MD5: c5731e49992d768425df85bf41e8701e
SHA1: 4b0c8cf812a43bbc31bcaf17c876f16563aa18b7
SHA256: e92ae4ed193365d7ca42ce5a56b48e51ec7befbd5d6216b83279176d5e298ba4
SSDeep: 24576:RhLIoBkN4W5A3kE XkSk l2G1pqgMxa5sqQRTU vp:DvnXfG1pOTPvp
Size: 2672640 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: BorlandDelphi30, BorlandDelphiv30, UPolyXv05_v6
Company: MindSpark
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:1672

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1672 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7676.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_EE9DB89C3D6A328B5FEAFF0ED3C77874 (1640 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1E698CCB2C296D265AC1A253974E09FD_5ACDE65230A4C850E10D8A8B3874063D (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E698CCB2C296D265AC1A253974E09FD_5ACDE65230A4C850E10D8A8B3874063D (1608 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_EE9DB89C3D6A328B5FEAFF0ED3C77874 (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar7677.tmp (2712 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar7677.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7676.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1672 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\c5731e49992d768425df85bf41e8701e_RASAPI32]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\c5731e49992d768425df85bf41e8701e_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\c5731e49992d768425df85bf41e8701e_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\c5731e49992d768425df85bf41e8701e_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\c5731e49992d768425df85bf41e8701e_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\c5731e49992d768425df85bf41e8701e_RASMANCS]
"FileTracingMask" = "4294901760"
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\c5731e49992d768425df85bf41e8701e_RASMANCS]
"ConsoleTracingMask" = "4294901760"

"EnableConsoleTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACEAGC+AmOouYmuRo7J4Qfua8=
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACEAGC+AmOouYmuRo7J4Qfua8=	93.184.220.29
s3.amazonaws.com	52.216.229.157

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACEAGC+AmOouYmuRo7J4Qfua8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=172800

Content-Type: application/ocsp-response

Date: Tue, 10 Oct 2017 11:59:14 GMT

Etag: "59dc6954-1d7"

Expires: Thu, 12 Oct 2017 11:59:14 GMT

Last-Modified: Tue, 10 Oct 2017 06:31:48 GMT

Server: ECS (vie/F3AD)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0........Y0.GX....T6.{:..M...2017052
6193053Z0s0q0I0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
........&..;'........20170526193053Z....20171122193053Z0...*.H........
.....!>.SN4...6....J......n..BOV.#.....S.k....h<1..j..:iLK......
......xv...hn,..y...v..6..]s....\......3".m.*'h..T...Si|....,6j.(..j(.
..\...g.BNY;...W..F@Fq.)q_'K.....GtC!*......z...,.t..x.b".....D._n.V=V
......v....._<.(Z}#..|.l....[a|.JBBh.4..0....gp.|...1{w..HTTP/1.1 2
00 OK..Accept-Ranges: bytes..Cache-Control: max-age=172800..Content-Ty
pe: application/ocsp-response..Date: Tue, 10 Oct 2017 11:59:14 GMT..Et
ag: "59dc6954-1d7"..Expires: Thu, 12 Oct 2017 11:59:14 GMT..Last-Modif
ied: Tue, 10 Oct 2017 06:31:48 GMT..Server: ECS (vie/F3AD)..X-Cache: H
IT..Content-Length: 471..0..........0..... .....0......0...0........Y0
.GX....T6.{:..M...20170526193053Z0s0q0I0... ........./Ev..Y..].....x.#
......Y0.GX....T6.{:..M..........&..;'........20170526193053Z....20171
122193053Z0...*.H.............!>.SN4...6....J......n..BOV.#.....S.k
....h<1..j..:iLK............xv...hn,..y...v..6..]s....\......3".m.*
'h..T...Si|....,6j.(..j(...\...g.BNY;...W..F@Fq.)q_'K.....GtC!*......z
...,.t..x.b".....D._n.V=V......v....._<.(Z}#..|.l....[a|.JBBh.4..0.
...gp.|...1{w......
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

Uh.fA

ssShift

htKeyword

EInvalidOperation

u%CNu

%s_%d

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

uxtheme.dll

%s%s%s%s%s%s%s%s%s%s

Proportional

MAPI32.DLL

PasswordCharp

OnKeyDown

OnKeyPress

OnKeyUp

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

imm32.dll

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

Uh.nE

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

TSQLTimeStampVariantType

TSQLTimeStampData

SqlTimSt

ole32.dll

SQLTimeStamp

Password

TLoginDialog

TLoginDialog ^F

TPasswordDialog

TPasswordDialogHeF

Uh.NG

tcPW

!"#$%&*;<=>@[]^_`{|}

Invalid size or check sum of file or unsupported compression format

File "%s" not found

Cannot create file "%s"

Cannot create directory "%s"

Cannot open file "%s"

Cannot delete file "%s"

Invalid compressed size, rfs.size = %d, count = %d

Cannot create output file. Probably file is locked by another process. FileName = '%s'.

Archive is open. You should close it beore performing this operation.

Cannot compress file '%s'. Zip64 mode is not enabled

Deflate64 compression method is not supported

Cannot delete folder "%s"

Multiple transactions are not supported for multi-volume archives

Invalid InitVector index = %d. Index should be >= 0 and < %d

Invalid password. Cannot decompress encrypted file.

%s: %s

TZFProcessOperation

Operation

TZFOnPasswordEvent

NewPassword

Password

OnPassword

1.2.5

Web site: hXXp://VVV.componentace.com

the appropriate version of this product at hXXp://VVV.componentace.com

feel free to contact us at support@componentace.com

OnExecuteMacro

Service %s

Topic %s

URLDownloadToFileA

urlmon.dll

ShellExecuteA

shell32.dll

*.exe

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

JOIN

NICK

PRIVMSG

olepro32.dll

ltsLeftPercent

%TWordApplicationWindowSelectionChange

TWordApplicationWindowSize

OnWindowSelectionChange

OnWindowSize

\log.txt

deflate 1.2.5 Copyright 1995-2010 Jean-loup Gailly and Mark Adler

inflate 1.2.5 Copyright 1995-2010 Mark Adler

^%S<O_Z__`'""

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

RegFlushKey

WinExec

GetCPInfo

version.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

comdlg32.dll

= =$=(=,=0=4=8=<=%>?>

8)8=8[8}8

?#?'? ?/?3?7?

6"676<6{6

? ?$?(?,?0?

2 2$2(2,202>2

88N8f8n8r8

5 5$575?5_5

6"6&6*606

< <$<(<,<0<4<8<<<

2034383<3

1 1$1(1,1014181

6|7

4!4%4)4-414

5l6x6

7 7-7C7H7U7k7p7}7

>,?0?4?8?

3,4044484

6 7$7(7,7|7

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

33333333333333

337373?3

333373?33

33333337

3733333

3337333

3333373

3737333

373333?3

3333333333

333333333

333?33?333

333373?3

H:url

.Dzj*

KWindows

rSqlTimSt

UrlMon

ZFKeyDeriv

ZFUWindows

 IdTCPServer

IdTCPConnection

IdTCPStream

LoginDialog

Database Login

&Password:

PasswordChar

PasswordDialog

Enter password

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

Picture.Data

Unspecified error (%d) from %s.

TLOGINDIALOG

TPASSWORDDIALOG

NUnable to retrieve a pointer to a running object registered with OLE for %s/%s/Top Legend Position must be between 0 and 100 %

First Legend Value must be > 0.Legend Color Width must be between 0 and 100 %*%s Angle must be between 0 and 359 degrees#DateTime Axis cannot be Logarithmic2Logarithmic Axis Min and Max values should be >= 0*Labels Separation % must be greater than 0

%s of %s

#,##0.###

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design mode

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

%s is not a valid service.

Socket Error # %d

Operation would block.

Operation now in progress.

Operation already in progress.

Socket operation on non-socket.

Password for "%s"

Enter password:

Please insert a blank disk #%d

Please insert disk #%dtDisk is full. Required free space: %d bytes, but available only: %d bytes. Clean the disk or find another blank disk0%s. File processing error, possibly disk is fullPFile '%s' not found on inserted disk. Please insert last disk with required file

Set Size Exceeded.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

Remote Login;Circular Protection detected, Protection Object is invalid.

String Format "%d" not exists. Input is not an valid %s Format.&Input can not be convert to %s Format.

XX CodingLLength from Encryptionkey is invalid.

Keysize for %s must be to %d-%d bytes6%s is not initialized call Init() or InitKey() before.

Overwrite file "%s" with "%s"

Invalid SQL date/time values

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

No help keyword specified.

%s is not a valid BCD value$Could not parse SQL TimeStamp string

Alt  Clipboard does not support Icons

Cannot open clipboard/Menu '%s' is already being used by another form

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Cannot drag a form"An error returned from DDE ($0%x)/DDE Error - conversation not established ($0%x)0Error occurred when DDE ran out of memory ($0%x)"Unable to connect DDE conversation

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

$%s not in a class registration group

Property %s does not exist

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Invalid stream format$''%s'' is not a valid component name

Invalid property element: %s

Invalid property type: %s

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Operation not supported

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value

I/O error %d

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7676.tmp (51 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_EE9DB89C3D6A328B5FEAFF0ED3C77874 (1640 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1E698CCB2C296D265AC1A253974E09FD_5ACDE65230A4C850E10D8A8B3874063D (471 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E698CCB2C296D265AC1A253974E09FD_5ACDE65230A4C850E10D8A8B3874063D (1608 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_EE9DB89C3D6A328B5FEAFF0ED3C77874 (471 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar7677.tmp (2712 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.