MD5: ebcfd0480d8651347e048445052aaec9
SHA1: 72f0b09b0e070e7eb4b6061aac2f5648e3723ada
SHA256: a6cb55bfd742f5e67f993b9f7629c4cc2471b0b60760272cd3e71ac93ffae584
SSDeep: 49152:75UARHY5Ksqldqt45rbSo4/ZnAILCJPIzRcRgvKsid8hvET8oz3vLJwus4on qN5:w
Size: 17387520 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2011-01-23 00:20:12
Analyzed on: WindowsXP SP3 32-bit

Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

Process activity

The Worm creates the following process(es):

PDFill.exe:1368
%original file name%.exe:844
MsiExec.exe:1956
vkZtkbozih.exe:1104

The Worm injects its code into the following process(es):

vbc.exe:1056

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process PDFill.exe:1368 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_Excel.dll (79 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\WriterSave.exe (1795 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\DownloadandInstall.exe (79 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_Word.dll (79 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPSCRIPT.HLP (26 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPSCRIPT.NTF (5442 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPSCRIPT5.DLL (1824 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceam.tlx (7 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\wspell.ocx (180 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\Wspelldlg.GID (8 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\correct.tlx (21 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.ico (3 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPSCRIPT.HLP (26 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\WriterSave.chm (64 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\userdic.tlx (89 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPS5UI.DLL (3801 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceam2.clx (327 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\decoder.dll (1738 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillWriterMon32.dll (26 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill_PDF_Tools.exe (24 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPSCRIPT5.DLL (3701 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPS5UI.DLL (3923 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillWriterMon64.dll (30 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PSCRIPT5.jar (25429 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\sscebr.tlx (7 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPSCRIPT.NTF (5442 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\cimage.dll (3851 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.x64.msi (6 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.mst (290 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceca.tlx (7 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill_license.rtf (10 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFWrite.rsp (133 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.exe (7972 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.msi (6 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\DownloadPDF.exe (170 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\accent.tlx (2 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\mfc70u.dll (6405 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFillWriter.PPD (25 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\msvcr70.dll (1625 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\tech.tlx (3 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_PowerPoint.dll (79 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\pdf2image.dll (22433 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceca2.clx (1609 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFillZip.exe (75 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\sscebr2.clx (1611 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\DynamicTwainCtrl.dll (294 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\Wspelldlg.hlp (18 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\CommandBars1300vc70U.dll (7972 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\WriterSetup.exe (57 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.chm (275 bytes)

The process %original file name%.exe:844 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\8.0.0.0\vkZtkbozih.exe (96836 bytes)

The process vkZtkbozih.exe:1104 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PDFill.exe (70225 bytes)
%Documents and Settings%\%current user%\Application Data\HBTDZJTZVhyNVWfDxbdK\HBTDZJTZVhyNVWfDxbdK\0.0.0.0\vkZtkbozih.exe (98579 bytes)
%Documents and Settings%\All Users\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\8.0.0.0\cic.dll (16 bytes)
%Documents and Settings%\%current user%\Application Data\HBTDZJTZVhyNVWfDxbdK\HBTDZJTZVhyNVWfDxbdK\0.0.0.0\cic.dll (16 bytes)

The process vbc.exe:1056 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\data.dat (37 bytes)
%Documents and Settings%\%current user%\Application Data\host.exe (3860 bytes)

Registry activity

The process PDFill.exe:1368 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E 1A 34 3C C8 C3 EE BF AC C4 6F 54 27 3D 2B 06"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process %original file name%.exe:844 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 A4 E2 2C 61 87 F0 F8 23 43 79 ED EE FA B3 5B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\All Users\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\8.0.0.0]
"vkZtkbozih.exe" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process MsiExec.exe:1956 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 96 BE 25 DF 01 C3 9B FD B2 A8 17 D1 EE 51 42"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process vkZtkbozih.exe:1104 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 02 22 77 D7 7B CF 54 57 21 F3 62 43 22 F8 0F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"PDFill.exe" = "Create, Edit, Save PDF; Edit PDF file without Adobe Acrobat"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"vkZtkbozih.exe" = "%Documents and Settings%\%current user%\Application Data\HBTDZJTZVhyNVWfDxbdK\HBTDZJTZVhyNVWfDxbdK\0.0.0.0\vkZtkbozih.exe"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process vbc.exe:1056 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 43 F2 67 83 8D CC C0 DF C3 C3 3D 20 92 7B D6"

[HKCU\Software\VB and VBA Program Settings\INSTALL\DATE]
"Q5VSR2B9A4" = "June 28, 2014"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\VB and VBA Program Settings\SrvID\ID]
"Q5VSR2B9A4" = "1/20/11-1:27-angel"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name: PlotSoft LLC
Product Name: PDFill PDF Editor with FREE Writer and FREE Tools
Product Version: 8.0.0.0
Legal Copyright: Copyright (C) PlotSoft LLC
Legal Trademarks:
Original Filename: PDFill.exe
Internal Name: PDFill.exe
File Version: 8.0.0.0
File Description: PDFill.exe
Comments: Create, Edit, Save PDF; Edit PDF file without Adobe Acrobat
Language: English (United Kingdom)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://crl.usertrust.com/UTN-USERFirst-Object.crl	178.255.83.2

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /UTN-USERFirst-Object.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.usertrust.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 28 Jun 2014 05:57:31 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 75433

Last-Modified: Fri, 27 Jun 2014 16:46:01 GMT

Connection: close

X-CCACDN-Mirror-ID: t8edcacrl4

Accept-Ranges: bytes
0..&.0..%....0...*.H........0..1.0...U....US1.0...U....UT1.0...U....Sa
lt Lake City1.0...U....The USERTRUST Network1!0...U....hXXp://VVV.user
trust.com1.0...U....UTN-USERFirst-Object..140627164601Z..140701164601Z
0..$.0"....2EY..aU..........050525083740Z0".....Iv...h ..ys.....050525
090148Z0!..u.......|..xk.0...050602000000Z0".....6.z..........7..05060
2075356Z0"....!.$.KM(C@="..o}..050603153950Z0".......W%Ny.vD.q..Y..050
607084159Z0".......3W]...$.#\F4..050613095931Z0!......(.62..2PLr.q..05
0630164737Z0"....BLA......)..5....050707141212Z0!..Wa........q#......0
50711082844Z0!.._j.....o...'...m..050715130339Z0!..?........N]B..Z...0
50721083234Z0!..RO.)@..Q...p._....050726090436Z0".....k......1.g......
050729091017Z0"....l........o... ...050729134103Z0"....v.R..~...?.(..&
..050803165854Z0!..6..;....sC.M.s:...050809135135Z0!...........^nH.U.(
..050810132024Z0"......;.S...wU-K.c...050810211644Z0"......d..#IE..#|.
g#..050811182050Z0"....!..|....]rR..-r..050817085053Z0"......Ai..xJ..q
]Xi...050822140450Z0!..>...........t'6...050824025640Z0!..?3..rd5&g
t;ocV.. ....050824075512Z0"....|..5u[.}<..[[email protected]!..GJ
.C...<NM.i......050912092806Z0!....(.8....U.1.'....050912144650Z0!.
.*.(ECy.V.?x.3S_k..050915103419Z0!......./.....L...r..050919144257Z0!.
.Y....=....#.......050929000000Z0!..p.,.g.x..z:q~.....050930114111Z0".
...-.."...\w...~....050930123007Z0!....o0........P.H...051004084832Z0"
.......=6......4.....051005122403Z0!..md\\...~.v.o......051013100954Z0
!...6.D...hR..BO._...051013110610Z0!..5.x.1..6.p~}>.....0510181
<<< skipped >>>

The Worm connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

9/t%S3

Ht~Ht^Ht:Ht.Ht"H

8%u2P

WININET.dll

msi.dll

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

FtpGetFileSize

FtpCommandA

wininet.dll

REST %u

Range: bytes=%u-

HTTP/1.0

FTP Server

.part

/exelang

/exebasicui

/exenoui

comctl32.dll

%d.%d %s

%d.0%d %s

%d %s

\StringFileInfo\xx\%s

%d.%d.%d.%d

Shell32.dll

Shlwapi.dll

\explorer.exe

\/:*?"<>|

%d-%s

kernel32.dll

%d.dll

shfolder.dll

SETUPEXEDIR

WindowsVolume

WindowsFolder

SearchCmdLine

Operator

SQLCompact

SQLExpress

MainAppURL

MainAppCmdLine

URL=%s

/n %s

TRANSFORMS=:%s.mst MSINEWINSTANCE=1

{FAB10E66-B22C-4274-8647-7CA1BA5EF30F}

http://www.example.com

http://www.yahoo.com

http://www.google.com

[SystemFolder]inetsrv\w3wp.exe

[SystemFolder]inetsrv\inetinfo.exe

[SystemFolder]wininet.dll

Windows Mobile Device Center 6.1

Windows Mobile Device Center 6.0

HKLM\SOFTWARE\Microsoft\Windows CE Services\MinorVersion

HKLM\SOFTWARE\Microsoft\Windows CE Services\MajorVersion

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CEAPPMGR.EXE\

HKLM\Software\Microsoft\VSTO Runtime Setup\v9.0.21022\Install

HKLM\Software\Microsoft\vsto runtime Setup\v2.0.50727\Install

{957A4EC0-E67B-4E86-A383-6AF7270B216A}

{53C65973-D89D-4EA0-8567-8788C14E0A02}

{A58B51D1-89BF-4D88-939D-B6D0DB2EEB53}

{835AC3CE-E36B-4D65-B50F-2863A682ABEE}

{1C8772BD-6E6F-4C9D-8FF8-B5EA072F86EF}

{6F1AE751-4D8A-4B25-AC0A-C6CB912A9791}

{3F40FA9E-26CA-4CA2-93C9-603622349915}

{14D3E42A-A318-4D77-9895-A7EE585EFC3B}

{C1E59364-35F6-44B3-AF0F-FCA934C4B252}

{A1FE0698-609D-400F-BF10-F52238DD6475}

6.01.7000.0000

6.00.6000.16386

4.09.00.0903

4.09.00.0902

4.09.00.0901

4.09.00.0900

4.08.02.0134

4.08.01.0901

4.08.01.0810

4.08.00.0400

4.07.01.3000

4.07.00.0716

4.07.00.0700

SQL Server Compact 3.5 SP1

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Compact Edition\v3.5\ENU\DesktopRuntimeServicePackLevel

SQL Server Compact 3.5

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Compact Edition\v3.5\ENU\DesktopRuntimeVersion

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\SQLSERVER2008\MSSQLServer\CurrentVersion\CurrentVersion

SQL Server Express 2008

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\SQLEXPRESS\MSSQLServer\CurrentVersion\CurrentVersion

9.00.4035

SQL Server Express 2005 SP3

9.00.3042

SQL Server Express 2005 SP2

9.00.2047

SQL Server Express 2005 SP1

SQL Server Express 2005

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\90\Tools\ClientSetup\CurrentVersion\CurrentVersion

HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727\Install

HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322\Install

3321-3705

HKLM\SOFTWARE\Microsoft\.NETFramework\policy\v1.0\3705

SELECT `Value` FROM `Property` WHERE `Property` = '%s'

[SystemFolder]msi.dll

\\.\pipe\ToServer

Software\Microsoft\Windows\CurrentVersion\Run

mstask.exe

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

RICHED20.DLL

ATTRIB -r "%s"

del "%s"

if exist "%s" goto try

del "%s" | cls

rd "%s"

[SystemFolder]msiexec.exe

%s AI_SETUPEXEPATH="%s" SETUPEXEDIR="%s"

TRANSFORMS="%s"

TRANSFORMS="%s;%s\%d"

TRANSFORMS=":%d"

"%s" /OriginalPath:"%s"%s

.eui.exe

unpack200.exe

--verbose --log-file="%s" --remove-pack-file "%s" "%s"

.pack

0.0.0.0

0123456789

InternetCrackUrlA

HttpQueryInfoA

HttpOpenRequestA

HttpSendRequestA

FtpOpenFileA

FtpFindFirstFileA

VERSION.dll

GetProcessHeap

GetWindowsDirectoryA

CreateNamedPipeA

ConnectNamedPipe

KERNEL32.dll

ExitWindowsEx

MsgWaitForMultipleObjects

USER32.dll

GetViewportExtEx

GDI32.dll

RegOpenKeyA

RegOpenKeyExA

RegCloseKey

RegEnumKeyExA

RegCreateKeyExA

RegDeleteKeyA

RegQueryInfoKeyA

ADVAPI32.dll

ShellExecuteExA

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

COMCTL32.dll

{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\lang1033\f0\fs20\par

{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\f0\fs20 EULA\par

3334445558;;<<<<>>>?

"999500>

"999550-]

version="1.0.0.0"

name="Microsoft.Windows.AdvancedInstallerSetup"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

B.aiu

*\\?\

<>:"/\|?*

[WindowsFolder]explorer.exe

Copy URL In Clipboard

You must locate, download and install the following prerequisites onto your computer. Double click on an URL to open it in your web browser.

This archive is corrupted.(This archive has an unsupported version.'Windows Installer could not be started.)An error occurred while reading the file.#An error occurred while extracting.

Select the download folder.R%s can not be installed on systems with Windows Installer version smaller than %s.

ErrorkThis package requires Windows Installer version "%s". You have "%s".

Please upgrade your Windows Installer.

%s Options(Extracting the main application files...

%s [options]

/listlangs - list languages supported by this setup

 - options for msiexec.exe on running the MSI package

Installing %s4Press the Next button to download the prerequisites.3Press the Next button to install the prerequisites.;Press the Next button to open the prerequisites' web sites.8Press the Finish button to install the main application.

%s Setup

Required: %s or lower.

Required: %s or higher.

Required: between %s and %s.

Found: %s.

NameCPress the Finish button when you are done and ready to install %s. 3Press the Next button to install the prerequisites.

Error: %s

Installing %s from: %sZSome prerequisites could not be installed. Press Back to return to the prerequisites list.{After launching all packages some required prerequisites are still missing. Press Back to return to the prerequisites list.aAll prerequisites have been installed successfully. Press Finish to install the main application.&Welcome to the %s Prerequisites Wizard

%d.%d KB/slSome required prerequisites are still missing. You can try again or remove them from the prerequisites list.

%d hr %d min at %s/sec

%d min %d sec at %s/sec

%d sec at %s/sec

Progress: %d%% (%s of %s) Downloading: %s %d%% (%s of %s)

Opening site of %s

Downloading %s Extracting files from archive...

Extracting file to %s0The %s file can't be unpacked. Error message: %saThe Java Runtime Environment version 1.5 or later must be installed in order to unpack JAR files.-Another instance of setup is already running.

%s can not be installed on %s2%s can not be installed on systems earlier than %s

Q%s can not be installed on systems with Internet Explorer version smaller than %s]%s can not be installed on systems with Internet Information Services version smaller than %sI%s can not be installed on systems with screen resolution smaller than %sK%s can not be installed on systems with color quality smaller than %s bits.H%s can not be installed on systems with less physical memory than %s MB.N%s can not be installed on systems with .NET Framework version smaller than %s1%s requires administrative privileges to install.

Unpacking file:%syThere is not enough space in folder:%s

Preparing...N%s can not be installed on systems with Acrobat Reader version smaller than %s

%s Languages

C%s can not be installed on systems with JRE version smaller than %sG%s can not be installed on systems with DirectX version smaller than %sw%s requires an active Internet connection for installation. Please check your network configuration and proxy settings.1%s cannot be installed on systems without %s 20031%s cannot be installed on systems without %s 2007

QuestionOAn upgrade of the selected instance will be performed. Do you want to continue? Upgrade all installed instances.xThis package allows you to install multiple instances of %s. Please select the option you want and press OK to continue:M%s can not be installed on systems with XNA Framework version smaller than %s

Evaluating launch conditions...C%s can not be installed on systems with JDK version smaller than %s-%s can not be installed on systems without %s7%s can not be installed on systems without %s or higher

,%s cannot be installed on systems without %sK%s cannot be installed on systems without %s 2003 Primary Interop Assembly.K%s cannot be installed on systems without %s 2007 Primary Interop Assembly.-%s cannot be installed on systems without %s.

PDFill.exe

vbc.exe_1056:

`.rsrc

bss_server.usrReverseRelay

bss_server.usrRelay

tmrWebHide

bss_server.Socket

mswinsck.ocx

MSWinsockLib.Winsock

modLaunchWeb

%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\SysWOW64\ieframe.dll

winmm.dll

user32.dll

CHAT_ADDMSG

advapi32.dll

shell32.dll

kernel32.dll

avicap32.dll

advpack.dll

GetAsyncKeyState

SetWindowsHookExA

UnhookWindowsHookEx

GetKeyboardLayout

GetKeyboardState

GetKeyState

PSAPI.DLL

CreatePipe

GetTcpTable

ExitWindowsEx

EnumWindows

WinInet.dll

DeleteUrlCacheEntryA

urlmon

URLDownloadToFileA

ShellExecuteA

keybd_event

cmdShowfiles

x%Program Files% (x86)\Microsoft Visual Studio\VB98\mswinsck.oca

UDPSocket

tmrUDP

tmrTCP

UDPFlood

VBA6.DLL

C:\Windows\SysWow64\MSVBVM60.DLL\3

ws2_32.dll

AddMsg

GdiplusShutdown

WSOCK32.DLL

RegCloseKey

RegOpenKeyExA

ntdll.dll

Http_DownloadFile

ole32.dll

FtpGetDirectory

crypt32.dll

oleaut32.dll

RegOpenKeyA

FindFirstUrlCacheEntryA

FtpUpload

FindNextUrlCacheEntryA

RegCreateKeyA

RegDeleteKeyA

RegEnumKeyExA

gdi32.dll

olepro32.dll

InternetOpenUrlA

FtpGetFileA

FtpPutFileA

FtpSetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpOpenFileA

FtpGetFileSize

FtpDeleteFileA

FtpCreateDirectoryA

FtpRemoveDirectoryA

FtpRenameFileA

FtpDownload

RemotePort

LocalPort

msvbvm60.dll

?8??8??8??8??8?

uMsg

strMsg

MsgNum

AllMsgs

Port

Password

WebURL

lngPort

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Occurs after a send operation has completed

.text

`.data

.rsrc

.rsrm

KERNEL32.DLL

MSVBVM60.DLL

*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp

2c49f800-c2dd-11cf-9ad6-0080c7e7b78d

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5

{00020404-0000-0000-C000-000000000046}

4.0.1

data.dat

\nir_cmd.bss speak text

\nir_cmd.bss setsysvolume 65535

\nir_cmd.bss mutesysvolume 1

\nir_cmd.bss mutesysvolume 0

\nir_cmd.bss screensaver

\nir_cmd.bss monitor off

\nir_cmd.bss monitor on

PORT

TRANSFERPORT

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\

Keylog

Wscript.Shell

HKEY_CLASSES_ROOT\HTTP\shell\open\command\

\winlogon.exe

iexplore.exe

ADVAPI32.dll

Windows Firewall/Internet Connection Sharing (ICS)

WebCamCapture

\Vuze\Azureus.exe

\LimeWire\LimeWire.exe

\uTorrent\uTorrent.exe

\BitTorrent\bittorrent.exe

\MSWINSCK.OCX

\cmd.exe

nkey

dkey

regsvr32.exe

\pws_mail.bss

\pws_mess.bss

\pws_cdk.bss

\nir_cmd.bss

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "

:*:Enabled:Windows Messanger" /f

winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2

00000000

winmgmts:\\.\root\cimv2

api.ipinfodb.com

Select * from Win32_Keyboard

GET /v2/ip_query.php?key=

&timezone=off HTTP/1.1

Host: api.ipinfodb.com

GET /v2/ip_query_country.php?key=

Portable

winmgmts:\\.\root\SecurityCenter

\wallpaper.bmp

\wallpaper.jpg

WScript.Shell

WinServer 2003, Web Edition

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

__oxFrame.class__

Scripting.FileSystemObject

Autorun.ini

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

Address family not supported by protocol family.

Operation already in progress.

Operation now in progress.

Socket operation on nonsocket.

Operation not supported.

Protocol family not supported.

Protocol not supported.

Socket type not supported.

Winsock.dll version out of range.

CSocketMaster.SocketExists

CSocketMaster.PostSocket

CSocketMaster.ConnectToIP

CSocketMaster.ResolveIfHostname

CSocketMaster.SendBufferedDataUDP

CSocketMaster.SendBufferedData

sqlite3_open

sqlite3.dll

sqlite3_close

sqlite3_prepare_v2

sqlite3_step

sqlite3_finalize

sqlite3_column_text

abe2869f-9b47-4cd9-a358-c22904dba7f7

/stext mess.dat

\mess.dat

/stext mail.dat

\mail.dat

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion

Windows

softokn3.dll

nss3.dll

SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

\Mozilla Firefox\

mozcrt19.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

\Mozilla\Firefox\

profiles.ini

\signons.sqlite

select * from moz_logins

PK11_GetInternalKeySlot

http\shell\open\command

127.0.0.1

\dump.txt

255.255.255.255

bps1.exe

finalizarprocessoportas

CONNECT %s:%i HTTP/1.0

SOFTWARE\Classes\http\shell\open\command

Software\Classes\http\shell\open\command

Software\Microsoft\Windows NT\CurrentVersion\SystemRestore

code.is.a.winner

Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId

bhookpl.dll

bnfa.exe

drvloadn.dll

drvloadx.dll

VNCHooks.dll

xr4tdwa.exe

shutdown.exe

TCnRawKeyBoard

HuntHTTPDownload

explorer.exe

autorun.inf

https://onlineeast#.bankofamerica.com

winlogon.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

\system32\userinit.exe,

@*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp

vbc.exe_1056_rwx_00400000_0005C000:

`.rsrc

bss_server.usrReverseRelay

bss_server.usrRelay

tmrWebHide

bss_server.Socket

mswinsck.ocx

MSWinsockLib.Winsock

modLaunchWeb

%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\SysWOW64\ieframe.dll

winmm.dll

user32.dll

CHAT_ADDMSG

advapi32.dll

shell32.dll

kernel32.dll

avicap32.dll

advpack.dll

GetAsyncKeyState

SetWindowsHookExA

UnhookWindowsHookEx

GetKeyboardLayout

GetKeyboardState

GetKeyState

PSAPI.DLL

CreatePipe

GetTcpTable

ExitWindowsEx

EnumWindows

WinInet.dll

DeleteUrlCacheEntryA

urlmon

URLDownloadToFileA

ShellExecuteA

keybd_event

cmdShowfiles

x%Program Files% (x86)\Microsoft Visual Studio\VB98\mswinsck.oca

UDPSocket

tmrUDP

tmrTCP

UDPFlood

VBA6.DLL

C:\Windows\SysWow64\MSVBVM60.DLL\3

ws2_32.dll

AddMsg

GdiplusShutdown

WSOCK32.DLL

RegCloseKey

RegOpenKeyExA

ntdll.dll

Http_DownloadFile

ole32.dll

FtpGetDirectory

crypt32.dll

oleaut32.dll

RegOpenKeyA

FindFirstUrlCacheEntryA

FtpUpload

FindNextUrlCacheEntryA

RegCreateKeyA

RegDeleteKeyA

RegEnumKeyExA

gdi32.dll

olepro32.dll

InternetOpenUrlA

FtpGetFileA

FtpPutFileA

FtpSetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpOpenFileA

FtpGetFileSize

FtpDeleteFileA

FtpCreateDirectoryA

FtpRemoveDirectoryA

FtpRenameFileA

FtpDownload

RemotePort

LocalPort

msvbvm60.dll

?8??8??8??8??8?

uMsg

strMsg

MsgNum

AllMsgs

Port

Password

WebURL

lngPort

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Occurs after a send operation has completed

.text

`.data

.rsrc

.rsrm

KERNEL32.DLL

MSVBVM60.DLL

*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp

2c49f800-c2dd-11cf-9ad6-0080c7e7b78d

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5

{00020404-0000-0000-C000-000000000046}

4.0.1

data.dat

\nir_cmd.bss speak text

\nir_cmd.bss setsysvolume 65535

\nir_cmd.bss mutesysvolume 1

\nir_cmd.bss mutesysvolume 0

\nir_cmd.bss screensaver

\nir_cmd.bss monitor off

\nir_cmd.bss monitor on

PORT

TRANSFERPORT

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\

Keylog

Wscript.Shell

HKEY_CLASSES_ROOT\HTTP\shell\open\command\

\winlogon.exe

iexplore.exe

ADVAPI32.dll

Windows Firewall/Internet Connection Sharing (ICS)

WebCamCapture

\Vuze\Azureus.exe

\LimeWire\LimeWire.exe

\uTorrent\uTorrent.exe

\BitTorrent\bittorrent.exe

\MSWINSCK.OCX

\cmd.exe

nkey

dkey

regsvr32.exe

\pws_mail.bss

\pws_mess.bss

\pws_cdk.bss

\nir_cmd.bss

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "

:*:Enabled:Windows Messanger" /f

winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2

00000000

winmgmts:\\.\root\cimv2

api.ipinfodb.com

Select * from Win32_Keyboard

GET /v2/ip_query.php?key=

&timezone=off HTTP/1.1

Host: api.ipinfodb.com

GET /v2/ip_query_country.php?key=

Portable

winmgmts:\\.\root\SecurityCenter

\wallpaper.bmp

\wallpaper.jpg

WScript.Shell

WinServer 2003, Web Edition

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

__oxFrame.class__

Scripting.FileSystemObject

Autorun.ini

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

Address family not supported by protocol family.

Operation already in progress.

Operation now in progress.

Socket operation on nonsocket.

Operation not supported.

Protocol family not supported.

Protocol not supported.

Socket type not supported.

Winsock.dll version out of range.

CSocketMaster.SocketExists

CSocketMaster.PostSocket

CSocketMaster.ConnectToIP

CSocketMaster.ResolveIfHostname

CSocketMaster.SendBufferedDataUDP

CSocketMaster.SendBufferedData

sqlite3_open

sqlite3.dll

sqlite3_close

sqlite3_prepare_v2

sqlite3_step

sqlite3_finalize

sqlite3_column_text

abe2869f-9b47-4cd9-a358-c22904dba7f7

/stext mess.dat

\mess.dat

/stext mail.dat

\mail.dat

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion

Windows

softokn3.dll

nss3.dll

SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

\Mozilla Firefox\

mozcrt19.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

\Mozilla\Firefox\

profiles.ini

\signons.sqlite

select * from moz_logins

PK11_GetInternalKeySlot

http\shell\open\command

127.0.0.1

\dump.txt

255.255.255.255

bps1.exe

finalizarprocessoportas

CONNECT %s:%i HTTP/1.0

SOFTWARE\Classes\http\shell\open\command

Software\Classes\http\shell\open\command

Software\Microsoft\Windows NT\CurrentVersion\SystemRestore

code.is.a.winner

Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId

bhookpl.dll

bnfa.exe

drvloadn.dll

drvloadx.dll

VNCHooks.dll

xr4tdwa.exe

shutdown.exe

TCnRawKeyBoard

HuntHTTPDownload

explorer.exe

autorun.inf

https://onlineeast#.bankofamerica.com

winlogon.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

\system32\userinit.exe,

@*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp

MsiExec.exe_1956:

.text

`.data

.rsrc

msvcrt.dll

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

ole32.dll

msi.dll

WinHttpOpen

WinHttpConnect

WinHttpCrackUrl

WinHttpOpenRequest

WinHttpCloseHandle

WinHttpSendRequest

WinHttpReceiveResponse

WinHttpQueryDataAvailable

WinHttpReadData

WinHttpQueryHeaders

WinHttpGetProxyForUrl

WinHttpGetIEProxyConfigForCurrentUser

WinHttpSetOption

RegDeleteKeyExW

SQLInstallDriverExW

SQLConfigDriverW

SQLRemoveDriverW

SQLInstallTranslatorExW

SQLRemoveTranslatorW

SQLConfigDataSourceW

SQLInstallerErrorW

SQLInstallDriverManagerW

SQLRemoveDriverManagerW

UrlCanonicalizeW

UrlCombineW

UrlIsW

UrlIsFileUrlW

UrlGetPartW

PathCreateFromUrlW

DeleteUrlCacheEntryW

URLDownloadToCacheFileW

SetThreadExecutionState

GetSystemWindowsDirectoryW

NtRenameKey

NtOpenKey

TermsrvLogInstallIniFileEx

WTHelperGetProvCertFromChain

CertDuplicateCertificateContext

CertFreeCertificateContext

ReportFault

ApphelpFixMsiPackageExe

msiexec.pdb

PSSSSSSh

SSSSht

_acmdln

RegOpenKeyExW

RegCreateKeyExW

RegCloseKey

RegDeleteKeyW

RegEnumKeyW

RegEnumKeyExW

RegGetKeySecurity

MsgWaitForMultipleObjects

ntdll.dll

name="MSIExec"

version="4.0.0.0"

 Windows installer setup service 

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

Msi.Package

Windows Installer Package

Msi.Patch

Windows Installer Patch

APPID\%s

%s\DefaultIcon

%s\CLSID

CLSID\%s

CLSID\%s\ProgId

Msi.dll

MsiRegMv.Exe

MsiExecCA32

Software\Microsoft\Windows\CurrentVersion\Installer

{lX-0000-0000-C000-000000000046}

ISMIF32.DLL

RICHED20.DLL

%d.d.%.4d.%d

REINSTALL=ALL REINSTALLMODE=%s

Error: %d. %s.

Software\Policies\Microsoft\Windows\Installer

Failed to connect to server. Error: 0x%X

FDeleteRegTree: Unable to delete subkey: %s

Interface\{lX-0000-0000-C000-000000000046}\NumMethods

3.1.4000

3.0.3790

%d.%d.%d

CLSID\{lX-0000-0000-C000-000000000046}\DllVersion

FIsKeyLocalSystemOrAdminOwned: Could not get owner security info.

PurgeUserOwnedSubkeys: Could not open subkey: %s

PurgeUserOwnedSubkeys: Could not enumerate subkeys.

PurgeUserOwnedSubkeys: Could not delete SubKey tree.

PurgeUserOwnedSubkeys: %s not owned by System or Admin. Deleting key   subkeys.

PurgeUserOwnedInstallerKeys: Could not delete tree.

PurgeUserOwnedInstallerKeys: Key '%s' not owned by System or Admin. Deleting key   subkeys.

PurgeUserOwnedInstallerKeys: Could not open key '%s'

OpenProcessToken failed with %d

passive

Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries

SetInstallerACLs: Could not create Secure Installer sub key.

SetInstallerACLs: Could not delete Installer key tree.

SetInstallerACLs: Installer key not owned by System or Admin. Deleting key   subkeys and re-creating.

SetInstallerACLs: Could not create Installer key.

kernel32.dll

WINHTTP

fusion.dll

URLMON

RPCRT4

Windows

3.1.4001.5512

msiexec

msiexec.exe

Windows Installer - Unicode

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   PDFill.exe:1368
   %original file name%.exe:844
   MsiExec.exe:1956
   vkZtkbozih.exe:1104
   

2. Delete the original Worm file.
   
3. Delete or disinfect the following files created/modified by the Worm:
   

   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_Excel.dll (79 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\WriterSave.exe (1795 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\DownloadandInstall.exe (79 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_Word.dll (79 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPSCRIPT.HLP (26 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPSCRIPT.NTF (5442 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPSCRIPT5.DLL (1824 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceam.tlx (7 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\wspell.ocx (180 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\Wspelldlg.GID (8 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\correct.tlx (21 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.ico (3 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPSCRIPT.HLP (26 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\WriterSave.chm (64 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\userdic.tlx (89 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPS5UI.DLL (3801 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceam2.clx (327 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\decoder.dll (1738 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillWriterMon32.dll (26 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill_PDF_Tools.exe (24 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPSCRIPT5.DLL (3701 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPS5UI.DLL (3923 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillWriterMon64.dll (30 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PSCRIPT5.jar (25429 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\sscebr.tlx (7 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPSCRIPT.NTF (5442 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\cimage.dll (3851 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.x64.msi (6 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.mst (290 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceca.tlx (7 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill_license.rtf (10 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFWrite.rsp (133 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.exe (7972 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.msi (6 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\DownloadPDF.exe (170 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\accent.tlx (2 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\mfc70u.dll (6405 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFillWriter.PPD (25 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\msvcr70.dll (1625 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\tech.tlx (3 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_PowerPoint.dll (79 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\pdf2image.dll (22433 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceca2.clx (1609 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFillZip.exe (75 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\sscebr2.clx (1611 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\DynamicTwainCtrl.dll (294 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\Wspelldlg.hlp (18 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\CommandBars1300vc70U.dll (7972 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\WriterSetup.exe (57 bytes)
   %Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.chm (275 bytes)
   %Documents and Settings%\All Users\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\8.0.0.0\vkZtkbozih.exe (96836 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\PDFill.exe (70225 bytes)
   %Documents and Settings%\%current user%\Application Data\HBTDZJTZVhyNVWfDxbdK\HBTDZJTZVhyNVWfDxbdK\0.0.0.0\vkZtkbozih.exe (98579 bytes)
   %Documents and Settings%\All Users\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\8.0.0.0\cic.dll (16 bytes)
   %Documents and Settings%\%current user%\Application Data\HBTDZJTZVhyNVWfDxbdK\HBTDZJTZVhyNVWfDxbdK\0.0.0.0\cic.dll (16 bytes)
   %Documents and Settings%\%current user%\Application Data\data.dat (37 bytes)
   %Documents and Settings%\%current user%\Application Data\host.exe (3860 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "vkZtkbozih.exe" = "%Documents and Settings%\%current user%\Application Data\HBTDZJTZVhyNVWfDxbdK\HBTDZJTZVhyNVWfDxbdK\0.0.0.0\vkZtkbozih.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.