Trojan.Win32.FlyStudio_dfd41436d6 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:2040

Mutexes

The following mutexes were created/opened:

ShimCacheMutex

File activity

The process %original file name%.exe:2040 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\UUWiseHelper.dll (291 bytes)
C:\ZMApi.dll (7972 bytes)
C:\KZSZ.ini (170 bytes)
C:\dc.dll (122 bytes)
C:\%original file name%.exe (17629 bytes)
C:\qadati.dll (111 bytes)

The Trojan deletes the following file(s):

C:\affxtltuxxcahbexesgi.dfg (0 bytes)

Registry activity

The process %original file name%.exe:2040 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 C9 D4 9D A9 14 E3 37 90 1E F2 21 2D E6 51 D1"

[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

Dropped PE files

MD5	File path
dc6b73cbd1f6f5cec640a8c634ae50c8	c:\UUWiseHelper.dll
3acaceed9edcf17193c69b5409cec1e0	c:\ZMApi.dll
f803ad370a8649a143429f179af5f3ab	c:\dc.dll
0a0ea34af52834bf26151c68f529c8ff	c:\%original file name%.exe
842cb72bf02c2205d84c243ead552354	c:\qadati.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\UUWiseHelper.dll (291 bytes)
C:\ZMApi.dll (7972 bytes)
C:\KZSZ.ini (170 bytes)
C:\dc.dll (122 bytes)
C:\%original file name%.exe (17629 bytes)
C:\qadati.dll (111 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: ?????
Product Name: ???????? Www.52Dfg.Com
Product Version: 1.0.0.0
Legal Copyright: ??????????[www.52dfg.com],??????,?????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ??,??,????????,????
Comments: ???????
Language: English (United States)

Company Name: ?????Product Name: ???????? Www.52Dfg.ComProduct Version: 1.0.0.0Legal Copyright: ??????????[www.52dfg.com],??????,?????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ??,??,????????,????Comments: ???????Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	4079616	1680384	5.54511	312bc13926ecac7c5c84874dde7042a3
UPX	4083712	1146880	1145344	5.11038	d0388ae2a5b368d42bdce8a0e6592c42
.idata	5230592	4096	3072	3.12847	91ce9436013ba0178a143ce1f40334bb
.rsrc	5234688	86016	86016	2.33529	12c9e7ffd671b01dda9b1c51e02fea4d
UPX	5320704	4096	4096	5.53392	4d4df200352cd217f0c34181599066d4

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 24
0eb3eeccb56aea3257feed2919d3fd17
d43d1a418c9b1b477b7536847659a5db
0c7754c2774a1149de69979cb365f1f8
a88b40527691d4f84efdec09a8e78390
3ed17fe1fcb831e4bc3b40da5a6bd650
1b55fb364fd6b0d738c98152e7454608
f9251a28e752af06c50d4cdc6918e207
7ad74775558cb48b7e8fa7f966577fb0
8c60b001998397f7c942ba09118f6df5
e1272245b5b19259a02f2d1f75c3e0cf
cf56877724c62223134d217e5b43269c
73756da5d18d1ecf322b187e43a741eb
804ae40a18bc6c031985282cfd236472
a3e04192b789094ac73751d12891fda3
41c6d13da7697b538e65e54505028240
21a7bc29c7487c140f253a660846834e
195190cca6530238269fcc01259b200f
5bdc8cfe57b265f712555ddc0fe8d840
aa68fea7971a31e8474253999801b8e5
bf2b68f71b84ba9bd0c4abc17fcfb642
1192121e8ba728be56837d9fcf6f147a
756cc22c1882292460dd1682053e2a7a
5935dd6ac2bc984ebf1b5a60db52a09e
1a9ef403eb36590f0d61b583f0182f94

Network Activity

URLs

URL	IP
hxxp://92wg.sinaapp.com/softtj.php?act=add&softname=MZDS	220.181.136.55
apisoft.df0535.com	183.61.13.155

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /softtj.php?act=add&softname=MZDS HTTP/1.1

Referer: hXXp://92wg.sinaapp.com/softtj.php?act=add&softname=MZDS

Accept: */*

Accept-Language: zh-CN

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0

Host: 92wg.sinaapp.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Mon, 30 May 2016 00:02:32 GMT

Content-Type: text/html; charset=iso-8859-1

Content-Length: 208

Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /softtj.php was not found on this server.</p>.</body></html>.HTTP/1.1 404 Not Found..Server: nginx..Date: Mon, 30 May 2016 00:02:32 GMT..Content-Type: text/html; charset=iso-8859-1..Content-Length: 208..Connection: keep-alive..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /softtj.php was not found on this server.</p>.</body></html>...

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_2040:

.text

h.idata

H.rsrc

t%SVh

qSShG

t$(SSh

~%UVW

u$SShe

ole32.dll

advapi32.dll

Advapi32.dll

user32.dll

oleaut32.dll

kernel32.dll

ntdll.dll

UUWiseHelper.dll

dc.dll

ZMApi.dll

qadati.dll

RegOpenKeyA

RegEnumKeyExA

RegCloseKey

ZwQueryValueKey

ZwOpenKey

RtlFormatCurrentUserKeyPath

ZwSetValueKey

ZwCreateKey

CreateIoCompletionPort

uu_reportError

uu_loginA

ReportError

ZM_ReportErrorA

QACloubLogin

QACloubReportError

{86AB1D8A-7995-4D86-AE5F-18710759228B}

E9326F3E-A23C-46D3-9C20-3AE825EFA0A7

{A068799B-7551-46b9-8CA8-EEF8357AFEA4}

/KZSZ.ini

\KZSZ.ini

skey

hXXp://ic2.s21.qzone.qq.com/cgi-bin/feeds/feeds2_shield_pannel_get?uin=

data.data.hide_uins

].uin

data.data.hide_uins[

hXXp://w.qzone.qq.com/cgi-bin/feeds/feeds2_shield_pannel_set?g_tk=

qzreferrer=http://user.qzone.qq.com/

WinHttp.WinHttpRequest.5.1

application/x-www-form-urlencoded

MSScriptControl.ScriptControl

function get__key(o) {

a.push(i);

//return JSON.stringify(jsonobj);

if (Object.prototype.toString.apply(O) === '[object Array]') {

for (var i = 0; i

S.push(O2String(O[i]));

J = '[' S.join(',') ']';

else if (Object.prototype.toString.apply(O) === '[object String]') {

J = '"' O.replace(/"/g,"\\\"").replace(/\r/g,"\\r").replace(/\n/g,"\\n") '"';

else if (Object.prototype.toString.apply(O) === '[object Number]') {

else if (Object.prototype.toString.apply(O) === '[object Date]') {

J = "new Date(" O.getTime() ")";

else if (Object.prototype.toString.apply(O) === '[object RegExp]' || Object.prototype.toString.apply(O) === '[object Function]') {

J = O.toString();

else if (Object.prototype.toString.apply(O) === '[object Object]') {

t = typeof (O[i]) == 'string' ? '"' O[i].replace(/"/g,"\\\"").replace(/\r/g,"\\r").replace(/\n/g,"\\n") '"' : (typeof (O[i]) === 'object' ? O2String(O[i]) : O[i]);

S.push('\"' i '\"' ':' t);

J = '{' S.join(',') '}';

\data.dat

hXXp://VVV.sz789.net/reg.aspx

hXXp://VVV.uudama.com/userReg.html

hXXp://VVV.zhima365.com/userreg.php

hXXp://VVV.ruokuai.com/home/register

hXXp://VVV.qadati.cn/Account/Register

\UUWiseHelper.dll

`.rdata

@.data

.rsrc

@.reloc

SSSSh

ByScreen.JPG

operator

GetProcessWindowStation

E:\work\UUWiseHelper

\UUWiseHelper.pdb

KERNEL32.dll

USER32.dll

GDI32.dll

RegOpenKeyExW

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

SHLWAPI.dll

urlmon.dll

dbghelp.dll

gdiplus.dll

IPHLPAPI.DLL

WS2_32.dll

GetProcessHeap

GetCPInfo

UUWiseHelper.DLL

uu_easyRecognizeUrlA

uu_easyRecognizeUrlW

uu_loginW

uu_recognizeByCodeTypeAndUrlA

uu_recognizeByCodeTypeAndUrlW

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps