Trojan.Win32.FlyStudio_10c0175a85

by malwarelabrobot on June 3rd, 2016 in Malware Descriptions.

Susp_Dropper (Kaspersky), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 10c0175a85a1e84515289d70c97f1adc
SHA1: 5b883018e75c8a07f035cfa154a3e0098a8337bd
SHA256: 50facb490c757217f8ef35219fd47f1fa0a6c7fdf37181a809acf10777f95065
SSDeep: 49152:wRsQbSKp ceZiBryJ z0kPBjLMJpjqFATZxuozsEKjmDkUcUiwH5 pG0CJZZ/ABT:AsQFXeZy2J z0kKJdqFQZxdrTcCJZZIx
Size: 3069952 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2016-04-29 20:40:48
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour Description
EmailWorm Worm can send e-mails.


Process activity

The Trojan creates the following process(es):

cd.exe:1900
%original file name%.exe:1332

The Trojan injects its code into the following process(es):

ÌÚѶÄÚ²¿.exe:1936

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process cd.exe:1900 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\YDJDld4\Media\pby.exe.hsk (7386 bytes)
C:\YDJDld4\Media\seqgw290.exe (104 bytes)
%Program Files%\etauclt.exe (6395 bytes)
C:\YDJDld4\Media\etauclt.exe (6395 bytes)
C:\YDJDld4\Media\gzip.dll (30 bytes)

The process %original file name%.exe:1332 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ztj[1].htm (108 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ÌÚѶÄÚ²¿.exe (15801 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (203 bytes)
%Program Files%\Common Files\System\pzwj.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cd.exe (20507 bytes)
%Program Files%\Common Files\System\pzwj.txt (10 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2988 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416\index.dat (0 bytes)

Registry activity

The process ÌÚѶÄÚ²¿.exe:1936 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 0A 42 5D 33 BE D7 4E FC BE 79 AB C0 8B FC C0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process cd.exe:1900 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "87 73 E3 50 61 F8 83 A8 A7 56 8B D5 C7 5C 8F 6E"

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = "C:\YDJDld4\Media\seqgw290.exe"

The process %original file name%.exe:1332 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016060220160603]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016060220160603]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016060220160603\"
"CachePrefix" = ":2016060220160603:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016060220160603]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 5C CE DE A8 D8 A5 C9 3D 78 5F B8 F5 C1 8B D3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016060220160603]
"CacheLimit" = "8192"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041520140416]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5 File path
c5540fddfbd5cab971a752b82c24c60f c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\cd.exe
f42c102998cc0964ec9df60612d3e931 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ÌÚѶÄÚ²¿.exe
6ba4c0f515f7b7863be44bb13a2c1be7 c:\Program Files\etauclt.exe
6ba4c0f515f7b7863be44bb13a2c1be7 c:\YDJDld4\Media\etauclt.exe
8b3591965f623b219c0c528153746cab c:\YDJDld4\Media\gzip.dll
45ae1d3d1e2e2dd469707ade21e959b9 c:\YDJDld4\Media\seqgw290.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX0 4096 3432448 0 0 d41d8cd98f00b204e9800998ecf8427e
UPX1 3436544 2998272 2996736 5.48773 09847b0e0818b7e0acb62b6325060f87
.rsrc 6434816 16384 14336 1.44054 a43a9f2a675533ddf95f8a5410fc51a7
.rmnet 6451200 61440 57856 0.406724 0c7e414981424f0b66316275910215fb

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://www.qq5588.com/ztj.html?pan0501 183.61.164.113
hxxp://www.qb34.com/hlb.txt 23.234.14.135
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=1254180802&web_id=1254180802
hxxp://oz.cnzz.com/stat.htm?id=1254180802&r=&lg=en-us&ntime=none&cnzz_eid=622986580-1464889399-&showp=1276x846&t=&h=1&rnd=1782533034 198.11.132.200
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=1254180802&t=z
hxxp://log.gds.mmstat.com/9.gif?abc=1&rnd=1264051581
hxxp://s11.cnzz.com/stat.php?id=1254180802&web_id=1254180802 1.99.192.16
hxxp://c.cnzz.com/core.php?web_id=1254180802&t=z 195.59.70.248
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1264051581 140.205.99.5
pcookie.cnzz.com


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0

Traffic

GET /ztj.html?pan0501 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qq5588.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 02 Jun 2016 19:22:43 GMT
Server: Apache
Last-Modified: Mon, 14 Sep 2015 05:47:25 GMT
ETag: "6c-51fae9994f540"
Accept-Ranges: bytes
Content-Length: 108
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
<script src="hXXp://s11.cnzz.com/stat.php?id=1254180802&web_id=1254
180802" language="JavaScript"></script>..HTTP/1.1 200 OK..Dat
e: Thu, 02 Jun 2016 19:22:43 GMT..Server: Apache..Last-Modified: Mon, 
14 Sep 2015 05:47:25 GMT..ETag: "6c-51fae9994f540"..Accept-Ranges: byt
es..Content-Length: 108..Keep-Alive: timeout=5, max=100..Connection: K
eep-Alive..Content-Type: text/html..<script src="hXXp://s11.cnzz.co
m/stat.php?id=1254180802&web_id=1254180802" language="JavaScript">&
lt;/script>....



GET /hlb.txt HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: VVV.qb34.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 02 Jun 2016 19:00:15 GMT
Content-Length: 11
Content-Type: text/plain
Content-Location: hXXp://VVV.qb34.com/hlb.txt
Last-Modified: Mon, 30 May 2016 14:24:08 GMT
Accept-Ranges: bytes
ETag: "668bc8ed7ebad11:1729"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
99Lover.exeHTTP/1.1 200 OK..Date: Thu, 02 Jun 2016 19:00:15 GMT..Conte
nt-Length: 11..Content-Type: text/plain..Content-Location: hXXp://VVV.
qb34.com/hlb.txt..Last-Modified: Mon, 30 May 2016 14:24:08 GMT..Accept
-Ranges: bytes..ETag: "668bc8ed7ebad11:1729"..Server: Microsoft-IIS/6.
0..X-Powered-By: ASP.NET..99Lover.exe..



GET /core.php?web_id=1254180802&t=z HTTP/1.1
Accept: */*
Referer: hXXp://VVV.qq5588.com/ztj.html?pan0501
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 764
Connection: keep-alive
Date: Thu, 02 Jun 2016 19:00:25 GMT
Last-Modified: Thu, 02 Jun 2016 19:00:25 GMT
Expires: Thu, 02 Jun 2016 19:15:25 GMT
Via: cache10.l2de1[301,200-0,M], cache63.l2de1[301,0], cache8.uk1[316,200-0,M], cache10.uk1[317,0]
X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2
X-Swift-SaveTime: Thu, 02 Jun 2016 19:00:25 GMT
X-Swift-CacheTime: 900
Timing-Allow-Origin: *
EagleId: c33b46d214648940251515662e
!function(){var p,q,r,a=encodeURIComponent,b="1254180802",c="",d="",e=
"online_v3.php",f="z13.cnzz.com",g="1",h="text",i="z",j="站ž
71;统计",k=window["_CNZZDbridge_" b]["bobject"],l="http:",
m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h
=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&
&k["callRequest"]([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k["c
reateScriptIcon"](n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/websi
te.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cn
zz.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "
'><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p=
"<a href='" q "' target=_blank title='" j "'>" j "</a>",k[
"createIcon"]([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type
: application/javascript..Content-Length: 764..Connection: keep-alive.
.Date: Thu, 02 Jun 2016 19:00:25 GMT..Last-Modified: Thu, 02 Jun 2016 
19:00:25 GMT..Expires: Thu, 02 Jun 2016 19:15:25 GMT..Via: cache10.l2d
e1[301,200-0,M], cache63.l2de1[301,0], cache8.uk1[316,200-0,M], cache1
0.uk1[317,0]..X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2..X-Swift-SaveT
ime: Thu, 02 Jun 2016 19:00:25 GMT..X-Swift-CacheTime: 900..Timing-All
ow-Origin: *..EagleId: c33b46d214648940251515662e..!function(){var p,q
,r,a=encodeURIComponent,b="1254180802",c="",d="",e="online_v3.php",f="
z13.cnzz.com",g="1",h="text",i="z",j="站长统计
",k=window["_CNZZDbridge_" b]["bobject"],l="http:",m="0",n=l "//on
<<< skipped >>>


GET /9.gif?abc=1&rnd=1264051581 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.qq5588.com/ztj.html?pan0501
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Server: Tengine
Date: Thu, 02 Jun 2016 19:00:26 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=SnDXDwRBEB8CAcLyYNpHhFqD; expires=Sun, 31-May-26 19:00:26 GMT; path=/; domain=.mmstat.com
Set-Cookie: sca=bfc42078; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=45baa14eb87f1be02bb95d26_1464894026; expires=Sun, 31-May-26 19:00:26 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=SnDXDwRBEB8CAcLyYNpHhFqD
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..



GET /stat.htm?id=1254180802&r=&lg=en-us&ntime=none&cnzz_eid=622986580-1464889399-&showp=1276x846&t=&h=1&rnd=1782533034 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.qq5588.com/ztj.html?pan0501
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: oz.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine/1.4.6
Date: Thu, 02 Jun 2016 19:00:25 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..



GET /stat.php?id=1254180802&web_id=1254180802 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.qq5588.com/ztj.html?pan0501
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s11.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 9941
Connection: keep-alive
Date: Thu, 02 Jun 2016 17:43:19 GMT
Last-Modified: Thu, 02 Jun 2016 17:43:19 GMT
Cache-Control: max-age=5400,s-maxage=5400
Via: cache46.l2de1[0,200-0,H], cache23.l2de1[0,0], cache8.uk1[0,200-0,H], cache8.uk1[0,0]
Age: 4625
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Thu, 02 Jun 2016 17:58:38 GMT
X-Swift-CacheTime: 4481
Timing-Allow-Origin: *
EagleId: c33b46d014648940246141741e
(function(){function k(){this.c="1254180802";this.R="z";this.N="";this
.K="";this.M="";this.r="1464889399";this.P="oz.cnzz.com";this.L="";thi
s.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" 
this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la(
)}function g(a,b){try{var c=.[];c.push("siteid=1254180802");c.push("na
me=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer))
;c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.user
Agent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.ra
ndom()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}
catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURICom
ponent,n=unescape;k.prototype={la:function(){try{this.U(),this.J(),thi
s.ia(),this.H(),this.o(),this.ga(),.this.fa(),this.ja(),this.j(),this.
ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.pa(),e[thi
s.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},na:f
unction(){try{var a=this;e._czc={push:function(){return a.B.apply(a,ar
guments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;
if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b 
 ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object S
tring]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAu
toPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch
(d){g(d,"cS failed")}},pa:function(){try{if("undefined"===typeof e._cz
_account||e._cz_account===this.c){e._cz_account=this.c;if("[object
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

ÌÚѶÄÚ²¿.exe_1936:

.text
`.rdata
@.data
.rsrc
t$(SSh
~%UVW
u.hpXd
u$SShe
wininet.dll
shlwapi.dll
kernel32.dll
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
GetWindowsDirectoryA
hXXp://VVV.qb34.com/hlb/
%S4WD
hg%fpM
S.Ac9SR
0.I%3s
,wAe.kI
aiUy'4xu
%c*@j
.eH'y
{&%U)
lj%4U
xe%CNs
9F.cLe
hJK.ZH
O.qt0
KERNEL32.DLL
COMCTL32.dll
GDI32.dll
MSIMG32.dll
MSVCRT.dll
MSVFW32.dll
USER32.dll
SkinH_EL.dll
?hXXp://VVV.qb34.com/hlb.txt
k%UPp
fg.VG
%C',@
>Ùd
wEBX
.qpTT
B>U%f
.iqW>
"3/%F
5r.US
:mD].tB
!.qn%
X].XMgW
.dq?]
L.qg6
&get_nick=1&_=
hXXp://r.pengyou.com/fcg-bin/cgi_get_portrait.fcg?uins=
&spec=100&url_enc=0&referer=bu_interface&term_type=PC
hXXp://q2.qlogo.cn/headimg_dl?bs=
1970-01-01 08:00:00
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
http=
https
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
hXXps://
hXXp://
hXXp://VVV.qb34.com/txnb.txt
X.cc=
e%ct[
.bM:p
FTù1
HT.FU
z===.UMW].
c:\1.png
hXXp://VVV.2345.com/?k1742288
%Program Files%\Internet Explorer\IEXPLORE.EXE
"f$E&_%C$
$\&.'>(<(
"s%f'
H%u0)-
wshom.ocx
SHELL32.dll,4
WindowStyle
Hotkey
dbghelp.dll
MsgWaitForMultipleObjects
hXXp://222.186.129.19/replay_18_22697
hXXp://222.186.129.19
C:\tmp\
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
%d&&'
123456789
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
__MSVCRT_HEAP_SELECT
Broken pipe
Inappropriate I/O control operation
Operation not permitted
user32.dll
GetProcessHeap
WinExec
KERNEL32.dll
GetKeyState
GetViewportOrgEx
WINMM.dll
WINSPOOL.DRV
RegCloseKey
RegOpenKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
WS2_32.dll
GetCPInfo
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetWindowsHookExA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
comdlg32.dll
RegCreateKeyExA
.PAVCException@@
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
.PAVCFileException@@
: %d]
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
.PAVCNotSupportedException@@
out.prn
(*.prn)|*.prn|
%d.%d
%d/%d
1.6.9
unsupported zlib version
png_read_image: unsupported transformation
%d / %d
Bogus message code %d
libpng error: %s
libpng warning: %s
1.1.3
bad keyword
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
(%d-%d):
%ld%c
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
#include "l.chs\afxres.rc" // Standard components
C:\fff.exe
C:\\fff.exe
@.vmp0
`.vmp1
.reloc
&>.0 8(4
$<,1!9)5
$=-7'?/ 
*08 (6>&
)7?'/5=%
4:8><" &
p.sVwy
Xj%F 
?|>%F
?Ww
E.LjH
.SG,\
%xK*Uxg
%dKa^f
JD.ggY
P'.zP
c#{%cv
^.QpN
.sR10
< .XV
.seHU
.YB'nM
}8%cMl
9cMD`
%Wg6%dzp
%x 11
8,.<&*:-
hfRlbFJ.Xrrp
z.nI:)
zOLEAUT32.dll
C:\qq.exe
C:\\qq.exe
VVV.qb123456.cc.
99Lover.exe
pay.qq.com
(7),01444
'9=82<.342
1.2.18
MSWHEEL_ROLLMSG
AVIFIL32.dll
RASAPI32.dll
iphlpapi.dll
SHLWAPI.dll
MPR.dll
VERSION.dll
RegCreateKeyA
oledlg.dll
InternetCrackUrlA
InternetCanonicalizeUrlA
WININET.dll
(*.htm;*.html)|*.htm;*.html
(*.avi)|*.avi
WPFT532.CNV
WPFT632.CNV
EXCEL32.CNV
write32.wpc
Windows Write
mswrd632.wpc
Word for Windows 6.0
wword5.cnv
Word for Windows 5.0
mswrd832.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
html32.cnv
operator
keywords
KeyJOYBUTN12
KeyJOYBUTN11
KeyJOYBUTN10
KeyNUMKEYS
KeyJOYBUTN9
KeyJOYBUTN8
KeyJOYBUTN7
KeyJOYBUTN6
KeyJOYBUTN5
KeyJOYBUTN4
KeyJOYBUTN3
KeyJOYBUTN2
KeyJOYBUTN1
KeyJOYBUTN0
KeyMOUSEBUTN4
KeyMOUSEMIDDLE
KeyMOUSERIGHT
KeyMOUSELEFT
KeyPAUSE
KeyPRINTSCRN
KeySCROLLLOCK
KeyCAPSLOCK
KeyNUMLOCK
KeyNUM9
KeyNUM8
KeyNUM7
KeyNUM6
KeyNUM5
KeyNUM4
KeyNUM3
KeyNUM2
KeyNUM1
KeyNUM0
KeyNUMPERIOD
KeyNUMENTER
KeyNUMPLUS
KeyNUMMINUS
KeyNUMSTAR
KeyNUMSLASH
KeyPGDN
KeyPGUP
KeyEND
KeyHOME
KeyDEL
KeyINS
KeyF12
KeyF11
KeyF10
KeyF9
KeyF8
KeyF7
KeyF6
KeyF5
KeyF4
KeyF3
KeyF2
KeyF1
KeyDOWNARROW
KeyUPARROW
KeyRIGHTARROW
KeyLEFTARROW
KeyRIGHTALT
KeyLEFTALT
KeyRIGHTCTRL
KeyLEFTCTRL
KeyRIGHTSHIFT
KeyLEFTSHIFT
KeyDELETE
KeyTILDA
KeyRCURLY
KeyPIPE
KeyLCURLY
KeyZ
KeyX
KeyW
KeyV
KeyU
KeyT
KeyS
KeyR
KeyQ
KeyP
KeyO
KeyN
KeyM
KeyL
KeyK
KeyJ
KeyI
KeyH
KeyG
KeyF
KeyE
KeyD
KeyC
KeyB
KeyA
KeyGRAVE
KeyUNDERSCORE
KeyCARETE
KeyRBRACKET
KeyBACKSLASH
KeyLBRACKET
KeyCZ
KeyCY
KeyCX
KeyCW
KeyCV
KeyCU
KeyCT
KeyCS
KeyCR
KeyCQ
KeyCP
KeyCO
KeyCN
KeyCM
KeyCL
KeyCK
KeyCJ
KeyCI
KeyCH
KeyCG
KeyCF
KeyCE
KeyCD
KeyCC
KeyCB
KeyCA
KeyAT
KeyQMARK
KeyGREATERTHEN
KeyEQUALS
KeyLESSTHEN
KeySEMICOLON
KeyCOLON
KeySLASH
KeyPERIOD
KeyDASH
KeyCOMMA
KeyPLUS
KeyASTERISC
KeyRBRACE
KeyLBRACE
KeyAMPERSAND
KeyPERCENT
KeyDOLLAR
KeyPOUND
KeyDQUOTE
KeyBANG
KeySPACE
KeyESCAPE
KeyENTER
KeyTAB
KeyBACKSPACE
\d3drm.dll
\dplayx.dll
\dsound.dll
\dinput.dll
\ddraw.dll
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
.PAVCOleException@@
.PAVCOleDispatchException@@
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
1, 0, 6, 6
- Skin.dll
"$,22761(030&
 /7-,-%,11.&#
*1531-(%$
,)'.-.))
(*.*)

ÌÚѶÄÚ²¿.exe_1936_rwx_10000000_0003E000:

`.rsrc
L$(h%f
SSh0j
msctls_hotkey32
TVCLHotKey
THotKey
\skinh.she
}uo,x6l5k%x-l h
9p%s m)t4`#b
e"m?c&y1`Ð<
SetViewportOrgEx
SetViewportExtEx
SetWindowsHookExA
UnhookWindowsHookEx
EnumThreadWindows
EnumChildWindows
`c%US.4/
!#$<#$#=
.text
`.rdata
@.data
.rsrc
@.UPX0
`.UPX1
`.reloc
hJK.ZH
O.qt0
KERNEL32.DLL
COMCTL32.dll
GDI32.dll
MSIMG32.dll
MSVCRT.dll
MSVFW32.dll
USER32.dll
SkinH_EL.dll
1, 0, 6, 6
- Skin.dll


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    cd.exe:1900
    %original file name%.exe:1332

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\YDJDld4\Media\pby.exe.hsk (7386 bytes)
    C:\YDJDld4\Media\seqgw290.exe (104 bytes)
    %Program Files%\etauclt.exe (6395 bytes)
    C:\YDJDld4\Media\etauclt.exe (6395 bytes)
    C:\YDJDld4\Media\gzip.dll (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ztj[1].htm (108 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].php (764 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ÌÚѶÄÚ²¿.exe (15801 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (203 bytes)
    %Program Files%\Common Files\System\pzwj.ini (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (208 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\cd.exe (20507 bytes)
    %Program Files%\Common Files\System\pzwj.txt (10 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (2988 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT (96 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].php (1177 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now