Gen.Variant.Strictor.113557_4a484393b1

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:2880

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:2880 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\tj[1].htm (339 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\navcancl[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\ErrorPageTemplate[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\info_48[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\httpErrorPagesScripts[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017032920170330\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bullet[1] (447 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TA3DKYRR.txt (125 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67ff8.tmp (7971 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\stat[1].js (1321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\errorPageStrings[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UW7Q6M8K.txt (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\navcancl[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ErrorPageTemplate[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\errorPageStrings[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\background_gradient[1] (453 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\background_gradient[1] (453 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\bullet[1] (447 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68018.tmp (5873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68029.tmp (1425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\info_48[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\httpErrorPagesScripts[1] (5 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\info_48[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016101020161017 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\bullet[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\background_gradient[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\navcancl[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016102820161029 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68018.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68029.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ErrorPageTemplate[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67ff8.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\errorPageStrings[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\httpErrorPagesScripts[1] (0 bytes)

Registry activity

The process %original file name%.exe:2880 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017032920170330]
"CachePrefix" = ":2017032920170330:"
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Tracing\4a484393b122ba5ea5d1805514cae7a1_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\4a484393b122ba5ea5d1805514cae7a1_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\4a484393b122ba5ea5d1805514cae7a1_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]
"WpadLastNetwork" = "{E549E976-C5F2-4E77-819D-55BC9B7C25BC}"

[HKLM\SOFTWARE\Microsoft\Tracing\4a484393b122ba5ea5d1805514cae7a1_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017032920170330]
"CacheRepair" = "0"
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Tracing\4a484393b122ba5ea5d1805514cae7a1_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\4a484393b122ba5ea5d1805514cae7a1_RASAPI32]
"EnableFileTracing" = "0"
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 0C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\4a484393b122ba5ea5d1805514cae7a1_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\4a484393b122ba5ea5d1805514cae7a1_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017032920170330]
"CachePath" = "%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017032920170330"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\4a484393b122ba5ea5d1805514cae7a1_RASMANCS]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\4a484393b122ba5ea5d1805514cae7a1_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016101020161017]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016102820161029]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\tj[1].htm (339 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\navcancl[1] (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\ErrorPageTemplate[1] (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\info_48[1] (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\httpErrorPagesScripts[1] (5 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017032920170330\index.dat (16 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bullet[1] (447 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TA3DKYRR.txt (125 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67ff8.tmp (7971 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\stat[1].js (1321 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\errorPageStrings[1] (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\UW7Q6M8K.txt (135 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\navcancl[1] (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ErrorPageTemplate[1] (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\errorPageStrings[1] (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\background_gradient[1] (453 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\background_gradient[1] (453 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\bullet[1] (447 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68018.tmp (5873 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\68029.tmp (1425 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\info_48[1] (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\httpErrorPagesScripts[1] (5 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: ????????
Product Name: ????????
Product Version: 6.9.0.1
Legal Copyright: www.ucbug.com
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 6.9.0.1
File Description: www.ucbug.com ????????
Comments: www.ucbug.com ????????
Language: English (United States)

Company Name: ????????Product Name: ????????Product Version: 6.9.0.1Legal Copyright: www.ucbug.comLegal Trademarks: Original Filename: Internal Name: File Version: 6.9.0.1File Description: www.ucbug.com ????????Comments: www.ucbug.com ????????Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1155072	377344	5.54477	44750dc3d7d55f6bc2ea59d40f798f24
.rdata	1159168	1851392	1270272	5.54489	2276e4dafe764542faeb433e6ebc482c
.data	3010560	356352	25088	5.53681	ba6aa45e09846f30d7371f19635b8759
.rsrc	3366912	24576	8192	4.38443	e8b3824af427c19c862f93bbaa7ba64d
.asssjj	3391488	8192	7680	3.80535	3c6ec7784d2b6ba0fc72e03d32c8354f
.adata	3399680	4096	0	0	d41d8cd98f00b204e9800998ecf8427e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://asssjjdata.sddata6.com//asjjdata/cs.txt	192.225.225.167
hxxp://asssjjdata.sddata6.com//asjjdata/banben.txt	192.225.225.167
hxxp://asssjjdata.sddata6.com//asjjdata/zdbanben.txt	192.225.225.167
hxxp://asssjjdata.sddata6.com//asjjdata/tj.html?V6.9	192.225.225.167
hxxp://asssjjdata.sddata6.com//asjjdata/gxdz.txt	192.225.225.167
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=1252900975&show=pic
hxxp://s23.cnzz.com/stat.php?id=1252900975&show=pic	1.99.192.16
dns.msftncsi.com	131.107.255.255
my.4399.com
c.cnzz.com
asdata.ui10.net
z5.cnzz.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET //asjjdata/cs.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: asssjjdata.sddata6.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 1

Content-Type: text/plain

Last-Modified: Wed, 22 Feb 2017 18:53:54 GMT

Accept-Ranges: bytes

ETag: "a564d133d8dd21:17ec"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Wed, 29 Mar 2017 14:25:39 GMT

1HTTP/1.1 200 OK..Content-Length: 1..Content-Type: text/plain..Last-Modified: Wed, 22 Feb 2017 18:53:54 GMT..Accept-Ranges: bytes..ETag: "a564d133d8dd21:17ec"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Wed, 29 Mar 2017 14:25:39 GMT..1....

GET //asjjdata/banben.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: asssjjdata.sddata6.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 4

Content-Type: text/plain

Last-Modified: Fri, 17 Mar 2017 14:29:08 GMT

Accept-Ranges: bytes

ETag: "9564d0d62a9fd21:17ec"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Wed, 29 Mar 2017 14:25:46 GMT

V7.0....

GET //asjjdata/zdbanben.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: asssjjdata.sddata6.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 4

Content-Type: text/plain

Last-Modified: Sat, 19 Jul 2014 17:54:04 GMT

Accept-Ranges: bytes

ETag: "c4cbe46d7aa3cf1:17ec"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Wed, 29 Mar 2017 14:25:46 GMT

V0.1....

GET //asjjdata/tj.html?V6.9 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: asssjjdata.sddata6.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 339

Content-Type: text/html

Last-Modified: Sat, 19 Jul 2014 18:20:35 GMT

Accept-Ranges: bytes

ETag: "978397227ea3cf1:17ec"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Wed, 29 Mar 2017 14:25:46 GMT

<script type="text/javascript">var cnzz_protocol = (("https:" == document.location.protocol) ? " hXXps://" : " hXXp://");document.write(unescape("ipt src='" cnzz_protocol "s23.cnzz.com/stat.php?id=1252900975%26show=pic' type='text/javascript'>"));</script>..

GET //asjjdata/gxdz.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: asssjjdata.sddata6.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 30

Content-Type: text/plain

Last-Modified: Fri, 17 Feb 2017 23:13:24 GMT

Accept-Ranges: bytes

ETag: "6dd8a707389d21:17ec"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Wed, 29 Mar 2017 14:26:07 GMT

hXXp://VVV.asssjj.com/?6.72|W|HTTP/1.1 200 OK..Content-Length: 30..Content-Type: text/plain..Last-Modified: Fri, 17 Feb 2017 23:13:24 GMT..Accept-Ranges: bytes..ETag: "6dd8a707389d21:17ec"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Wed, 29 Mar 2017 14:26:07 GMT..http://VVV.asssjj.com/?6.72|W|..

GET /stat.php?id=1252900975&show=pic HTTP/1.1

Accept: */*

Referer: hXXp://asssjjdata.sddata6.com//asjjdata/tj.html?V6.9

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: s23.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 10990

Connection: keep-alive

Date: Wed, 29 Mar 2017 13:07:52 GMT

Last-Modified: Wed, 29 Mar 2017 13:07:51 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache20.l2et2-1[0,200-0,H], cache4.l2et2-1[6,0], kunlun4.cn74[0,200-0,H], kunlun5.cn74[0,0]

Age: 4707

X-Cache: HIT TCP_MEM_HIT dirn:11:32477764

X-Swift-SaveTime: Wed, 29 Mar 2017 13:43:01 GMT

X-Swift-CacheTime: 3291

Timing-Allow-Origin: *

EagleId: deba319e14907975798336642e

(function(){function k(){this.c="1252900975";this.ca="z";this.Z="pic";this.W="";this.Y="";this.C="1490792871";this.aa="z5.cnzz.com";this.X="";this.G="CNZZDATA" this.c;this.F="_CNZZDbridge_" this.c;this.P="_cnzz_CV" this.c;this.R="CZ_UUID" this.c;this.L="UM_distinctid";this.H="0";this.K={};this.a={};this.Aa()}function g(a,.b){try{var c=[];c.push("siteid=1252900975");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,m=decodeURIComponent,r=unescape;k.prototype={Aa:function(){try{this.ja(),this.V(),this.wa(),this.T(),this.za(),.this.w(),this.ua(),this.ta(),this.xa(),this.o(),this.sa(),this.va(),this.ya(),this.qa(),this.oa(),thCustomVar":if(3<=a.length){if(!a[1]||!a[2])return!1;var d=a[1],l=a[2],n=a[3]||0;a=0;for(var h in this.a.b)a ;if(5<=a)return!1;var p;0==n?p="p":-1==n||-2==n?p=n:p=(new Date).getTime() 1E3*n;this.a.b[d]={};this.a.b[d].da=l;this.a.b[d].h=p;this.I()}break;case "_deleteCustomVar":2<=a.length&&(d=a[1],this.a.b[d]&&(delete this.a.b[d],this.I()));break;case "_trackPageContent":a[1]&&(this.D=a[1],this.s(),delete this.D);case "_trackPageAction":c=.[];a[1]&&a[2]&&(c.push(f(a[1])),c.push(f(a[2])),this.u=c.join("|"),this.s(),delete this.u);break;case "_setUUid":var m=a[1];if(128<m.length)return!1;var k=

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_2880:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

.asssjj

.asssjj

.adata

.adata

t$(SSh

t$(SSh

~%UVW

~%UVW

u$SShe

u$SShe

Bv=kAv.SCv

Bv=kAv.SCv

kernel32.dll

kernel32.dll

gdi32.dll

gdi32.dll

user32.dll

user32.dll

ntdll.dll

ntdll.dll

wininet.dll

wininet.dll

shlwapi.dll

shlwapi.dll

ws2_32.dll

ws2_32.dll

WS2_32.dll

WS2_32.dll

mswsock.dll

mswsock.dll

Shlwapi.dll

Shlwapi.dll

GetAsyncKeyState

GetAsyncKeyState

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

MapVirtualKeyA

MapVirtualKeyA

GetKeyNameTextA

GetKeyNameTextA

HttpOpenRequestA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

DeleteUrlCacheEntry

DeleteUrlCacheEntry

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

FindCloseUrlCache

{A068799B-7551-46b9-8CA8-EEF8357AFEA4}

{A068799B-7551-46b9-8CA8-EEF8357AFEA4}

WebBrowser

WebBrowser

hXXp://my.4399.com/zhuanti/home/adxsk-getCode-app-ssjj-sid-

hXXp://my.4399.com/zhuanti/home/adxsk-getCode-app-ssjj-sid-

(*.txt)|*.txt|

(*.txt)|*.txt|

(*.*)|*.*

(*.*)|*.*

hXXp://my.4399.com/yxssjj/

hXXp://my.4399.com/yxssjj/

hXXp://my.qzone.qq.com/app/1102503166.html

hXXp://my.qzone.qq.com/app/1102503166.html

).txt

).txt

00ptlogin2.qq.com

00ptlogin2.qq.com

ptnick_

ptnick_

ptui_loginuin=

ptui_loginuin=

hXXp://

hXXp://

\dm.dll

\dm.dll

!!"#$%&'())?

!!"#$%&'())?

%C%]uSj

%C%]uSj

Ha.QE

Ha.QE

xCmD$L

xCmD$L

s.Nd)

s.Nd)

A_%.ID,

A_%.ID,

n.Nn0 b

n.Nn0 b

.hh=@-

.hh=@-

T8.Sz

T8.Sz

.dTR0

.dTR0

.PWh=j

.PWh=j

nL.nP?

nL.nP?

webH

webH

NQt%F

NQt%F

.XV LV#

.XV LV#

PGPus(.Gz

PGPus(.Gz

.ROH=

.ROH=

]v%UO

]v%UO

uù u

uù u

0k00[ `.kh#

0k00[ `.kh#

.scwX

.scwX

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

CxImage 6.0.0

CxImage 6.0.0

deflate 1.2.3 Copyright 1995-200d

deflate 1.2.3 Copyright 1995-200d

a .WO

a .WO

e processors when executed

e processors when executed

>support g

>support g