Gen.Variant.Symmi.4535_fa8899c877 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

No files have been created.

Registry activity

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	19916	20480	4.52066	2e50996cc73c4c2fb7ea8f79cf982b26
.rdata	24576	2634	4096	2.46749	e5615fe4c75b4f7ba6eaedb684bf431c
.data	28672	8024	8192	1.98389	65f79c130923371bceab73bb68dbb967
.data	36864	1622016	1622016	4.36315	1143ace8b4fa5aa67c7a2739673cfc60
.rsrc	1658880	100560	102400	2.49921	f78fabf1e23d8e9a118a276ef5fac993

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_3792:

.text

`.rdata

@.data

.data

.rsrc

user32.dll

KERNEL32.dll

USER32.dll

GetCPInfo

krnln.fne

krnln.fnr

E_N%X

1.1.3

c:\%original file name%.exe

{A0005538-9391-4dd9-B4D6-8EB7B9360F08}

BmpOperate

42305932-06E6-47a5-AC79-8BDCDC58DF61

WebBrowser2

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

SkinH_EL.dll

GBj%c

}&-4}v

&pass=

hXXp://vip.fbkc.net/chinacn/c40e7431a68c3fbc55f9602cf981bb36.asp?user=

hXXp://vip.fbkc.net/chinacn/tishi.txt

\update.exe

hXXp://vip.fbkc.net/chinacn/3.asp?user=

hXXp://

hXXps://

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

HTTP/1.1

Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Content-Type: application/x-www-form-urlencoded

hXXp://down.fbkc.net/chinacn.exe

hXXp://vip.fbkc.net/chinacn/banben.txt

WinHttp.WinhttpRequest.5.1

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

.html

hXXp://VVV.100ppi.com/forecast/list-13--

hXXp://VVV.100ppi.com/forecast/detail-

()

hXXp://VVV.100ppi.com/info/list-news-13--

hXXp://VVV.100ppi.com/info/detail-

hXXp://VVV.ah.chinanews.com.cn/portal.php?mod=list&catid=26&page=

hXXp://VVV.ah.chinanews.com.cn/article-

\*.jpg

hXXp://ping.baidu.com/ping/RPC2

weblogUpdates.ping

hXXp://ping.baidu.com/ping.html

application/x-www-form-urlencoded

_.bin

hXXp://my.cn.china.cn/ajaxnew.php

hXXp://my.cn.china.cn/manage.php?op=SellInfoShowNew&auth=

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

hXXp://my.cn.china.cn/ajaxnew.php?op=sellinforesend

verifystr=&type=online&ids[]=

x-requested-with: XMLHttpRequest

hXXp://my.cn.china.cn/manage.php

hXXp://my.cn.china.cn/ajaxapi.php?op=getAttrGoconfig&industry_id=

hXXp://my.cn.china.cn/manage.php?op=LoginShowNew

hXXp://cn.china.cn/

hXXp://my.cn.china.cn/manage.php?op=captha&t=2&seed=8230

&op=B2BLoginnew&destUrl=&verifyCode={$verifyCode}

&userPassword=

hXXp://my.cn.china.cn/manage.php?op=adminIndex

id=

hXXp://my.cn.china.cn/manage.php?op=SellInfoCatNew&auth=

hXXp://my.cn.china.cn/ajaxnew.php?op=initAlbum&initMode=1&r=0.7703644179888691

_.dat

hXXp://my.cn.china.cn/manage.php?op=SellInfoChangeSNew&auth=

hXXp://my.cn.china.cn/ajaxapi.php

t$(SSh

~%UVW

u$SShe

Wininet.dll

InternetOpenUrlA

HttpQueryInfoA

MsgWaitForMultipleObjects

{E60056EA-07A8-4bf5-B6F0-DF05DE6FAE1F}

hXXp://vip.fbkc.net/1.txt

anonymous@123.com

.exe|.rar|.zip|.gif|.jpg|.mp3|.rm

User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

RASAPI32.dll

GetProcessHeap

WinExec

GetKeyState

GetViewportOrgEx

WINMM.dll

WINSPOOL.DRV

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

WS2_32.dll

HttpSendRequestA

HttpOpenRequestA

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

RegCreateKeyExA

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

[%s:%d]

Range: bytes=%s-

[%s:%d]

PASS %s

PASS ******

USER %s

E:\dev\e\static_link\static_libs\source\downlib\mystrlib.cpp

SIZE %s

PORT

User-Agent: %s

Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)

Referer: %s

Host: %s

GET %s HTTP/1.1

Cookie: %s

%d, %s

\\192.168.0.129\TCP\1037

NSPlayer/9.0.0.2980; {%s}; Host: %s

rmff_fix_header: assuming data.size=%i

rmff_fix_header: assuming data.num_packets=%i

rmff_fix_header: assuming prop.num_packets=%i

rmff_fix_header: setting prop.data_offset from %i to %i

rmff_fix_header: correcting prop.num_streams from %i to %i

rmff_fix_header: correcting prop.size from %i to %i

%s %s %s

Session: %s

Cseq: %u

%*s %s

%*s %u

CSeq: %u

rtsp://%s:%i

rtsp://%s:%i/%s

ClientID: Linux_2.4_6.0.9.1235_play32_RN01_EN_586

GUID: 00000000-0000-0000-0000-000000000000

[%s:%d]

User-Agent: RealMedia Player Version 6.0.9.1235 (linux-2.0-libc6-i386-gcc2.95)

Range: npt=%s-

%s/streamid=1

%s/streamid=0

Transport: x-pn-tng/tcp;mode=play,rtp/avp/tcp;unicast;mode=play

If-Match: %s

RealChallenge2: %s, sd=%s

Title: %s

Copyright: %s

Author: %s

real: Content-length for description too big (> %uMB)!

Require: com.real.retain-entity-for-setup

SupportsMaximumASMBandwidth: 1

Bandwidth: %u

Challenge1: %s

hash output: %x %x %x %x

hash input: %x %x %x %x

stream=%u;rule=%u,

Illegal character '%c' in input.

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÃ

#include "l.chs\afxres.rc" // Standard components

PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGhXXp://vip.gangguan.in/gonggao.txt

LED

hXXp://my.cn.china.cn/manage.php?op=SellInfoListNew&auth=

,url:'

hXXp://vip.fbkc.net/chinacn/2ef955d371f3ab0cbb54cfbc6abef844.asp?uid=

hXXp://my.cn.china.cn/manage.php?op=SellInfoAddv2

&keyword3=

&keyword2=

&tradeleadtype=10&keyword1=

&capitalscore=5&picscore=5&attrscore=5&groupscore=5&introscore=5&jyscore=5&keywordscore=5&id=&categoryid=

@advapi32.dll

kernel32.dll

wininet.dll

Ole32.dll

Windows

*.jpg|*.jpg

Www.FbKc.Net

1, 0, 6, 6

- Skin.dll

(*.*)

1.1.0.0

(hXXp://VVV.eyuyan.com)

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps