MD5: a4c9d15c7bdfc4952d7ec53de8bf4141
SHA1: f28fe618abd0aa673599d6ffe033746c5e196218
SHA256: fc1f4836c1bbb2309994c8baf4da3b0a8934a2dcaabbd8562511da14af53c960
SSDeep: 6144:GVcgoUoPgaTOsPffftemyjqqgL9vbEXqZBHu6GzrH:kcgoUoPgaTXf0HjgLxbfDO6
Size: 313856 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2007-04-18 14:23:51
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1200
geixsa.exe:1856

The Trojan injects its code into the following process(es):

Explorer.EXE:1572

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1200 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Ajato\geixsa.exe (1738 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FJC1EA4.bat (173 bytes)

The process geixsa.exe:1856 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\NTUSER.DAT.LOG (2400 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (1436 bytes)

Registry activity

The process %original file name%.exe:1200 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7E E9 50 62 12 0B 89 71 B5 6F 80 ED 3E 16 C7 FE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process geixsa.exe:1856 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 C6 73 7C 47 30 61 C6 6D 15 03 27 85 27 AA 2E"

[HKCU\Software\Microsoft\Puvomob]
"1j650d10" = "mdAMnwU/3pOAI5Zf6/XKJg=="

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in WININET.dll:

HttpSendRequestExA
HttpSendRequestW
InternetReadFileExA
InternetWriteFile
InternetWriteFileExA
InternetQueryDataAvailable
HttpQueryInfoW
HttpSendRequestExW
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle

The Trojan installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan installs the following user-mode hooks in USER32.dll:

GetClipboardData
TranslateMessage

The Trojan installs the following user-mode hooks in Secur32.dll:

DecryptMessage
SealMessage
DeleteSecurityContext

The Trojan installs the following user-mode hooks in WS2_32.dll:

WSAGetOverlappedResult
WSASend
recv
gethostbyname
WSARecv
send
closesocket
freeaddrinfo
getaddrinfo
GetAddrInfoW

The Trojan installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
NtCreateThread

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.reloc

Invalid parameter passed to C runtime function.

0123456789

6$7,747<7

gdiplus.dll

GdiplusShutdown

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

HTTP/1.1

RegDeleteKeyExW

>.-0298,>9;{ 

OlzhjkeYLbzlh`t

7* 37 0&0

* 13.701.

REPORT

hXXp://VVV.google.com/

hXXp://VVV.bing.com/

t.Ht$HHt

m9.td

ntdll.dll

KERNEL32.dll

GetKeyboardState

MsgWaitForMultipleObjects

ExitWindowsEx

USER32.dll

CryptGetKeyParam

CryptImportKey

CryptDestroyKey

RegCreateKeyExW

RegQueryInfoKeyW

RegDeleteKeyW

RegOpenKeyExW

RegFlushKey

RegEnumKeyExW

RegCloseKey

ADVAPI32.dll

PathIsURLW

UrlUnescapeA

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

ole32.dll

GDI32.dll

WS2_32.dll

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

PFXImportCertStore

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

InternetCrackUrlA

HttpOpenRequestA

HttpEndRequestA

HttpAddRequestHeadersA

WININET.dll

OLEAUT32.dll

NETAPI32.dll

IPHLPAPI.DLL

VERSION.dll

msvcrt.dll

zcÁ

9$9,949<9

3#3(343{3

\StringFileInfo\xx\%s

launchpadshell.exe

dirclt32.exe

wtng.exe

prologue.exe

pcsws.exe

fdmaster.exe

kernel32.dll

"%s" %s

/c "%s"

c.tmp

Wadvapi32.dll

shell32.dll

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\%s

urlmon.dll

cabinet.dll

%Documents and Settings%\%current user%\Application Data

%Documents and Settings%\%current user%\Local Settings\Application Data

Global\{3D6E1BE3-083C-4088-F013-F140DE00D252}

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1200
   geixsa.exe:1856
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Application Data\Ajato\geixsa.exe (1738 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\FJC1EA4.bat (173 bytes)
   %Documents and Settings%\%current user%\NTUSER.DAT.LOG (2400 bytes)
   

5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.