Trojan.Generic.20482761_0ae013d9d5 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:1976

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1976 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\errorPageStrings[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\httpErrorPagesScripts[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Y2WNRMHF.txt (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\background_gradient[1] (453 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\dnserrordiagoff_webOC[1] (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bullet[1] (447 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\navcancl[1] (2 bytes)
C:\iall3550004.exe (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ErrorPageTemplate[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\info_48[1] (4 bytes)

Registry activity

The process %original file name%.exe:1976 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\0ae013d9d5072a6c741d4ea47af4ed9c_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\0ae013d9d5072a6c741d4ea47af4ed9c_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\0ae013d9d5072a6c741d4ea47af4ed9c_RASMANCS]
"MaxFileSize" = "1048576"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\0ae013d9d5072a6c741d4ea47af4ed9c_RASAPI32]
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\0ae013d9d5072a6c741d4ea47af4ed9c_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\0ae013d9d5072a6c741d4ea47af4ed9c_RASAPI32]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

[HKLM\SOFTWARE\Microsoft\Tracing\0ae013d9d5072a6c741d4ea47af4ed9c_RASAPI32]
"FileDirectory" = "%windir%\tracing"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

MD5	File path
2101bf058d15daf3246c15be798e6b5f	c:\iall3550004.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\errorPageStrings[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\httpErrorPagesScripts[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Y2WNRMHF.txt (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\background_gradient[1] (453 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\dnserrordiagoff_webOC[1] (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bullet[1] (447 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\navcancl[1] (2 bytes)
C:\iall3550004.exe (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ErrorPageTemplate[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\info_48[1] (4 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
Esp0	4096	921600	0	0	d41d8cd98f00b204e9800998ecf8427e
Esp1	925696	1204224	1201664	5.54506	a9dea72aca27137560b4062d1c783473
.rsrc	2129920	372736	369152	0.86108	797807edf44ca1175e2b0a529852d0ad
.Esp	2502656	512	512	4.69958	68e4ce7365a050f32577c7cf1ac6e66f

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.ip.cn/
hxxp://www.luomowg.com/a/changqiwangzhan/2015/0615/99.html	103.226.127.111
hxxp://1st.dl.ourdvs.com/dl/newpck55/iall3550004.exe
hxxp://441418.p23.tc.cdntip.com/downloads/jm/HNInstall_Setup_v1.2.0.12_7654_26214.exe
hxxp://d.heinote.com/downloads/jm/HNInstall_Setup_v1.2.0.12_7654_26214.exe	125.211.204.201
hxxp://dl.ikiki.cn/dl/newpck55/iall3550004.exe	203.130.56.136
ac.100bt.com	106.75.68.89

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /a/changqiwangzhan/2015/0615/99.html HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: VVV.luomowg.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 15 Mar 2017 21:28:14 GMT

Content-Length: 3349

Content-Type: text/html

Content-Location: hXXp://VVV.luomowg.com/a/changqiwangzhan/2015/0615/99.html

Last-Modified: Wed, 15 Mar 2017 01:09:43 GMT

Accept-Ranges: bytes

ETag: "c68657d4289dd21:e2d"

Server: IIS

X-Powered-By: WAF/2.0

Set-Cookie: safedog-flow-item=764CBEB8DE038C69432B6133E7FDF3A6; expires=Thur, 16-Mar-2017 16:00:14 GMT; domain=luomowg.com; path=/

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />..<title>....-........_........-............,............................!</title>..<meta name="keywords" content="....,....,....," />..<meta name="description" content="1" />..<link rel="shortcut icon" href="favicon.ico"/>..<link rel="stylesheet" type="text/css" href="/dedemao/css/basic.css" />..<link rel="stylesheet" type="text/css" href="/dedemao/css/service.css" />..<link rel="stylesheet" type="text/css" href="/dedemao/css/caseInfo.css" />..</head>..<body>...<script>....</script>..<div class="top">...<h1>..............<a href="http:/VVV.luomowg.com" ></a></h1>...<ul class="nav">...... ... .<li><a href='hXXp://VVV.luomowg.com/' >....</a></li>.. ... .<li><a href='/plus/list.php?tid=1' >.... ........</a></li>.. ... .<li><a href='/plus/list.php?tid=6' >....</a></li>.. ....</ul>.....</div>..<div class="main">...<div

<<< skipped >>>

GET /downloads/jm/HNInstall_Setup_v1.2.0.12_7654_26214.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: d.heinote.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: NWS_TCloud_S1

Connection: keep-alive

Date: Wed, 15 Mar 2017 21:28:22 GMT

Cache-Control: max-age=600

Expires: Wed, 15 Mar 2017 21:38:22 GMT

Last-Modified: Thu, 29 Dec 2016 10:17:40 GMT

Content-Type: application/octet-stream

Content-Length: 5467432

Content-Disposition: attachment; filename="HNInstall_Setup_v1.2.0.12_7654_26214.exe"

X-Daa-Tunnel: hop_count=2

X-Cache-Lookup: Hit From Upstream

X-Cache-Lookup: Hit From Disktank

Accept-Ranges: bytes

MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........$.F.E...E...E..O.(..E..O.*.WE..O. ..E..e....E.......E..n....E.......E.......E...=]..E.......E.......E.......E...=Z..E...=J..E...E..jD..n....E..n....E..i.&..E...EN..E..n....E..Rich.E..........PE..L......W.................n....I.....].............@...........................S.......S...@.............................P...0&..........8CE.......... S.(M... S..}..0...T...................\...........@............................................text....m.......n.................. ..`.rdata...............r..............@..@.data....V...P... ...:..............@....gfids...............Z..............@..@.tls.................\..............@....rsrc...8CE......DE..^..............@..@.reloc...}... S..~....R.............@..B.................................................................................................................................................................................kZ......M.........M......"Y..h.|I....M......Y..U...4.M...b..h`|I.........]..p.M..6...ho|I......Y.hy|I......Y.h.|I......Y.h.|I......Y....M......h.|I......Y....M......h.|I......Y.j..lcI......j.h4.I..P.M..:...j....K.3.S...M..u..#....u..`.M..u..u...X.M......E..RC..E.........j.S.p.M..E..........j.S...M..E........M...u.3....M..x.M..E..E..E..h.|I.........Y......j...dI..!...j....K....M.V.....j.3....M.V.}..s....M...u..=..M..}..}..}....M.h.|I......w...Y.......(.M...z..h.|I..\...Y.j....M......h.|I..D...Y.j....M......

<<< skipped >>>

GET / HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: VVV.ip.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.10.0 (Ubuntu)

Date: Wed, 15 Mar 2017 21:27:52 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

d8d..<!DOCTYPE html>.<html>.<head>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8">.<link href="hXXp://s.ip-cdn.com" rel="dns-prefetch" />.<title>IP.cn - IP ............ | ............ | ...............</title>.<meta name="robots" content="all" />.<meta name="Keywords" content="ip,ip......,......ip,......ip,......ip,ip............,.........,.........">.<meta name="Description" content="............ IP ..................... IP ..............................IP ................................................................................................................................................">.<link href='hXXp://s.ip-cdn.com/css/bootstrap.min.css' rel='stylesheet' type='text/css'>.<meta name="viewport" content="width=device-width, minimum-scale=0.5">.<meta name="format-detection" content="telephone=no">..<link href='http://s.ip-cdn.com/css/main.css' rel='stylesheet' type='text/css'>.</head>.<body onLoad="document.fs.ip.focus()">.<div class="container-fluid">..<div class="header">...<a href="/"><img src="hXXp://s.ip-cdn.com/img/logo.gif"></a>..</div>...<div class="mainbar">...<ul class="nav nav-pills center-pills">....<li class="active"><a href="/">IP ......</a></li>....<li><a href="db.php">...........

<<< skipped >>>

GET /dl/newpck55/iall3550004.exe HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: dl.ikiki.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 15 Mar 2017 21:28:14 GMT

Content-Type: application/octet-stream

Last-Modified: Wed, 15 Mar 2017 17:35:03 GMT

Accept-Ranges: bytes

ETag: "cd20f87ab29dd21:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 5692320

Via: 1.1 dxinxzai56:3 (Cdn Cache Server V2.0), 1.1 ml34:0 (Cdn Cache Server V2.0)

Connection: keep-alive

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:D..[*O.[*O.[*O...O.[*O$..O.[*O.#.O.[*O.SuO.[*O.SwO.[*O.[ O.Z*O.#.O [*O.#.O:[*O...O.[*O.[.O.[*O.#.O.[*ORich.[*O........................PE..L...?ORX.............................>............@.................................^WW..............................................@...1............V..?..........................................`...@............................................text...L........................... ..`.rdata..,...........................@..@.data...(........@..................@....rsrc....1...@...2..................@..@.................................................................................................................................................................................................................................................................................................................................................................k........j.X.U...E..E.h.IF..E.P.c....U...u..u.....E...u.].VP....E.....t(.u..u.....E..M......v.;.s.I....tV.u.;.r.3..........#.^]..D$....@...j.P.t$.....E...u...t$.P.t$..z.......U...E..u....@...Pj..u.....E...u.]..u.P.u..H......].SVW...V.j....<...3.C...t$..t$.W..........u.S.......C....u._^[......A........J........Q...R...D$..U..3.9E.u..W....%.U.V.u.....t...BF.M.u.^9E.u.J.z......]....D$.S3...u..W....5VW.t$..|$..t$..p.VPW..........|.;.w.u...>....>.z..._^..[...V.t$.3...;.t..T$.8.t.BNu.;.u..W......T$.;

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1976:

`.rsrc

@N.xG

t$(SSh

~%UVW

u$SShe

C:\1888.txt

hXXp://VVV.ip.cn/

$JA.hy

.iqW>

"3/%F

k.KVp

]>.KrV

t.vim

.ti^a

.OW74

"E.jV

.qED=?

kS$-NY}

.TY3F

kEY94

~.qMi

,.GM>

ri&,G.aL

.BY~^

.yk (Di

D.gbQP

B.PQn

sI%fX

a.mGtn

EcMD*}

%du2$"

.unOZ

c T.Om

OE.ky

.UJ3Zw

.XLKoB

.ax*9

;%C

.Jr1Z

0'.Ll

[I(3/#N0.bd

j"%u=w

q%Xn`

@|H.NI

.wdd!

S|%u4

7O%C

.WE= T!N

#?%s(C(

I %d)

.aEd(

W%xvd

5.ch*

y.MMO}

5r.KV}b

rz.yIL

EcT%x#

W.XZ~

..Xc&

4.Ky%t

.h.fO

Ã•6m*

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

hXXp://VVV.luomowg.com/a/changqiwangzhan/2015/0615/99.html

hXXp://ac.100bt.com/

%d&&'

123456789

00003333

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

ole32.dll

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

user32.dll

.PAVCException@@

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

1.1.3

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

(*.htm;*.html)|*.htm;*.html

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

.PAVCOleDispatchException@@

zcÃ

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

WinExec

GetProcessHeap

GetCPInfo

RegOpenKeyExA

RegCloseKey

RegCreateKeyExA

GetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

ShellExecuteA

UnhookWindowsHookEx

GetKeyState

CreateDialogIndirectParamA

SetWindowsHookExA

InternetCanonicalizeUrlA

InternetCrackUrlA

HttpOpenRequestA

HttpQueryInfoA

HttpSendRequestA

.data

.rdata

@.data

@.text

ADVAPI32.dll

comdlg32.dll

OLEAUT32.dll

oledlg.dll

RASAPI32.dll

SHELL32.dll

WININET.dll

WINMM.dll

WINSPOOL.DRV

WS2_32.dll

1, 0, 6, 6

- Skin.dll

(*.*)

%original file name%.exe_1976_rwx_00401000_00207000:

t$(SSh

~%UVW

u$SShe

C:\1888.txt

hXXp://VVV.ip.cn/

$JA.hy

.iqW>

"3/%F

k.KVp

]>.KrV

t.vim

.ti^a

.OW74

"E.jV

.qED=?

kS$-NY}

.TY3F

kEY94

~.qMi

,.GM>

ri&,G.aL

.BY~^

.yk (Di

D.gbQP

B.PQn

sI%fX

a.mGtn

EcMD*}

%du2$"

.unOZ

c T.Om

OE.ky

.UJ3Zw

.XLKoB

.ax*9

;%C

.Jr1Z

0'.Ll

[I(3/#N0.bd

j"%u=w

q%Xn`

@|H.NI

.wdd!

S|%u4

7O%C

.WE= T!N

#?%s(C(

I %d)

.aEd(

W%xvd

5.ch*

y.MMO}

5r.KV}b

rz.yIL

EcT%x#

W.XZ~

..Xc&

4.Ky%t

.h.fO

Ã•6m*

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

hXXp://VVV.luomowg.com/a/changqiwangzhan/2015/0615/99.html

hXXp://ac.100bt.com/

%d&&'

123456789

00003333

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

ole32.dll

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

user32.dll

.PAVCException@@

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

1.1.3

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

(*.htm;*.html)|*.htm;*.html

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

.PAVCOleDispatchException@@

zcÃ

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

WinExec

GetProcessHeap

GetCPInfo

RegOpenKeyExA

RegCloseKey

RegCreateKeyExA

GetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

ShellExecuteA

UnhookWindowsHookEx

GetKeyState

CreateDialogIndirectParamA

SetWindowsHookExA

InternetCanonicalizeUrlA

InternetCrackUrlA

HttpOpenRequestA

HttpQueryInfoA

HttpSendRequestA

.data

.rdata

@.data

@.text

1, 0, 6, 6

- Skin.dll

(*.*)

%original file name%.exe_1976_rwx_10000000_0003E000:

`.rsrc

L$(h%f

SSh0j

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ã

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1, 0, 6, 6

- Skin.dll

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps