Trojan.Win32.FlyStudio_07ddf208c8
Gen:Variant.Graftor.98820 (B) (Emsisoft), Gen:Variant.Graftor.98820 (AdAware), GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
MD5: 07ddf208c880aceb3cea9c240e021f29
SHA1: d1d3fb9cf752f7470dc19c265b934573f347c147
SHA256: 201f3dca763d5a28e823ebae33e3d46477ba340ad6d90e6362c594aefc332248
SSDeep: 12288:Q6tmipTMyZnOanKLU20H9tNmHgnsxsbA935t2cthV116M9UNY3jh2:Q6MHDUr9tNmAs68tXX59N3j
Size: 687616 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: MyApps
Created at: 2014-04-12 15:30:35
Analyzed on: WindowsXP SP3 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):
%original file name%.exe:3532
File activity
The process %original file name%.exe:3532 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\DLL.dll (320 bytes)
Registry activity
The process %original file name%.exe:3532 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 13 F7 BB 77 D1 77 BD CA 37 F9 89 C6 F4 D2 71"
[HKCU\Software\Super-EC\½ûÖ¹Öظ´Ãâ€Ãƒâ€¹ÃƒÂÃÂ]
"(Default)" = "0"
Dropped PE files
| MD5 | File path |
|---|---|
| 3f456fad5e06ca2c35ae7bcf3fb825ad | c:\DLL.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
VersionInfo
Company Name:
Product Name: ?????
Product Version: 1.0.0.1
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.1
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: English (United States)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| UPX0 | 4096 | 577536 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| UPX1 | 581632 | 630784 | 630784 | 5.45159 | b03687dad0c3247692a8b3f336b2dce3 |
| .rsrc | 1212416 | 57344 | 55808 | 4.89946 | c7aaaf3cedb7c9aff0f3d5e3e8a92ed5 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Web Traffic was not found.
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\DLL.dll (320 bytes)
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
