760":["hXXp://qlogo1.store.qq.com/qzone/1027
663760/1027663760/100",34125,-1,7,0,1,"..............",0]})HTTP/1.1 20
0 OK..Server: QZHTTP-2.37.1..Cache-Control: max-age=86400..Content-Typ
e: text/html..Date: Mon, 08 Jun 2015 06:19:51 GMT..Content-Length: 129
..Connection: keep-alive..portraitCallBack({"1027663760":["hXXp://qlog
o1.store.qq.com/qzone/1027663760/1027663760/100",34125,-1,7,0,1,".....
.........",0]})..

GET /1027663760/10/ HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: qqshow-user.tencent.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Connection: close

Server: QZHTTP-2.1

Date: Mon, 08 Jun 2015 06:19:47 GMT

Accept-Ranges: bytes

Cache-Control: max-age=7200

Content-Length: 13770

Content-Type: image/gif
GIF87a...............(.PZ.............T{B. ...G)6...............bE5[-U
.........{_[m..e-O....j.mF_.......2B.......r2...Q91..q.-9.......aG./4.
....P...kOB.........%..............kTdc7,.......w..x..................
....sIZ............ .!.r..........C.2.[mke.....q^....Jn...s1[~ks...cBP
.........W8J.............j..kp...gk.............R,%j9VT,D.......Ni~@g.
Js..................................u.J<.7.*....[.sK.....GK........
.............439......OAC.................$.[`..................VP....
.........................[b...^$K.............sx...............UJT....
..............................=J...wTH...............N"B..........0=7(
2........................n. .;G.^.}a..TT.zt....AL\.#..................
................&%...yw.....xi.|.X 1..........lR......................
...........s?f,...............H......*\......#J.H.....3j...... C..I...
.(S.\[email protected])R...a...F.xOuJ....R.YkFEB.
.Y.H....u*3?~.z..6f..f. Y.TmH.t.".:..Y?M....1j.....u4.p^LH.1...kTf.6c.
LP.#.......Y_..aGe......... .Y.......;....k;..h...k.R]..z.....v...U.R.
.cbN.x].X.Q_.....\...b~p[$....{...E]9b.".Ag.l.!.[`..V.{.m...k.F.g.....
..w......~U.( ._...g`...t.r...|l......Z..96...y.........Xqbv...`..E)em
7R........6zX..t)u[nFb6.U.^v.Y&..#..-...t...~T..e.NL......UU.....H|.WZ
.%....X...h...mvfj...].%.....~_zw.[.......h&...8.\...h._.i...1....X...
.N.....-..^....q.!x..q.....Xa.........kg......{.K..S.:...-@...~eg.z.e.
.XX....h.....k...N.^....C.].f.^.^e..tIE.k...b...eiB...).....?.O...N.y.
m..&...>Y.}q-`........6.(.s..t.1....{..r..r...92.s..%.Y.Xh....l
<<< skipped >>>

GET /getonline?Type=1&1027663760: HTTP/1.1

Accept: */*

Referer: hXXp://webpresence.qq.com/getonline?Type=1&1027663760:

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: webpresence.qq.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: tws

Date: Mon, 08 Jun 2015 06:19:17 GMT

Content-Type: text/html; charset=ISO-8859-1

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding
c..online[0]=0;..0..

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

t$(SSh

~%UVW

u$SShe

wininet.dll

kernel32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1027663760

hXXp://qlogo3.store.qq.com/qzone/

hXXp://qqshow-user.tencent.com/

hXXp://g.cnc.qzone.qq.com/cgi-bin/friendshow/cgi_get_visitor_simple?uin=

hXXp://users.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?get_nick=1&uins=

hXXp://webpresence.qq.com/getonline?Type=1&

hXXp://user.qzone.qq.com/

https

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

http=

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

&spec=40&url_enc=0&referer=bu_interface&term_type=PC

hXXp://q3.qlogo.cn/headimg_dl?bs=qq&dst_uin=

\9ifz.exe

\dlcore.dll

.reloc

CCmdTarget

%*.*f

CNotSupportedException

commctrl_DragListMsg

COMCTL32.DLL

__MSVCRT_HEAP_SELECT

user32.dll

GetProcessHeap

KERNEL32.dll

EnumWindows

MsgWaitForMultipleObjects

RegCloseKey

RegCreateKeyExA

RegOpenKeyA

ADVAPI32.dll

SHLWAPI.dll

comdlg32.dll

iphlpapi.dll

GetWindowsDirectoryA

GetCPInfo

SetWindowsHookExA

GetKeyState

UnhookWindowsHookEx

RegOpenKeyExA

SHELL32.dll

ole32.dll

MPR.dll

WINMM.dll

WS2_32.dll

VERSION.dll

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

WINSPOOL.DRV

WININET.dll

dlcore.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

&_*.lnk

iexplore.exe,Internet Explorer

sogouexplorer.exe,

Firefox.exe,

opera.exe,opera

360se.exe,360

chrome.exe,google

360chrome.exe,360

baidubrowser.exe,

QQbrowser.exe,QQ

leibao.exe,

2345Explorer.exe,

2345Chrome.exe,

firefox.exe,

maxthon.exe,

Juzi.exe,

taobrowser.exe,

yybrowser.exe,YY

yyexplorer.exe,YY

C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch

C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu

C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs

C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu

C:\Users\

%Documents and Settings%\

\AppData\Roaming\Microsoft\Windows\Start Menu\Programs

\AppData\Roaming\Microsoft\Windows\Start Menu

http\shell\open\command\

Kernel32.dll

Comdlg32.dll

shlwapi.dll

advapi32.dll

program internal error number is %d.

:"%s"

:"%s".

%s,%d

%s.lnk

1.1.3

;3 #>6.&

'2, / 0&7!4-)1#

.?AVCCmdTarget@@

.PAVCException@@

.?AVCCmdUI@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCArchiveException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.?AVCTestCmdUI@@

zcÁ

6-6}6

:$:(:,:0:4:8:<:@:

0 0$0(0,0004080

2 2$2(2,2

2!2%2)2-2125292

.ndata

@.reloc

;~TtCP

FtPj

RegDeleteKeyExW

Kernel32.DLL

PSAPI.DLL

operator

GetProcessWindowStation

127.0.0.1

0.0.0.0

,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u

upload_data.qq.com

121.14.102.16

COMM:%u,%u,%u,%I64u,%I64u,%d,%d,%d,%d,%d,%d,%d,%d,%d

,0,0,0,0,0

User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows Xp)

Host: %s:%d

(%d) d:d:d.d000 %s: %s

pdlxf.qq.com

fs-tcp-conn.qq.com

stun.qq.com

xuanfengnet.qq.com

fs-hello.qq.com

fs-conn.qq.com

fs-h2u.qq.com

fs-report.qq.com

R:\TempView\Misc\Setup3\build\Release\QQSetupEx.pdb

NETAPI32.dll

CreatePipe

GetWindowsDirectoryW

RegOpenKeyExW

RegCreateKeyW

RegDeleteKeyW

RegEnumKeyW

RegCreateKeyExW

SHFileOperationW

ShellExecuteExW

ShellExecuteW

CryptCATCatalogInfoFromContext

WTHelperGetProvCertFromChain

WINTRUST.dll

CertGetNameStringW

CRYPT32.dll

.?AVCVideoMsg@@

^SQLS^

'%cMMV#)

Hummer Backup Setup EXE

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

<!-- Windows 8.1 -->

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

<!-- Windows Vista -->

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<!-- Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<!-- Windows 8 -->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

5;7,8084888<8@8

>#> ><>[>

?#?-?2?7?

5_5X5o5

7&8 80888

>#>(>->7>

?)?.?3?=?

0'1?1.6:6

4!4%4)4-4

7|7g7

? ?$?(?,?0?

6 6$6(6,60646

Thawte Certification1

hXXp://ocsp.thawte.com0

.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

hXXp://ts-ocsp.ws.symantec.com07

 hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0<

 hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

.Class 3 Public Primary Certification Authority0

<VeriSign Class 3 Public Primary Certification Authority - G50

hXXp://crl.verisign.com/pca3.crl0

hXXps://VVV.verisign.com/cps0

#hXXp://logo.verisign.com/vslogo.gif04

hXXp://ocsp.verisign.com0>

2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,

/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D

hXXps://VVV.verisign.com/rpa0

hXXp://ocsp.verisign.com0;

/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0

hXXps://VVV.verisign.com/cps0*

#hXXp://crl.verisign.com/pca3-g5.crl04

hXXp://ocsp.verisign.com0

@wininet.dll

%d&&'

123456789

00003333

deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

inflate 1.1.3 Copyright 1995-1998 Mark Adler

F%*.*f

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

Broken pipe

Inappropriate I/O control operation

Operation not permitted

RASAPI32.dll

WinExec

GetViewportOrgEx

ShellExecuteA

OLEAUT32.dll

WSOCK32.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

CreateDialogIndirectParamA

GetViewportExtEx

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

VVV.dywt.com.cn

.PAVCResourceException@@

.PAVCUserException@@

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/> </requestedPrivileges> </security></trustInfo></assembly>

1, 0, 6, 6

- Skin.dll

Software\Microsoft\Windows\CurrentVersion

*?|<>/":

invalid registry key

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

RMDir: RemoveDirectory failed("%s")

RMDir: RemoveDirectory("%s")

RMDir: RemoveDirectory invalid input("%s")

Delete: DeleteFile failed("%s")

Delete: DeleteFile("%s")

install.log

Section: "%s"

.DEFAULT\Control Panel\International

logging set to %d

settings logging to %d

WriteReg: error creating key "%s\%s"

WriteReg: error writing into "%s\%s" "%s"

WriteRegDWORD: "%s\%s" "%s"="0xx"

WriteRegExpandStr: "%s\%s" "%s"="%s"

WriteRegStr: "%s\%s" "%s"="%s"

DeleteRegKey: "%s\%s"

DeleteRegValue: "%s\%s" "%s"

WriteINIStr: wrote [%s] %s=%s in %s

CopyFiles "%s"->"%s"

Exec: failed createprocess ("%s")

Exec: success ("%s")

Exec: command="%s"

ExecShell: success ("%s": file:"%s" params:"%s")

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d

Exch: stack < %d elements

RMDir: "%s"

MessageBox: %d,"%s"

Delete: "%s"

Rename failed: %s

Rename: %s

IfFileExists: file "%s" does not exist, jumping %d

IfFileExists: file "%s" exists, jumping %d

CreateDirectory: "%s" created

CreateDirectory: can't create "%s" - a file already exists

CreateDirectory: can't create "%s" (err=%d)

CreateDirectory: "%s" (%d)

SetFileAttributes: "%s":X

Sleep(%d)

detailprint: %s

Call: %d

Aborting: "%s"

Jump: %d

HKERNEL32.DLL

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

hXXp://dldir1.qq.com/qqfile/qq/plugin/setuppkg.7z.output

_TX~QQSetupEx~0503~A1C22B84-CE8D-437A-AA60-6D3ABCB18ACF

RCreateWindowsDirTemp

R:\TempView\Misc\Setup3\BackupDownloader\BackupDownload.cpp

create folder :%s error, errcode:%lu

dir:%s

ParseCmdLine

`anonymous-namespace'::ParseCmdLine

cmd line

r:\tempview\misc\setup3\backupdownloader\installobject\InstallObject.h

GetExitCodeProcess exit code : %u

CInstallObjectAgent::CloseProcessHandle

ID=%d

r:\tempview\misc\setup3\backupdownloader\installobject\InstallObjectDefault.h

%d.%d.%d.%d

R:\TempView\Misc\Setup3\BackupDownloader\InstallObject\InstallObjectDefault.cpp

%s\drivers\usbvideo.sys

usbvideo.sys file version: %s

5.1.2600.2729

usbvideo.sys file version is big than 5.1.2600.2729, no need install KB899271

SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB899271

has register key:SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB899271 , no need install KB899271

hXXp://download.microsoft.com/download/4/6/0/460ca2ec-55b8-46d6-afb6-b644a7e03d71/WindowsXP-KB899271-v4-x86-CHS.exe

hXXp://dldir1.qq.com/music/clntupate/QzoneMusicInstall.exe

hXXp://dldir1.qq.com/music/clntupate/QQPhotoDrawExSetupForQQ.exe

hXXp://dldir1.qq.com/P2PUpdate/P2PSetup.exe

hXXp://dldir1.qq.com/qqfile/qq/videomsg/VideoMsgInstall.exe

hXXp://dldir1.qq.com/qqfile/qq/plugin/VideoShowPlayerInstall.exe

hXXp://dldir1.qq.com/qqfile/qq/plugin/VideoBeautyInstall.exe

hXXp://dldir1.qq.com/invc/cyclone/QQMiniDL_Setup.exe

hXXp://dlied6.qq.com/invc/xfspeed/kxg/versetup/QQWifiDL.exe

Copy File : %s to %s error, errcode:%lu

hXXp://dldir1.qq.com/qqfile/qq/plugin/QQGameMicro_setup.exe

\QQGame.exe

QQGame.exe

hXXp://dldir1.qq.com/qqfile/qq/plugin/HotWordInstall.exe

hXXp://androidpc.app.qq.com/app1/vertis.do?id=201409090001

BrowserInstaller.exe

@hXXp://dldl.qq.com/dl/qqie8

hXXp://dldl.qq.com/dl/qq

hXXp://dldir1.qq.com/music/clntupate/QQMusicDownloader.exe

hXXp://dldir1.qq.com/qqtv/qqlivesetup.exe

QQBrowser_Setup_QQ.exe

hXXp://dldir3.qq.com/minigamefile/QQGameDownloader.exe

hXXp://ws.sj.qq.com/webservices/download.do?yw=qq

QQPhoneManager_700024.exe

\rundll32.exe

R:\TempView\Misc\Setup3\BackupDownloader\Util\7zUtil.cpp

decoder doesn't support this archive

ERROR #%d

gfile path : %s

R:\TempView\Misc\Setup3\BackupDownloader\Util\DecryptUtil.cpp

Open file failed, error code : %u

Get file size failed, error code : %u

File size too large, HighPart = %u

AR:\TempView\Misc\Setup3\BackupDownloader\DataReport\DataReport.cpp

DataReport::UploadInstallResult

log.tlg

\\.\PhysicalDrive0

Siphlpapi.dll

ACreateDownloader. uiCustomID = %d

strFilePath = %s

uiCustomID = %d

CDownload::IsWorking(). m_bInited = %d

strUrl = %s

strFileName = %s

CDownload::DeleteTask(). uiTaskID = %d

CDownload::HandleDeleteTask(). uiTaskID = %d

CDownload::DeleteTask(). strUrl = %s

CDownload::HandleDeleteTask(). strUrl = %s

CDownload::SetDownloadSpeed(). uiSpeed = %d

CDownload::SetP2PUploadSpeed(). uiSpeed = %d

CDownload::HandleSetP2PUploadSpeed(). uiSpeed = %d

CDownload::SetSafeMode(). bSafeMode = %d

CDownload::HandleSetSafeMode(). bSafeMode = %d

stProxyInfo.eProxyType = %d

stProxyInfo.strProxyIP = %s

stProxyInfo.usProxyPort = %d

CDownload::OnNotify()->OnDownloadComplete. uiTaskID = %d, uiResult = %d, uiErrorCode = %d, uiDetailErrorCode = %d

Adlcore.dll

QQPCDetector.dll

R:\TempView\Misc\Setup3\BackupDownloader\Network\BizInstallerMgr.cpp

task:%lu, download error code:%d

task:%lu, filename:%s

%d not need to download

%d need to download

name = %s

url = %s

args = %s

filename = %s

dlcore dll not exist, file:%s

iter->bFinished:%d

Start ObjectId:%u

m_oDownloadMgr.StartTask returns:%d

default file %s download ok, local file : %s

optional file %s download ok, local file : %s

%s...

ObjId: %u

Name: %s

Url: %s

Args: %s

Filename: %s

install a file:%s

run install failed, error code : %u

GetDectectorResult() successed, wording: %s

RunDetector successed, dwOperator == %d

RunDetector failed, dwOperator == %d

dwOperator Invaild, dwOperator == %d

GetInstallObjsReportString

CBizInstallerMgr::GetInstallObjsReportString

R:\TempView\Misc\Setup3\BackupDownloader\Network\BizInstallerWindow.cpp

WM_TASKTRAY_MSG

dwCookie:%d

R:\TempView\Misc\Setup3\BackupDownloader\Network\DownloadMgr.cpp

CreateDownloadTask,Url:%s, localPath:%s

CDownloadMgr::CreateHttpDownloadTask

m_oDownloader.StartTask, dwCookie:%d, return %d

CDownloadMgr::DeleteTask, dwCookie:%d

m_mapCookieToTask.erase, dwCookie:%d

szFileName = %s

7.1.14522.0

(*.*)

%original file name%.exe_484_rwx_10000000_0003E000:

`.rsrc

L$(h%f

SSh0j

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ð<

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$<#$#=

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1, 0, 6, 6

- Skin.dll

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\50[1].jpg (73 bytes)
   %Documents and Settings%\%current user%\Application Data\Áè¸ç¸¨Öú\9ifz.exe (1632 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qzone.qq[1].htm (8977 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cgi_get_portrait[1].htm (129 bytes)
   %Documents and Settings%\%current user%\Application Data\Áè¸ç¸¨Öú\dlcore.dll (208 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1027663760[1].htm (22283 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\getonline[1].htm (12 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.