Trojan.Generic.16017651_54df6fca57
HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Generic.16017651 (B) (Emsisoft), Trojan.Generic.16017651 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: 54df6fca578702630f554b7894d39967
SHA1: aa9656a6e4f7b038bf84e1f726126e6d3af23d75
SHA256: 467bc17532f51d4924ce0b3ffe804ca28c0606c7716bf52a4854637a8f712932
SSDeep: 98304:Y7crkUMKfhowjiRCzyqrCS5ySoFy6zOihGNENp:Y71UhZowjiR4yNS8SoFNHgop
Size: 3631123 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2016-03-01 13:53:03
Analyzed on: WindowsXP SP3 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
| Behaviour | Description |
|---|---|
| EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):
regsvr32.exe:432
The Trojan injects its code into the following process(es):
%original file name%.exe:1788
Mutexes
The following mutexes were created/opened:
No objects were found.
File activity
The process %original file name%.exe:1788 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
C:\ZCB_API.dll (20507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3.tmp (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (3361 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (0 bytes)
Registry activity
The process regsvr32.exe:432 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "88 3C 90 16 E3 4C 8C 3E 1B 1D 26 8A 79 CE A5 36"
[HKCR\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\TypeLib]
"(Default)" = "{D7111ECF-2415-46C6-AAD4-EE6802448456}"
[HKCR\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\ProgID]
"(Default)" = "REGCOM.Register.Api.1"
[HKCR\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0\0\win32]
"(Default)" = "c:\ZCB_API.dll"
[HKCR\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}]
"(Default)" = "ZCBApiPlug Class"
[HKCR\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\TypeLib]
"(Default)" = "{D7111ECF-2415-46C6-AAD4-EE6802448456}"
[HKCR\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0\FLAGS]
"(Default)" = "0"
[HKCR\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\TypeLib]
"Version" = "1.0"
[HKCR\REGCOM.Register.Api\CurVer]
"(Default)" = "REGCOM.Register.Api.1"
[HKCR\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0]
"(Default)" = "ZCB_APILib"
[HKCR\REGCOM.Register.Api.1\CLSID]
"(Default)" = "{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}"
[HKCR\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\VersionIndependentProgID]
"(Default)" = "REGCOM.Register.Api"
[HKCR\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\InprocServer32]
"(Default)" = "c:\ZCB_API.dll"
[HKCR\REGCOM.Register.Api.1]
"(Default)" = "ZCBApiPlug Class"
[HKCR\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}]
"(Default)" = "IZCBApiPlug"
[HKCR\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\Version]
"(Default)" = "1.0"
[HKCR\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\REGCOM.Register.Api]
"(Default)" = "ZCBApiPlug Class"
[HKCR\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0\HELPDIR]
"(Default)" = "c:"
The process %original file name%.exe:1788 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6C D4 41 0D E9 35 17 B0 5B 09 EC C3 F3 C9 B9 BA"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
| MD5 | File path |
|---|---|
| 2305a0666ee61c846ba2dade346e2980 | c:\ZCB_API.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
VersionInfo
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| vv 0 | 4096 | 2433024 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| vv 1 | 2437120 | 3465216 | 3464192 | 5.54514 | 71d663f81cece96ce469642c829bf57e |
| .rsrc | 5902336 | 167936 | 165376 | 2.9642 | 8fd6a6699ebc2a64560caa1570620ded |
| .vv | 6070272 | 512 | 512 | 4.75808 | 80360b4bf778bb1e919509f3c9456f5a |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Web Traffic was not found.
The Trojan connects to the servers at the folowing location(s):
`.rsrc
t%SVh
t$(SSh
~%UVW
u$SShe
Ntdll.dll
Kernel32.dll
Psapi.dll
kernel32.dll
ntdll.dll
user32.dll
advapi32.dll
wininet.dll
shlwapi.dll
Shlwapi.dll
shell32.dll
MsgWaitForMultipleObjects
RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegEnumKeyA
InternetOpenUrlA
HttpQueryInfoA
ShellExecuteA
110notepad.exe
HKEY_CLASSES_ROOT\CLSID\{34AA1089-0C18-472C-A22A-55954C5E0242}HKEY_CLASSES_ROOT\CLSID\{49FCED15-7F6B-3C90-BB11-DF2496046714}HKEY_CLASSES_ROOT\CLSID\{5103FE5C-9E12-40E9-8C32-C87D5BA61AD5}HKEY_CLASSES_ROOT\CLSID\{E7DC451F-5DB3-3BFB-876C-F59A02ECC5E8}\ZCB_API.dll
.text
`.rdata
@.data
.UPX0
.UPX1
.reloc
@.rsrc
f;T$.uBf
8%u/P
tFHt:Ht.Ht"Hu`
QSShP
s%j.Zf
xSSSh
FTPjKS
FtPj;S
C.PjRV
CNotSupportedException
CCmdTarget
CHttpFile
TaskDialogIndirect
portuguese-brazilian
operator
GetProcessWindowStation
Visual C CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
inflate 1.2.8 Copyright 1995-2013 Mark Adler
[%s] %s
rc4.CryptData fail!
DecryptEncryptFileFromMemory(): uncompress fail! iRet = %d
DecryptEncryptFile(): CreateFile error! %d
DecryptEncryptFile(): GetFileSizeEx error! %d
DecryptEncryptFile(): malloc error %d
DecryptEncryptFile(): ReadFile error %d
DecryptEncryptMemory(): malloc error %d
LoadAndRunEncryptFile(): VirtualAlloc error! %d
LoadAndRunEncryptFile(): not find dll %s!
LoadAndRunEncryptFile(): not find function %s from %s!
LoadAndRunEncryptFile(): VirtualProtect error! %d
LoadAndRunEncryptFile(): pDllImageBase = %X
MemoryLoadEncryptMemory(): VirtualAlloc error! %d
MemoryLoadEncryptMemory(): not find dll %s!
MemoryLoadEncryptMemory(): not find function %s from %s!
MemoryLoadEncryptMemory(): VirtualProtect error! %d
MemoryLoadEncryptMemory(): pDllImageBase = %X
LoadEncryptFile() pImageBase = %p, dwCurrentVer = %d
LoadEncryptMemory() pImageBase = %p, dwCurrentVer = %d
CWebBrowser2
SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}Mozilla/4.0 (compatible)
Content-Type: application/x-www-form-urlencoded
hXXp://
\*.log
CWebQQ
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
D:\project\ZCB\trunk\ZCB_API\Release\ZCB_API.pdb
ZCB_API.dll
.PAVCMemoryException@@
.?AVCTestCmdUI@@
.?AVCCmdUI@@
.PAVCUserException@@
.PAVCSimpleException@@
.PAVCObject@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.PAVCOleException@@
.PAVCResourceException@@
.PAVCInternetException@@
.?AVCHttpFile@@
.PAVCArchiveException@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.PAVCOleDispatchException@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WV12@PB_W@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCDocument@@PAV3@@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W_N_N@@
.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@
.PAVCFileException@@
zcÁ
.PAVCException@@
.?AVCCmdTarget@@
.?AVCWebBrowser2@@
.?AVCMD5@@
1.2.8
WS2_32.dll
User32.dll
.?AVCWebQQ@@
3FV%D
4ccrT
-mN}5
I%U0=
Su.BJ=
'*$/O.QI
,A:%D
s*.fme
)W%X6
_=2ÒA
.XP:KK
C.RvK
xmD&.va
\$l.SvFx
&.sIM
.CWHS
.vanr
&V}%duV
.sWy3<Am/
,5.KC
.Ixd'
UDpW
ptkD%U
?.Pf%
p?^.JI
6?u%S*
:)û
Y1.JF
-x}:
.qe>O
2B.rV
FZ=.fpf
oH%f)
>.fvd
7.MF,3l
.wi>C<
e.WeI
.dr}
Iik=.Ddwm:
g?k%D
xW%cp
NS.iA
(?.IR
H.QzZ
.ec\U
B(%U(
,u.IG
[<.QHp
S9.Wxd
s%u-r{-N;V&%u
.unYK
:3BGq@%c
l$$h%FP
2|B.mN7
yrK%c
.fmgH
f6^%6.d
FK.CN=
P.PR(
.bl(@
-gJ}_
%XfNl
Dn%x`
.mReu
u.MgZ
7=j.Ks
.xcs|i
Z.Aiv
L$@hh8'%f
4TD%Su
v.Dz`
jf.nzb
!b%u{SD$<~.Ok
%Dm|2
5B.riw{u\b.ek\"j
TP).Cm
D)h%X4G[
.WzeK
L7.oH
.jrIOe
&%fU.}
J?.IR
}5%.sg e
.mpu,
3]vExe
m=E.Lv
QK%cR
W%Xm$
Z).NQU:F&
)1%Fv
$.Ehk
#?.uy
%DgD3
%0x{J&sF%D:
.vs?Q
t.ek`
@-rA}4
^I%u1
/2U4I%coN
%f/2e:R%
Q/2%C}
/25;g.hF
%d/2u2j
I)/2%8s
/2Œ
w!%1X
fJ.vh
}/.Cv
.PZZ&
1f'%S
I!.vf?
S;C<oU.zL
#.dy7M
.TTU
/'.vt
oledlg.dll
ADVAPI32.dll
yk.GG
ShellExecuteW
KERNEL32.dll
SHLWAPI.dll
fGg.rV
InternetOpenUrlW
Cmq%C{c{ZGDI32.dll
WINSPOOL.DRV
,I.Im
e.Xiv
x&-4}p
ole32.dll
WININET.dll
SHELL32.dll
OLEACC.dll
IPHLPAPI.DLL
HV).qQ
OLEAUT32.dll
1p.qnd
.mdD&
$COMDLG32.dll
(l5.ZzL
1hS.xk
SetViewportExtEx
YUSER32.dll
-M9}6
;,<0<4<8<
8Ÿ:S:x:
=#='= =9>
?#?'? ?8?
; ;$;(;,;0;
4 4$4(4,4044484<4@4
7 7$7(7,7074787<7
3 3$3(3,30343
4 4(40484
7(707<7`7
REGCOM.Register.Api.1 = s 'ZCBApiPlug Class'
CLSID = s '{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}'REGCOM.Register.Api = s 'ZCBApiPlug Class'
CurVer = s 'REGCOM.Register.Api.1'
ForceRemove {9CF66319-AA2F-424A-BEEA-9E42E36BEA1A} = s 'ZCBApiPlug Class'ProgID = s 'REGCOM.Register.Api.1'
VersionIndependentProgID = s 'REGCOM.Register.Api'
TypeLib = s '{D7111ECF-2415-46C6-AAD4-EE6802448456}'stdole2.tlbWWW
API_LoginWWW
,7API_FindPasswordd
API_LoginOutd
API_QQLoginWd
rAPI_GetLoginInfod
gAPI_GetLoginStateInfoWWW
Created by MIDL version 7.00.0555 at Tue Jan 26 12:15:38 2016
1.3.1WW
\ZCB_API.dll" /s
REGCOM.Register.api.1
tzp6%NkCrlxFo%te%te%tfBGUIvyBHf%7GctNN3mMUw0TT%GSKtdZBeBz%R6rfEiU%arAQt6%srM2ok%ItYfyE%UtaAyQ%6tsMwa%ArQ6tv%Nt3lwJ%ZrgFiV%byBRt7%vyN3yl%JrZgtF%VtbByR%7yvNu4%mtK0qx%Oy4myK%0rhGtW%cyCSo8%xtO4em%Kt0hqG%WycCuS%9tzPrj27%X96yE8Xa7NtQfM%vdDtq%up%rIJfofQc%VQ3yBXU7WToNVK%m2Bt01kG8hed77%bTtBzJ6tZM%
IRHogIb5aKp%sWrMoz%HrXdiE%UtaAwQ%6tsMp2%ktI6qs%Mt2kuI%YtfErU%
gdi32.dll
\*.dll
\Config.ini
API_Login
hXXp://bbs.kartrider.net/jietoulanqiu.txt
hXXp://bbs.kartrider.net/160301A.exe.exe
cmd.exe /c del "
66666666
FreeStyle.exe
\ApolloCT.dll
API_LoginOut
API_FindPassword
#in_password
API_QQLogin
.rsrc
@.reloc
kernel32.DLL
SetWindowsHookExA
GetAsyncKeyState
GetProcessHeap
WINMM.dll
timeGetTimehXXp://VVV.2345.com/?ktt659189
BUG! hXXp://VVV.super-ec.cn/
ws2_32.dll
321050146
1.03-1.08
%d&&'
123456789
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
__MSVCRT_HEAP_SELECT
iphlpapi.dll
MPR.dll
VERSION.dll
WinExec
GetKeyState
USER32.dll
GetViewportOrgEx
GDI32.dll
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyExA
COMCTL32.dll
GetCPInfo
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetViewportOrgEx
OffsetViewportOrgEx
ScaleViewportExtEx
GetViewportExtEx
comdlg32.dll
dll.dll
Shell32.dll
Mpr.dll
Advapi32.dll
Gdi32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
(*.prn)|*.prn|
%d.%d
%d/%d
1.6.9
unsupported zlib version
png_read_image: unsupported transformation
%d / %d
Bogus message code %d
libpng error: %s
libpng warning: %s
1.1.3
bad keyword
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
(%d-%d):
%ld%c
#include "l.chs\afxres.rc" // Standard components
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/> </requestedPrivileges> </security></trustInfo></assembly>
2%3s3
< <$<(<,<0<4<8<<<@<
1 1$1(1,101
5"5,5@5|5
8%9u9
5Q5D5[5a5m5
7084888<8@8
0 1
8$9(9,90949
-090C0W0e0r0w0}0
2%2F2V2
7-7C7U7i7}7
: :$:(:,:0:4:8:<:@:
2 2$2(24282<2(6
hXXp://qq131420.cccpan.com/
Freestyle.exe
514416727
F%*.*f
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
c:\%original file name%.exe
InternetCanonicalizeUrlA
HttpSendRequestA
HttpOpenRequestA
InternetCrackUrlA
.data
.rdata
KERNEL32.DLL
RASAPI32.dll
comctl32.dll
accKeyboardShortcut
wuser32.dll
hhctrl.ocx
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
mfcm100u.dll
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
%s%s.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
lX-X-x-XX-XXXXXX
WININET.DLL
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
SHELL32.DLL
lXXxXXXXXXXX
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
WUSER32.DLL
UxTheme.dll
dwmapi.dll
D2D1.dll
DWrite.dll
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl
%s (%s:%d)
?456789:;<=
!"#$%&'()* ,-./0123
{79F66B3B-220D-43C7-A1C2-8E350783D8F2}000000000000
[%d/d/d d:d:d] %s
%sd-d-d.log
ZCB_MUTEX_%X
0123456789
|%s%s%s
%s|%d|%s|%s
%s|%s
d-d-d d:d:d
%s|%s|%s|%s|%s
%s|%s|%s|%s
%d|%d|%s|%d|%s|%s|%d|%d|%s|%s|%d|%s
%s|%s|%s
%d|%d
%d|%s|%s
%s\Update.exe
%s "%s" %d %s
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
OLEAUT32.DLL
{8856F961-340A-11D0-A96B-00C04FD705A2}c.84zcb.com/open/v1_7/run/bind%c.84zcb.com/open/v1_7/Account/Signup c.84zcb.com/open/v1_7/pay/bycard)c.84zcb.com/open/v1_7/account/resetpasswd
c.84zcb.com/open/v1_7/run/info(c.84zcb.com/open/v1_7/account/editpasswd'c.84zcb.com/open/v1_7/account/editemail
c.84zcb.com/open/v1_7/run/code c.84zcb.com/open/v1_7/run/unbind c.84zcb.com/open/v1_7/run/update
%c.84zcb.com/open/v1_7/leaveword/send "c.84zcb.com/open/v1_7/soft/upgrade
c.84zcb.com/open/v1_7/soft/ann
XXXXXX
Host: %s
%d:%s
%d,%d
data=%s&sign=%sG^([a-zA-Z0-9_\.\-] \@([a-zA-Z0-9_\-] \.) (com)|(cn)|(net)|(edu)|(org))$
hXXp://user.84zcb.com/p/qq
user.84zcb.com/s/Client
%d.%d.%d.%d
0.0.0.0
data=%s&sign=%s&crypto=%d
data=%s&sign=%s&crypto=%d&mm=%s
1.0.1.1032&hXXp://c1.84zcb.com/Open/V1_7/run/bind&hXXp://c2.84zcb.com/Open/V1_7/run/bind(hXXp://c1.84zcb.com/Open/V1_7/run/update(hXXp://c2.84zcb.com/Open/V1_7/run/update
CODE&hXXp://c1.84zcb.com/open/v1_7/run/code&hXXp://c2.84zcb.com/open/v1_7/run/code&hXXp://c1.84zcb.com/open/v1_7/run/info&hXXp://c2.84zcb.com/open/v1_7/run/info
1.0.1.1032
(*.*)
%original file name%.exe_1788_rwx_00401000_005A0000:
t%SVh
t$(SSh
~%UVW
u$SShe
Ntdll.dll
Kernel32.dll
Psapi.dll
kernel32.dll
ntdll.dll
user32.dll
advapi32.dll
wininet.dll
shlwapi.dll
Shlwapi.dll
shell32.dll
MsgWaitForMultipleObjects
RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegEnumKeyA
InternetOpenUrlA
HttpQueryInfoA
ShellExecuteA
110notepad.exe
HKEY_CLASSES_ROOT\CLSID\{34AA1089-0C18-472C-A22A-55954C5E0242}HKEY_CLASSES_ROOT\CLSID\{49FCED15-7F6B-3C90-BB11-DF2496046714}HKEY_CLASSES_ROOT\CLSID\{5103FE5C-9E12-40E9-8C32-C87D5BA61AD5}HKEY_CLASSES_ROOT\CLSID\{E7DC451F-5DB3-3BFB-876C-F59A02ECC5E8}\ZCB_API.dll
.text
`.rdata
@.data
.UPX0
.UPX1
.reloc
@.rsrc
f;T$.uBf
8%u/P
tFHt:Ht.Ht"Hu`
QSShP
s%j.Zf
xSSSh
FTPjKS
FtPj;S
C.PjRV
CNotSupportedException
CCmdTarget
CHttpFile
TaskDialogIndirect
portuguese-brazilian
operator
GetProcessWindowStation
Visual C CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
inflate 1.2.8 Copyright 1995-2013 Mark Adler
[%s] %s
rc4.CryptData fail!
DecryptEncryptFileFromMemory(): uncompress fail! iRet = %d
DecryptEncryptFile(): CreateFile error! %d
DecryptEncryptFile(): GetFileSizeEx error! %d
DecryptEncryptFile(): malloc error %d
DecryptEncryptFile(): ReadFile error %d
DecryptEncryptMemory(): malloc error %d
LoadAndRunEncryptFile(): VirtualAlloc error! %d
LoadAndRunEncryptFile(): not find dll %s!
LoadAndRunEncryptFile(): not find function %s from %s!
LoadAndRunEncryptFile(): VirtualProtect error! %d
LoadAndRunEncryptFile(): pDllImageBase = %X
MemoryLoadEncryptMemory(): VirtualAlloc error! %d
MemoryLoadEncryptMemory(): not find dll %s!
MemoryLoadEncryptMemory(): not find function %s from %s!
MemoryLoadEncryptMemory(): VirtualProtect error! %d
MemoryLoadEncryptMemory(): pDllImageBase = %X
LoadEncryptFile() pImageBase = %p, dwCurrentVer = %d
LoadEncryptMemory() pImageBase = %p, dwCurrentVer = %d
CWebBrowser2
SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}Mozilla/4.0 (compatible)
Content-Type: application/x-www-form-urlencoded
hXXp://
\*.log
CWebQQ
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
D:\project\ZCB\trunk\ZCB_API\Release\ZCB_API.pdb
ZCB_API.dll
.PAVCMemoryException@@
.?AVCTestCmdUI@@
.?AVCCmdUI@@
.PAVCUserException@@
.PAVCSimpleException@@
.PAVCObject@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.PAVCOleException@@
.PAVCResourceException@@
.PAVCInternetException@@
.?AVCHttpFile@@
.PAVCArchiveException@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.PAVCOleDispatchException@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WV12@PB_W@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCDocument@@PAV3@@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W_N_N@@
.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@
.PAVCFileException@@
zcÁ
.PAVCException@@
.?AVCCmdTarget@@
.?AVCWebBrowser2@@
.?AVCMD5@@
1.2.8
WS2_32.dll
User32.dll
.?AVCWebQQ@@
3FV%D
4ccrT
-mN}5
I%U0=
Su.BJ=
'*$/O.QI
,A:%D
s*.fme
)W%X6
_=2ÒA
.XP:KK
C.RvK
xmD&.va
\$l.SvFx
&.sIM
.CWHS
.vanr
&V}%duV
.sWy3<Am/
,5.KC
.Ixd'
UDpW
ptkD%U
?.Pf%
p?^.JI
6?u%S*
:)û
Y1.JF
-x}:
.qe>O
2B.rV
FZ=.fpf
oH%f)
>.fvd
7.MF,3l
.wi>C<
e.WeI
.dr}
Iik=.Ddwm:
g?k%D
xW%cp
NS.iA
(?.IR
H.QzZ
.ec\U
B(%U(
,u.IG
[<.QHp
S9.Wxd
s%u-r{-N;V&%u
.unYK
:3BGq@%c
l$$h%FP
2|B.mN7
yrK%c
.fmgH
f6^%6.d
FK.CN=
P.PR(
.bl(@
-gJ}_
%XfNl
Dn%x`
.mReu
u.MgZ
7=j.Ks
.xcs|i
Z.Aiv
L$@hh8'%f
4TD%Su
v.Dz`
jf.nzb
!b%u{SD$<~.Ok
%Dm|2
5B.riw{u\b.ek\"j
TP).Cm
D)h%X4G[
.WzeK
L7.oH
.jrIOe
&%fU.}
J?.IR
}5%.sg e
.mpu,
3]vExe
m=E.Lv
QK%cR
W%Xm$
Z).NQU:F&
)1%Fv
$.Ehk
#?.uy
%DgD3
%0x{J&sF%D:
.vs?Q
t.ek`
@-rA}4
^I%u1
/2U4I%coN
%f/2e:R%
Q/2%C}
/25;g.hF
%d/2u2j
I)/2%8s
/2Œ
w!%1X
fJ.vh
}/.Cv
.PZZ&
1f'%S
I!.vf?
S;C<oU.zL
#.dy7M
.TTU
/'.vt
oledlg.dll
ADVAPI32.dll
yk.GG
ShellExecuteW
KERNEL32.dll
SHLWAPI.dll
fGg.rV
InternetOpenUrlW
Cmq%C{c{ZGDI32.dll
WINSPOOL.DRV
,I.Im
e.Xiv
x&-4}p
ole32.dll
WININET.dll
SHELL32.dll
OLEACC.dll
IPHLPAPI.DLL
HV).qQ
OLEAUT32.dll
1p.qnd
.mdD&
$COMDLG32.dll
(l5.ZzL
1hS.xk
SetViewportExtEx
YUSER32.dll
-M9}6
;,<0<4<8<
8Ÿ:S:x:
=#='= =9>
?#?'? ?8?
; ;$;(;,;0;
4 4$4(4,4044484<4@4
7 7$7(7,7074787<7
3 3$3(3,30343
4 4(40484
7(707<7`7
REGCOM.Register.Api.1 = s 'ZCBApiPlug Class'
CLSID = s '{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}'REGCOM.Register.Api = s 'ZCBApiPlug Class'
CurVer = s 'REGCOM.Register.Api.1'
ForceRemove {9CF66319-AA2F-424A-BEEA-9E42E36BEA1A} = s 'ZCBApiPlug Class'ProgID = s 'REGCOM.Register.Api.1'
VersionIndependentProgID = s 'REGCOM.Register.Api'
TypeLib = s '{D7111ECF-2415-46C6-AAD4-EE6802448456}'stdole2.tlbWWW
API_LoginWWW
,7API_FindPasswordd
API_LoginOutd
API_QQLoginWd
rAPI_GetLoginInfod
gAPI_GetLoginStateInfoWWW
Created by MIDL version 7.00.0555 at Tue Jan 26 12:15:38 2016
1.3.1WW
\ZCB_API.dll" /s
REGCOM.Register.api.1
tzp6%NkCrlxFo%te%te%tfBGUIvyBHf%7GctNN3mMUw0TT%GSKtdZBeBz%R6rfEiU%arAQt6%srM2ok%ItYfyE%UtaAyQ%6tsMwa%ArQ6tv%Nt3lwJ%ZrgFiV%byBRt7%vyN3yl%JrZgtF%VtbByR%7yvNu4%mtK0qx%Oy4myK%0rhGtW%cyCSo8%xtO4em%Kt0hqG%WycCuS%9tzPrj27%X96yE8Xa7NtQfM%vdDtq%up%rIJfofQc%VQ3yBXU7WToNVK%m2Bt01kG8hed77%bTtBzJ6tZM%
IRHogIb5aKp%sWrMoz%HrXdiE%UtaAwQ%6tsMp2%ktI6qs%Mt2kuI%YtfErU%
gdi32.dll
\*.dll
\Config.ini
API_Login
hXXp://bbs.kartrider.net/jietoulanqiu.txt
hXXp://bbs.kartrider.net/160301A.exe.exe
cmd.exe /c del "
66666666
FreeStyle.exe
\ApolloCT.dll
API_LoginOut
API_FindPassword
#in_password
API_QQLogin
.rsrc
@.reloc
kernel32.DLL
SetWindowsHookExA
GetAsyncKeyState
GetProcessHeap
WINMM.dll
timeGetTimehXXp://VVV.2345.com/?ktt659189
BUG! hXXp://VVV.super-ec.cn/
ws2_32.dll
321050146
1.03-1.08
%d&&'
123456789
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
__MSVCRT_HEAP_SELECT
iphlpapi.dll
MPR.dll
VERSION.dll
WinExec
GetKeyState
USER32.dll
GetViewportOrgEx
GDI32.dll
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyExA
COMCTL32.dll
GetCPInfo
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetViewportOrgEx
OffsetViewportOrgEx
ScaleViewportExtEx
GetViewportExtEx
comdlg32.dll
dll.dll
Shell32.dll
Mpr.dll
Advapi32.dll
Gdi32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
(*.prn)|*.prn|
%d.%d
%d/%d
1.6.9
unsupported zlib version
png_read_image: unsupported transformation
%d / %d
Bogus message code %d
libpng error: %s
libpng warning: %s
1.1.3
bad keyword
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
(%d-%d):
%ld%c
#include "l.chs\afxres.rc" // Standard components
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/> </requestedPrivileges> </security></trustInfo></assembly>
2%3s3
< <$<(<,<0<4<8<<<@<
1 1$1(1,101
5"5,5@5|5
8%9u9
5Q5D5[5a5m5
7084888<8@8
0 1
8$9(9,90949
-090C0W0e0r0w0}0
2%2F2V2
7-7C7U7i7}7
: :$:(:,:0:4:8:<:@:
2 2$2(24282<2(6
hXXp://qq131420.cccpan.com/
Freestyle.exe
514416727
F%*.*f
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
c:\%original file name%.exe
InternetCanonicalizeUrlA
HttpSendRequestA
HttpOpenRequestA
InternetCrackUrlA
.data
.rdata
comctl32.dll
accKeyboardShortcut
wuser32.dll
hhctrl.ocx
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
mfcm100u.dll
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
KERNEL32.DLL
%s%s.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
lX-X-x-XX-XXXXXX
WININET.DLL
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
SHELL32.DLL
lXXxXXXXXXXX
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
WUSER32.DLL
UxTheme.dll
dwmapi.dll
D2D1.dll
DWrite.dll
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl
%s (%s:%d)
?456789:;<=
!"#$%&'()* ,-./0123
{79F66B3B-220D-43C7-A1C2-8E350783D8F2}000000000000
[%d/d/d d:d:d] %s
%sd-d-d.log
ZCB_MUTEX_%X
0123456789
|%s%s%s
%s|%d|%s|%s
%s|%s
d-d-d d:d:d
%s|%s|%s|%s|%s
%s|%s|%s|%s
%d|%d|%s|%d|%s|%s|%d|%d|%s|%s|%d|%s
%s|%s|%s
%d|%d
%d|%s|%s
%s\Update.exe
%s "%s" %d %s
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
OLEAUT32.DLL
{8856F961-340A-11D0-A96B-00C04FD705A2}c.84zcb.com/open/v1_7/run/bind%c.84zcb.com/open/v1_7/Account/Signup c.84zcb.com/open/v1_7/pay/bycard)c.84zcb.com/open/v1_7/account/resetpasswd
c.84zcb.com/open/v1_7/run/info(c.84zcb.com/open/v1_7/account/editpasswd'c.84zcb.com/open/v1_7/account/editemail
c.84zcb.com/open/v1_7/run/code c.84zcb.com/open/v1_7/run/unbind c.84zcb.com/open/v1_7/run/update
%c.84zcb.com/open/v1_7/leaveword/send "c.84zcb.com/open/v1_7/soft/upgrade
c.84zcb.com/open/v1_7/soft/ann
XXXXXX
Host: %s
%d:%s
%d,%d
data=%s&sign=%sG^([a-zA-Z0-9_\.\-] \@([a-zA-Z0-9_\-] \.) (com)|(cn)|(net)|(edu)|(org))$
hXXp://user.84zcb.com/p/qq
user.84zcb.com/s/Client
%d.%d.%d.%d
0.0.0.0
data=%s&sign=%s&crypto=%d
data=%s&sign=%s&crypto=%d&mm=%s
1.0.1.1032&hXXp://c1.84zcb.com/Open/V1_7/run/bind&hXXp://c2.84zcb.com/Open/V1_7/run/bind(hXXp://c1.84zcb.com/Open/V1_7/run/update(hXXp://c2.84zcb.com/Open/V1_7/run/update
CODE&hXXp://c1.84zcb.com/open/v1_7/run/code&hXXp://c2.84zcb.com/open/v1_7/run/code&hXXp://c1.84zcb.com/open/v1_7/run/info&hXXp://c2.84zcb.com/open/v1_7/run/info
1.0.1.1032
(*.*)
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
regsvr32.exe:432
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
C:\ZCB_API.dll (20507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3.tmp (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (3361 bytes) - Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
