MD5: 266738909a7449390a651292b97664f8
SHA1: 947c4ad935963fda08e56a212925a66501d94242
SHA256: bcfdccceec9311ea335cd87ce62187610cc5bb14d663d73ddf67f4d8a423384e
SSDeep: 49152:wsgOoi826d5niiIZt1IGVWMGagpOiU1zH0nfE:1gOoiylZObI6WMGLpOiU9SfE
Size: 2043904 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-06-04 10:45:44
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:1132

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1132 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\kss.ini (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B4.tmp (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\desktop.ini (67 bytes)
%System%\drivers\etc\hosts2 (2607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\api[1].htm (188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B2.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B3.tmp (3361 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\B2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B4.tmp (0 bytes)
%System%\drivers\etc\hosts_bak (0 bytes)

Registry activity

The process %original file name%.exe:1132 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\157321\½ûÖ¹Öظ´ÔËÐÐ]
"µÄ·¢¸öµØ·½µÄ·ç¸ñµØ·½" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 15 F1 2F 16 56 38 7F 31 B0 94 49 2D 95 ED 48"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 935 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

@.vmp0

`.tls

.vmp1

.reloc

y$\Nr

z/z.AC

s$tcp

.mN}"

.sh!M4

r".qG

>J.vc d

w"%fX

.iN0!o

t%SVh

t$(SSh

~%UVW

u$SShe

kernel32.dll

Kernel32.dll

ntdll.dll

user32.dll

Shlwapi.dll

advapi32.dll

ole32.dll

MsgWaitForMultipleObjects

CreateWindowStationA

CloseWindowStation

RegOpenKeyA

RegEnumKeyA

RegCloseKey

RegOpenKeyExA

gdi32.dll

1234wg.com

789pan.com

338mu.com

c:\kss.ini

password

123.com

0.0.0.0

0.0.0.0 www.

0.0.0.0 bbs.

1970-1-1 00:00:01

MSXML2.XMLHTTP

Microsoft.XMLHTTP

Can't create XMLHTTP connection object

Mozilla/4.0 (compatible; MSiE 6.0; Windows NT 5.1;)

application/x-www-form-urlencoded

errmsg_s

x.yvr

x.yvkd

\.pL.

Windows

0,8999($

.SCK_LINES/9

.jJ^\

.ERZDLL$

%fLH^A

n.ef"

g%s_%d

=.Xh"

.Hjsp"

ANSI_CHARSE.Dc

O7E(AL("%s

KeywnF

.cu%t

\-ú

.NDFR8P

 Ix.Lv?h]#

keysK<

A.DHq*-

8X%Fx

L.@%u

.QunW

.da]o

.PP` 

.pas8

6.Pob

oOV?.DD@

.ChS-v

#yfP.re

KERNEL32.DLL

comctl32.dll

oleaut32.dll

version.dll

wsock32.dll

rsadll.dll

\update.exe

00222222

crossfire.exe

Az.Cl

%dTr,

!.YK;

Bq.Uz"

.Wqi0<-

keyh-%x#

keyh-%x#*

*M.wH

.Gdp>J-$

o.KVA

7'.tv

YBYeXe

),%SIZ

o*i.pMUN

J~.AIf

t2.qn

m!*

w%sMpcb

jU.wg

eðw

1Rn(.cX

K.Jv%

Le%xV

ßs1

\e%Xf

D~ZqD.oK

bq.Vg

*MÒ9

.iTF.

%XRB^

R-Rp}*

%U//F

.iyc[

BI%X4

{n.JN

0.ijb

".OMd]

1~-.zPW7

T%;%X

u.sH*

O%S:y

O%SZH"

r.viJS

@5%f-

%cZE,s%

.uA@B

K.Ygd

NiH_%c

6U.xeIV

%c-F!

g.CN)\W

.OsFe

aE<.kt

q:\;6l

{.yIy*

T.ZD
tL}Û
-4Ô
|2|f.pu9^F
%D &#
&^&%s
^ks%D
Xu.jU
;jÔD
3t%Dt
Y.%D@
.juxu
:|:czkey:|:
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\
ServiceName\\.\
cmd.exe /c del
ws2_32.dll
F%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
__MSVCRT_HEAP_SELECT
iphlpapi.dll
SHLWAPI.dll
MPR.dll
VERSION.dll
WSOCK32.dll
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.*)|*.*||
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
%d.%d
%d / %d
%d/%d
Bogus message code %d
(%d-%d):
%ld%c
www.dywt.com.cn
1.1.3
;3 #>6.&
'2, / 0&7!4-)1#
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
0.0.0.0 bbs.338mu.com
acme.com # x client host
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
ghZÊoA
>.mYm
-%uhr
C.vFb
g9.Gf>US
Tb.WNtU
Mc;.Vg7
x9.@c7
k^?q.sLuj2
~;.aW
Wo.Vf
R}.DNp
%Uy'Tj.
zÂC
%XuoN
0z.Km
%u0sht
.Rxng
.tBCvA
.qb-0
A]%U)%
mt.qFM
x%SM.]
tcpZ
/%SX^
.iOcIo
2C{l%U
vlZ%UT
m.tB8&_&
,1`%ud
.iUV#
K8!.AD
f.epj
V.gnbq@?kv
jo.sI
4%s3:
K".Uah5
--j}2?
XIÊ
GDI32.dll
OffsetViewportOrgEx
WINMM.dll
GetProcessHeap
SetWindowsHookExA
RegCreateKeyA
CreateDialogIndirectParamA
WININET.dll
GetViewportOrgEx
USER32.dll
The ordinal %u could not be located in the dynamic link library %s
KERNEL32.dll
GetKeyState
m%xL:
5.FzC
.IXDe
of\%D
O.We]{
|G.oG
.sX.J9
To.FKe
4k.Fy
qftp
m.osP
R;Ftp
}04.Ts
A}.ht
A e.iN
>Z.qi
@y5%S(
.eb>~
TC%FIp
.uf,|
{0\.UB
LX.mP
f3.kc]?
k.mo&? 
[8.lz
`.wLor
L.Htz
L.SDz
8.By-B
%X8~q
2%D]K
%X"7&
so.oG
Oc%xr
Ey.SzN
L.iYB
e Nx.LX
.po$A
e.Zg8
,z%U@
2L%c|
WinExec
OLEAUT32.dll
ScaleViewportExtEx
ADVAPI32.dll
SetViewportOrgEx
comdlg32.dll
COMCTL32.dll
SetViewportExtEx
%X-!.o
ShellExecuteA
WINSPOOL.DRV
GetCPInfo
!HW"SHELL32.dll
RegCreateKeyExA
WS2_32.dll
RegDeleteKeyA
89p%S
c.JDL;N
GB&.suq&
%x*8&
n.hl7
o*.Vq
j{-n}
t%d>P
t%sxXD
LX%sG
W.k.gT
{_.Tu
>m.Tn
wMUc>%S
%ny_x.kZ
(.fT7r
Tm.bR
yR-zu}
Z%xo_-
%Di0O
.UMa$}
msg{/
RASAPI32.dll
UnhookWindowsHookEx
%'.nxm
^S7.Qy
.xv6r
o.Oy@
$pK%f
E7.nr
C`?%S
;l6.oI<
T.YVQ'
/.Iy8
0%Skx[2!
.qO9c
"'.XS
u.RSC
'.BpA
=w.Dk
p(.qB
.GU4K
~a.Ku
-yv}7
T.gV%?
8J.Rg=
}.Kwf
b/.DJq
aio%F
.oBng
8'.ek
%s:_f
.Oc!0i
@%SPg
FVf.hJv%q
G.DLS
w.EHr
GetViewportExtEx
The procedure entry point %s could not be located in the dynamic link library %s
.uG]C$_
.imoZ
(*.*)

%original file name%.exe_1132_rwx_0078D000_00003000:


WinExec
OLEAUT32.dll
ScaleViewportExtEx
ADVAPI32.dll
SetViewportOrgEx
comdlg32.dll
COMCTL32.dll
SetViewportExtEx

%original file name%.exe_1132_rwx_0087A000_00001000:


GetViewportExtEx
The procedure entry point %s could not be located in the dynamic link library %s
RegOpenKeyExA

%original file name%.exe_1132_rwx_00E00000_00072000:


`.rsrc
kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
USER32.DLL
oleaut32.dll
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
u%CNu
%s_%d
EInvalidGraphicOperation
comctl32.dll
uxtheme.dll
MAPI32.DLL
!"#$%xi
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview
WindowState
OnKeyDown
OnKeyPressl
OnKeyUp
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
AutoHotkeys
TMainMenuDp
TKeyEvent
TKeyPressEvent
HelpKeyword,
crSQLWait
%s (%s)
imm32.dll
readnowid.mtx
D:\ksreg_delphi\V9\_rsa_delphi_dll\UnitSock.pas
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
KWindows
UrlMon
GetCPInfo
RegOpenKeyExA
RegCloseKey
SetViewportOrgEx
UnhookWindowsHookEx
SetWindowsHookExA
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
GetKeyboardType
38000=344
.idata
.edata
P.reloc
P.rsrc
#yfP.re
KERNEL32.DLL
advapi32.dll
gdi32.dll
user32.dll
version.dll
wsock32.dll
rsadll.dll
No help keyword specified.
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Alt  Clipboard does not support Icons/Menu '%s' is already being used by another form
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Unsupported clipboard format
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
I/O error %d
Integer overflow Invalid floating point operation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\kss.ini (164 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\B4.tmp (1425 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\desktop.ini (67 bytes)
   %System%\drivers\etc\hosts2 (2607 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\api[1].htm (188 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\B2.tmp (4545 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\B3.tmp (3361 bytes)

4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.