MD5: 7f1931ba70ce188da24162797cd7c867
SHA1: 661511fe7dbfd4abf3a132a2d42920f38edbe655
SHA256: a7b26b560c4f3434a75ea28a80011486a5fd0cbb199156a96ed10f4b12549be2
SSDeep: 768:Ggr0wYSq1In5GF rPX oJpZ1LxUJZI5FSYP/Iq6HoGpfrP1CT:b9S1InA r2oTxUJi5gIAfDIT
Size: 41984 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2008-11-26 02:11:04
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):

wkisvr.exe:552
%original file name%.exe:1264

The Trojan injects its code into the following process(es):

wkisvr.exe:444

File activity

The process %original file name%.exe:1264 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\wkisvr.exe (41 bytes)

Registry activity

The process wkisvr.exe:444 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EC 80 69 50 17 95 A9 E7 69 01 91 CC 01 7E 67 36"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The process %original file name%.exe:1264 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 97 93 C5 B1 32 E1 B2 E2 73 59 01 B3 DC CA 93"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Msn" = "C:\Windows\wkisvr.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name:
Product Name: Project1
Product Version: 1.00
Legal Copyright:
Legal Trademarks:
Original Filename: Project1.exe
Internal Name: Project1
File Version: 1.00
File Description:
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

FVSSh

SSSh8

PSShmV@

[DDoS]: Send error: <%d>.

ddos.random

wonk.ack

ddos.ack

wonk.syn

ddos.syn

%s Done with flood (%iKB/sec).

%s Flooding %s:%s with %s for %s seconds

%s Bad URL or DNS Error, error: <%d>

%s Update failed: Error executing file: %s.

%s Process Finished: "%s", Total Running Time: %s.

%s Created process: "%s", PID: <%d>

%s Failed to create process: "%s", error: <%d>

%s Couldn't parse path, error: <%d>

%s File download: %.1fKB to: %s @ %.1fKB/sec.

A%s Couldn't open file for writing: %s.

[UDP] Finished sending packets to %s

[UDP] Error sending udp packets to %s.

%s Failed to get requested URL from HTTP server.

%s URL visited.

%s Failed to connect to HTTP server.

%s Could not open a connection.

%s Invalid URL.

\autorun.inf

icon=%SystemRoot%\system32\SHELL32.dll,4

autorunme.exe

[.ShellClassInfo]

CLSID={645FF040-5081-101B-9F08-00AA002F954E}

\Desktop.ini

Infected drive: %s

ddos.supersyn

ddos.udp

msn.spread

msn.msg

msn.stats

msn.addcontact

[UDP] Failed to start flood thread, error: <%d>

[UDP] Sending %d packets to: %s. Packet size: %d, Delay: %d(ms)

[DDoS]: Failed to start flood thread, error: <%d>.

%s Flooding %s:%s for %s seconds

%s Downloading update from: %s to: %s.

%seraseme_%d%d%d%d%d.exe

%s Downloading URL: %s to: %s.

%s address %s added to msn.

%s Thread Activated: Sending Message.

%s Thread Activated: Sending Zipfile.

%s Thread Activated: Sending Zipfile and Message.

%s Visiting Website Now

MSN MSG

%s Failed to parse command.

USER %s * 0 :%s

NICK %s

PASS %s

QUIT %s

PRIVMSG %s :%s

JOIN %s

JOIN %s %s

MODE %s %s %s

MODE %s %s

Ping Timeout? (%d-%d)%d/%d

PONG %s

NICK

PRIVMSG

JOIN

icmp.dll

shlwapi.dll

ShellExecuteA

shell32.dll

Mozilla/4.0 (compatible)

InternetCrackUrlA

InternetOpenUrlA

FtpPutFileA

FtpGetFileA

HttpSendRequestA

HttpOpenRequestA

wininet.dll

ws2_32.dll

user32.dll

kernel32.dll

%s!%s@%s

%s No %s thread found.

%s %s thread stopped. (%d thread(s) stopped.)

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

%s\%s

del "%s">nul

if exist "%s" goto Repeat

ping 0.0.0.0>nul

%s\removeMe%i%i%i%i.bat

RegCloseKey

RegCreateKeyExA

ADVAPI32.dll

SHELL32.dll

WS2_32.dll

MSVCR71.dll

_acmdln

_amsg_exit

VkKeyScanA

keybd_event

USER32.dll

ole32.dll

OLEAUT32.dll

GetWindowsDirectoryA

KERNEL32.dll

%s Welcome Bitch.

%s Fail.

%s %s out.

%s <%i> out.

%s No user at: <%i>

%s Invalid slot: <%i>

%s Kill: <%d> threads

%s No threads

%s Killed thread: <%s>

%s %s already running: <%d>.

%s Fail start %s, err: <%d>.

[msn]: Message & Zipfile sent to: %d contacts.

[msn]: Message sent to: %d Contacts.

[msn]: Sent Stats - Messages: %d :: Files: %d :: Message & Files: %d.

Go fuck yourself %s.

%s logged in.

Removed by: %s!%s@%s

%s main thread

%s mis param.

uNkbot - uNkn0wn.eu

C:\Windows\

wkisvr.exe

*@admin.com

dances.instalprivileges.com

wkisvr.exe_444_rwx_00400000_0004E000:

.text

`.rdata

@.data

.rsrc

FVSSh

SSSh8

PSShmV@

[DDoS]: Send error: <%d>.

ddos.random

wonk.ack

ddos.ack

wonk.syn

ddos.syn

%s Done with flood (%iKB/sec).

%s Flooding %s:%s with %s for %s seconds

%s Bad URL or DNS Error, error: <%d>

%s Update failed: Error executing file: %s.

%s Process Finished: "%s", Total Running Time: %s.

%s Created process: "%s", PID: <%d>

%s Failed to create process: "%s", error: <%d>

%s Couldn't parse path, error: <%d>

%s File download: %.1fKB to: %s @ %.1fKB/sec.

A%s Couldn't open file for writing: %s.

[UDP] Finished sending packets to %s

[UDP] Error sending udp packets to %s.

%s Failed to get requested URL from HTTP server.

%s URL visited.

%s Failed to connect to HTTP server.

%s Could not open a connection.

%s Invalid URL.

\autorun.inf

icon=%SystemRoot%\system32\SHELL32.dll,4

autorunme.exe

[.ShellClassInfo]

CLSID={645FF040-5081-101B-9F08-00AA002F954E}

\Desktop.ini

Infected drive: %s

ddos.supersyn

ddos.udp

msn.spread

msn.msg

msn.stats

msn.addcontact

[UDP] Failed to start flood thread, error: <%d>

[UDP] Sending %d packets to: %s. Packet size: %d, Delay: %d(ms)

[DDoS]: Failed to start flood thread, error: <%d>.

%s Flooding %s:%s for %s seconds

%s Downloading update from: %s to: %s.

%seraseme_%d%d%d%d%d.exe

%s Downloading URL: %s to: %s.

%s address %s added to msn.

%s Thread Activated: Sending Message.

%s Thread Activated: Sending Zipfile.

%s Thread Activated: Sending Zipfile and Message.

%s Visiting Website Now

MSN MSG

%s Failed to parse command.

USER %s * 0 :%s

NICK %s

PASS %s

QUIT %s

PRIVMSG %s :%s

JOIN %s

JOIN %s %s

MODE %s %s %s

MODE %s %s

Ping Timeout? (%d-%d)%d/%d

PONG %s

NICK

PRIVMSG

JOIN

icmp.dll

shlwapi.dll

ShellExecuteA

shell32.dll

Mozilla/4.0 (compatible)

InternetCrackUrlA

InternetOpenUrlA

FtpPutFileA

FtpGetFileA

HttpSendRequestA

HttpOpenRequestA

wininet.dll

ws2_32.dll

user32.dll

kernel32.dll

%s!%s@%s

%s No %s thread found.

%s %s thread stopped. (%d thread(s) stopped.)

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

%s\%s

del "%s">nul

if exist "%s" goto Repeat

ping 0.0.0.0>nul

%s\removeMe%i%i%i%i.bat

RegCloseKey

RegCreateKeyExA

ADVAPI32.dll

SHELL32.dll

WS2_32.dll

MSVCR71.dll

_acmdln

_amsg_exit

VkKeyScanA

keybd_event

USER32.dll

ole32.dll

OLEAUT32.dll

GetWindowsDirectoryA

KERNEL32.dll

%s Welcome Bitch.

%s Fail.

%s %s out.

%s <%i> out.

%s No user at: <%i>

%s Invalid slot: <%i>

%s Kill: <%d> threads

%s No threads

%s Killed thread: <%s>

%s %s already running: <%d>.

%s Fail start %s, err: <%d>.

[msn]: Message & Zipfile sent to: %d contacts.

[msn]: Message sent to: %d Contacts.

[msn]: Sent Stats - Messages: %d :: Files: %d :: Message & Files: %d.

Go fuck yourself %s.

%s logged in.

Removed by: %s!%s@%s

%s main thread

%s mis param.

uNkbot - uNkn0wn.eu

C:\Windows\

wkisvr.exe

*@admin.com

dances.instalprivileges.com

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   wkisvr.exe:552
   %original file name%.exe:1264

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %WinDir%\wkisvr.exe (41 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Msn" = "C:\Windows\wkisvr.exe"

5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.