Susp_Dropper (Kaspersky), Packed.Win32.Themida.FD, Trojan-Downloader.Win32.Karagany.1.FD, Trojan-PSW.Win32.Bzub.2.FD, Trojan-PSW.Win32.MSNPassword.FD, Trojan.NSIS.StartPage.FD, Trojan.Win32.BHO.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.Swrort.3.FD, GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan-PSW, Trojan, Packed
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: dfd41436d60fe74e4253408b2cc10736
SHA1: d9a3a2452f40794f204621314ad61e575b9b9fd3
SHA256: fd1fbe9689ffffe0c7e91fa11614eedbdb364593f5223022a7939c64ab9da596
SSDeep: 49152:LRTkUaqjoikF8pmfx2Oei/xk3qCB6 914dBa/jTwsxPN 2H 30FHqojB iS x5R2:LtkUanf3ffzCBF8ULTws1Ni3mHBwiS M
Size: 2928208 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, ACProtect141
Company: no certificate found
Created at: 2016-04-11 19:10:56
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:2040
Mutexes
The following mutexes were created/opened:
ShimCacheMutex
File activity
The process %original file name%.exe:2040 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\UUWiseHelper.dll (291 bytes)
C:\ZMApi.dll (7972 bytes)
C:\KZSZ.ini (170 bytes)
C:\dc.dll (122 bytes)
C:\%original file name%.exe (17629 bytes)
C:\qadati.dll (111 bytes)
The Trojan deletes the following file(s):
C:\affxtltuxxcahbexesgi.dfg (0 bytes)
Registry activity
The process %original file name%.exe:2040 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 C9 D4 9D A9 14 E3 37 90 1E F2 21 2D E6 51 D1"
[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
Dropped PE files
MD5 | File path |
---|---|
dc6b73cbd1f6f5cec640a8c634ae50c8 | c:\UUWiseHelper.dll |
3acaceed9edcf17193c69b5409cec1e0 | c:\ZMApi.dll |
f803ad370a8649a143429f179af5f3ab | c:\dc.dll |
0a0ea34af52834bf26151c68f529c8ff | c:\%original file name%.exe |
842cb72bf02c2205d84c243ead552354 | c:\qadati.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\UUWiseHelper.dll (291 bytes)
C:\ZMApi.dll (7972 bytes)
C:\KZSZ.ini (170 bytes)
C:\dc.dll (122 bytes)
C:\%original file name%.exe (17629 bytes)
C:\qadati.dll (111 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: ?????
Product Name: ???????? Www.52Dfg.Com
Product Version: 1.0.0.0
Legal Copyright: ??????????[www.52dfg.com],??????,?????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ??,??,????????,????
Comments: ???????
Language: English (United States)
Company Name: ?????Product Name: ???????? Www.52Dfg.ComProduct Version: 1.0.0.0Legal Copyright: ??????????[www.52dfg.com],??????,?????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ??,??,????????,????Comments: ???????Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 4079616 | 1680384 | 5.54511 | 312bc13926ecac7c5c84874dde7042a3 |
UPX | 4083712 | 1146880 | 1145344 | 5.11038 | d0388ae2a5b368d42bdce8a0e6592c42 |
.idata | 5230592 | 4096 | 3072 | 3.12847 | 91ce9436013ba0178a143ce1f40334bb |
.rsrc | 5234688 | 86016 | 86016 | 2.33529 | 12c9e7ffd671b01dda9b1c51e02fea4d |
UPX | 5320704 | 4096 | 4096 | 5.53392 | 4d4df200352cd217f0c34181599066d4 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 24
0eb3eeccb56aea3257feed2919d3fd17
d43d1a418c9b1b477b7536847659a5db
0c7754c2774a1149de69979cb365f1f8
a88b40527691d4f84efdec09a8e78390
3ed17fe1fcb831e4bc3b40da5a6bd650
1b55fb364fd6b0d738c98152e7454608
f9251a28e752af06c50d4cdc6918e207
7ad74775558cb48b7e8fa7f966577fb0
8c60b001998397f7c942ba09118f6df5
e1272245b5b19259a02f2d1f75c3e0cf
cf56877724c62223134d217e5b43269c
73756da5d18d1ecf322b187e43a741eb
804ae40a18bc6c031985282cfd236472
a3e04192b789094ac73751d12891fda3
41c6d13da7697b538e65e54505028240
21a7bc29c7487c140f253a660846834e
195190cca6530238269fcc01259b200f
5bdc8cfe57b265f712555ddc0fe8d840
aa68fea7971a31e8474253999801b8e5
bf2b68f71b84ba9bd0c4abc17fcfb642
1192121e8ba728be56837d9fcf6f147a
756cc22c1882292460dd1682053e2a7a
5935dd6ac2bc984ebf1b5a60db52a09e
1a9ef403eb36590f0d61b583f0182f94
Network Activity
URLs
URL | IP |
---|---|
hxxp://92wg.sinaapp.com/softtj.php?act=add&softname=MZDS | 220.181.136.55 |
apisoft.df0535.com | 183.61.13.155 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /softtj.php?act=add&softname=MZDS HTTP/1.1
Referer: hXXp://92wg.sinaapp.com/softtj.php?act=add&softname=MZDS
Accept: */*
Accept-Language: zh-CN
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Host: 92wg.sinaapp.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Server: nginx
Date: Mon, 30 May 2016 00:02:32 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 208
Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /softtj.php was not found on this server.</p>.</body></html>.HTTP/1.1 404 Not Found..Server: nginx..Date: Mon, 30 May 2016 00:02:32 GMT..Content-Type: text/html; charset=iso-8859-1..Content-Length: 208..Connection: keep-alive..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /softtj.php was not found on this server.</p>.</body></html>...
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_2040:
.text
.text
h.idata
h.idata
H.rsrc
H.rsrc
t%SVh
t%SVh
qSShG
qSShG
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
ole32.dll
ole32.dll
advapi32.dll
advapi32.dll
Advapi32.dll
Advapi32.dll
user32.dll
user32.dll
oleaut32.dll
oleaut32.dll
kernel32.dll
kernel32.dll
ntdll.dll
ntdll.dll
UUWiseHelper.dll
UUWiseHelper.dll
dc.dll
dc.dll
ZMApi.dll
ZMApi.dll
qadati.dll
qadati.dll
RegOpenKeyA
RegOpenKeyA
RegEnumKeyExA
RegEnumKeyExA
RegCloseKey
RegCloseKey
ZwQueryValueKey
ZwQueryValueKey
ZwOpenKey
ZwOpenKey
RtlFormatCurrentUserKeyPath
RtlFormatCurrentUserKeyPath
ZwSetValueKey
ZwSetValueKey
ZwCreateKey
ZwCreateKey
CreateIoCompletionPort
CreateIoCompletionPort
uu_reportError
uu_reportError
uu_loginA
uu_loginA
ReportError
ReportError
ZM_ReportErrorA
ZM_ReportErrorA
QACloubLogin
QACloubLogin
QACloubReportError
QACloubReportError
{86AB1D8A-7995-4D86-AE5F-18710759228B}
{86AB1D8A-7995-4D86-AE5F-18710759228B}
E9326F3E-A23C-46D3-9C20-3AE825EFA0A7
E9326F3E-A23C-46D3-9C20-3AE825EFA0A7
{A068799B-7551-46b9-8CA8-EEF8357AFEA4}
{A068799B-7551-46b9-8CA8-EEF8357AFEA4}
/KZSZ.ini
/KZSZ.ini
\KZSZ.ini
\KZSZ.ini
skey
skey
hXXp://ic2.s21.qzone.qq.com/cgi-bin/feeds/feeds2_shield_pannel_get?uin=
hXXp://ic2.s21.qzone.qq.com/cgi-bin/feeds/feeds2_shield_pannel_get?uin=
data.data.hide_uins
data.data.hide_uins
].uin
].uin
data.data.hide_uins[
data.data.hide_uins[
hXXp://w.qzone.qq.com/cgi-bin/feeds/feeds2_shield_pannel_set?g_tk=
hXXp://w.qzone.qq.com/cgi-bin/feeds/feeds2_shield_pannel_set?g_tk=
qzreferrer=http://user.qzone.qq.com/
qzreferrer=http://user.qzone.qq.com/
WinHttp.WinHttpRequest.5.1
WinHttp.WinHttpRequest.5.1
application/x-www-form-urlencoded
application/x-www-form-urlencoded
MSScriptControl.ScriptControl
MSScriptControl.ScriptControl
function get__key(o) {
function get__key(o) {
a.push(i);
a.push(i);
//return JSON.stringify(jsonobj);
//return JSON.stringify(jsonobj);
if (Object.prototype.toString.apply(O) === '[object Array]') {
if (Object.prototype.toString.apply(O) === '[object Array]') {
for (var i = 0; i
for (var i = 0; i
S.push(O2String(O[i]));
S.push(O2String(O[i]));
J = '[' S.join(',') ']';
J = '[' S.join(',') ']';
else if (Object.prototype.toString.apply(O) === '[object String]') {
else if (Object.prototype.toString.apply(O) === '[object String]') {
J = '"' O.replace(/"/g,"\\\"").replace(/\r/g,"\\r").replace(/\n/g,"\\n") '"';
J = '"' O.replace(/"/g,"\\\"").replace(/\r/g,"\\r").replace(/\n/g,"\\n") '"';
else if (Object.prototype.toString.apply(O) === '[object Number]') {
else if (Object.prototype.toString.apply(O) === '[object Number]') {
else if (Object.prototype.toString.apply(O) === '[object Date]') {
else if (Object.prototype.toString.apply(O) === '[object Date]') {
J = "new Date(" O.getTime() ")";
J = "new Date(" O.getTime() ")";
else if (Object.prototype.toString.apply(O) === '[object RegExp]' || Object.prototype.toString.apply(O) === '[object Function]') {
else if (Object.prototype.toString.apply(O) === '[object RegExp]' || Object.prototype.toString.apply(O) === '[object Function]') {
J = O.toString();
J = O.toString();
else if (Object.prototype.toString.apply(O) === '[object Object]') {
else if (Object.prototype.toString.apply(O) === '[object Object]') {
t = typeof (O[i]) == 'string' ? '"' O[i].replace(/"/g,"\\\"").replace(/\r/g,"\\r").replace(/\n/g,"\\n") '"' : (typeof (O[i]) === 'object' ? O2String(O[i]) : O[i]);
t = typeof (O[i]) == 'string' ? '"' O[i].replace(/"/g,"\\\"").replace(/\r/g,"\\r").replace(/\n/g,"\\n") '"' : (typeof (O[i]) === 'object' ? O2String(O[i]) : O[i]);
S.push('\"' i '\"' ':' t);
S.push('\"' i '\"' ':' t);
J = '{' S.join(',') '}';
J = '{' S.join(',') '}';
\data.dat
\data.dat
hXXp://VVV.sz789.net/reg.aspx
hXXp://VVV.sz789.net/reg.aspx
hXXp://VVV.uudama.com/userReg.html
hXXp://VVV.uudama.com/userReg.html
hXXp://VVV.zhima365.com/userreg.php
hXXp://VVV.zhima365.com/userreg.php
hXXp://VVV.ruokuai.com/home/register
hXXp://VVV.ruokuai.com/home/register
hXXp://VVV.qadati.cn/Account/Register
hXXp://VVV.qadati.cn/Account/Register
\UUWiseHelper.dll
\UUWiseHelper.dll
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
SSSSh
SSSSh
ByScreen.JPG
ByScreen.JPG
operator
operator
GetProcessWindowStation
GetProcessWindowStation
E:\work\UUWiseHelper
E:\work\UUWiseHelper
\UUWiseHelper.pdb
\UUWiseHelper.pdb
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
OLEAUT32.dll
OLEAUT32.dll
SHLWAPI.dll
SHLWAPI.dll
urlmon.dll
urlmon.dll
dbghelp.dll
dbghelp.dll
gdiplus.dll
gdiplus.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
WS2_32.dll
WS2_32.dll
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
UUWiseHelper.DLL
UUWiseHelper.DLL
uu_easyRecognizeUrlA
uu_easyRecognizeUrlA
uu_easyRecognizeUrlW
uu_easyRecognizeUrlW
uu_loginW
uu_loginW
uu_recognizeByCodeTypeAndUrlA
uu_recognizeByCodeTypeAndUrlA
uu_recognizeByCodeTypeAndUrlW
uu_recognizeByCodeTypeAndUrlW
&
&
&softname
&softname
&
&
&scope&view&daylist&uinlist&gid&flag&filter&applist&refresh&aisortEndTime&aisortOffset&getAisort&aisortBeginTime&pagenum&externparam&firstGetGroup&icServerTime&mixnocache&scene&begintime&count&dayspac&sidomain&useutf8&outputhtmlfeed&rd
&scope&view&daylist&uinlist&gid&flag&filter&applist&refresh&aisortEndTime&aisortOffset&getAisort&aisortBeginTime&pagenum&externparam&firstGetGroup&icServerTime&mixnocache&scene&begintime&count&dayspac&sidomain&useutf8&outputhtmlfeed&rd
&style&version&needDelOpr&hideExtend&showcount&MORE_FEEDS_CGI&refer
&style&version&needDelOpr&hideExtend&showcount&MORE_FEEDS_CGI&refer
&i_login_uin
&i_login_uin
&unikey
&unikey
&_stp
&_stp
&curkey
&curkey
&opuin
&opuin
&syn_tweet_verson¶mstr&pic_template&richtype&richval&special_url&subrichtype&who&con
&syn_tweet_verson¶mstr&pic_template&richtype&richval&special_url&subrichtype&who&con
&special_url&subrichtype&pic_bo
&special_url&subrichtype&pic_bo
&
&
&
&
&daid&pt_qzone_sig&hide_title_bar&low_login&qlogin_auto_login&no_verifyimg&link_target&appid&style&target&s_url&pt_qr_app&pt_qr_link&self_regurl&pt_qr_help_link
&daid&pt_qzone_sig&hide_title_bar&low_login&qlogin_auto_login&no_verifyimg&link_target&appid&style&target&s_url&pt_qr_app&pt_qr_link&self_regurl&pt_qr_help_link
&u1&r
&u1&r
&appid&js_ver&js_type&login_sig
&appid&js_ver&js_type&login_sig
&pt_tea&pt_vcode&uin
&pt_tea&pt_vcode&uin
&aid&uin
&aid&uin
&uin
&uin
&js_ver&js_type&login_sig
&js_ver&js_type&login_sig
&pt_randsalt&u1&ptredirect&h&t&g&from_ui&ptlang&action
&pt_randsalt&u1&ptredirect&h&t&g&from_ui&ptlang&action
&uin
&uin
&&&&&&
&&&&&&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&&navigator.appVersion
&&navigator.appVersion
&
&
&
&
&
&
&
&
&
&
&
&
&&
&&
&
&
&
&
&&
&&
&
&
&password
&password
&softkey
&softkey
&&
&&
&
&
&
&
&
&
&
&
&
&
&&&&
&&&&
&kEy
&kEy
&
&
&sQL
&sQL
<.teq>
<.teq>
&
&
&
&
&password&repassword&email&qq&phone&name&softwareid
&password&repassword&email&qq&phone&name&softwareid
&password&repassword&email&qq&phone&name&softwareid
&password&repassword&email&qq&phone&name&softwareid
&password&prepaid_card&softwareid
&password&prepaid_card&softwareid
&password&prepaid_card&softwareid
&password&prepaid_card&softwareid
&password
&password
&password
&password
&
&
&SSh
&SSh
&
&
&softname
&softname
&
&
&scope&view&daylist&uinlist&gid&flag&filter&applist&refresh&aisortEndTime&aisortOffset&getAisort&aisortBeginTime&pagenum&externparam&firstGetGroup&icServerTime&mixnocache&scene&begintime&count&dayspac&sidomain&useutf8&outputhtmlfeed&rd
&scope&view&daylist&uinlist&gid&flag&filter&applist&refresh&aisortEndTime&aisortOffset&getAisort&aisortBeginTime&pagenum&externparam&firstGetGroup&icServerTime&mixnocache&scene&begintime&count&dayspac&sidomain&useutf8&outputhtmlfeed&rd
&style&version&needDelOpr&hideExtend&showcount&MORE_FEEDS_CGI&refer
&style&version&needDelOpr&hideExtend&showcount&MORE_FEEDS_CGI&refer
&i_login_uin
&i_login_uin
&unikey
&unikey
&_stp
&_stp
&curkey
&curkey
&opuin
&opuin
&syn_tweet_verson¶mstr&pic_template&richtype&richval&special_url&subrichtype&who&con
&syn_tweet_verson¶mstr&pic_template&richtype&richval&special_url&subrichtype&who&con
&special_url&subrichtype&pic_bo
&special_url&subrichtype&pic_bo
&
&
&
&
&daid&pt_qzone_sig&hide_title_bar&low_login&qlogin_auto_login&no_verifyimg&link_target&appid&style&target&s_url&pt_qr_app&pt_qr_link&self_regurl&pt_qr_help_link
&daid&pt_qzone_sig&hide_title_bar&low_login&qlogin_auto_login&no_verifyimg&link_target&appid&style&target&s_url&pt_qr_app&pt_qr_link&self_regurl&pt_qr_help_link
&u1&r
&u1&r
&appid&js_ver&js_type&login_sig
&appid&js_ver&js_type&login_sig
&pt_tea&pt_vcode&uin
&pt_tea&pt_vcode&uin
&aid&uin
&aid&uin
&uin
&uin
&js_ver&js_type&login_sig
&js_ver&js_type&login_sig
&pt_randsalt&u1&ptredirect&h&t&g&from_ui&ptlang&action
&pt_randsalt&u1&ptredirect&h&t&g&from_ui&ptlang&action
&uin
&uin
&&&&&&
&&&&&&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&&navigator.appVersion
&&navigator.appVersion
&
&
&
&
&
&
&
&
&
&
&
&
&&
&&
&
&
&
&
&&
&&
&
&
&password
&password
&softkey
&softkey
&&
&&
&
&
&
&
&
&
&
&
&
&
&&&&
&&&&
&
&
&
&
&password&repassword&email&qq&phone&name&softwareid
&password&repassword&email&qq&phone&name&softwareid
&password&repassword&email&qq&phone&name&softwareid
&password&repassword&email&qq&phone&name&softwareid
&password&prepaid_card&softwareid
&password&prepaid_card&softwareid
&password&prepaid_card&softwareid
&password&prepaid_card&softwareid
&password
&password
&password
&password
&
&
&
&
&:
&:
&
&
&
&
&
&
&
&
&
&
&joiner
&joiner
&non-joiner
&non-joiner
&More
&More
&en
&en
&ft
&ft
&
&
<:>
<:>
&
&
<:_:>
<:_:>
&y1
&y1