Gen.Variant.Strictor.1217_cfc7af3058 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):

Ãƒâ€šÃ‚Â¾ÃƒÆ’Ã‚ÂÃƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â®Ãƒâ€šÃ‚Â¸Ãƒâ€šÃ‚Â¨ÃƒÆ’Ã¢â‚¬â€œÃƒÆ’Ã‚Âº.exe:944

The Trojan injects its code into the following process(es):

%original file name%.exe:584

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_RasPbFileShimCacheMutex

File activity

The process %original file name%.exe:584 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KHYZ412V\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\K5MFCXY3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\9ifz\Ãƒâ€šÃ‚Â¾ÃƒÆ’Ã‚ÂÃƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â®Ãƒâ€šÃ‚Â¸Ãƒâ€šÃ‚Â¨ÃƒÆ’Ã¢â‚¬â€œÃƒÆ’Ã‚Âº.exe (1632 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\N4QZRPF3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\9ifz\dlcore.dll (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\I41HJ4J3\desktop.ini (67 bytes)

The process Ãƒâ€šÃ‚Â¾ÃƒÆ’Ã‚ÂÃƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â®Ãƒâ€šÃ‚Â¸Ãƒâ€šÃ‚Â¨ÃƒÆ’Ã¢â‚¬â€œÃƒÆ’Ã‚Âº.exe:944 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Desktop\Internet Explorer.lnk (809 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (44 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Internet Explorer.lnk (815 bytes)

Registry activity

The process %original file name%.exe:584 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C 7E 1E 6B 11 20 46 0A 2B 81 4D 5D 57 D9 20 50"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process Ãƒâ€šÃ‚Â¾ÃƒÆ’Ã‚ÂÃƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â®Ãƒâ€šÃ‚Â¸Ãƒâ€šÃ‚Â¨ÃƒÆ’Ã¢â‚¬â€œÃƒÆ’Ã‚Âº.exe:944 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Search_URL" = "http://www.2345.com/?k59918823"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Search Page" = "http://www.2345.com/?k59918823"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Search Bar" = "http://www.2345.com/?k59918823"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.2345.com/?k59918823"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Start Page" = "http://www.2345.com/?k59918823"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.2345.com/?k59918823"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Local Page" = "http://www.2345.com/?k59918823"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Page_URL" = "http://www.2345.com/?k59918823"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Main]
"Search Bar" = "http://www.2345.com/?k59918823"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.2345.com/?k59918823"
"Default_Page_URL" = "http://www.2345.com/?k59918823"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F F3 78 B7 89 35 F1 2C BB CC 4B EC 42 2D AA 29"

[HKCU\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage]
"Command" = "%Program Files%\Internet Explorer\iexplore.exe http://www.2345.com/?k59918823"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Main]
"Search Page" = "http://www.2345.com/?k59918823"
"Default_Page_URL" = "http://www.2345.com/?k59918823"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Use_Async_DNS" = "http://www.2345.com/?k59918823"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ãƒâ€šÃ‚Â½ÃƒÆ’Ã‚Â»ÃƒÆ’Ã¢â‚¬â€œÃƒâ€šÃ‚Â¹Ãƒâ€šÃ‚ÂºÃƒÆ’Ã‚Â³Ãƒâ€šÃ‚Â¿ÃƒÆ’Ã¢â‚¬Â°ÃƒÆ’Ã¢â‚¬Å¾ÃƒÆ’Ã…â€œÃƒâ€šÃ‚Â»ÃƒÆ’Ã‚Â¡ÃƒÆ’Ã¢â‚¬ËœÃƒÆ’Ã‚ÂÃƒÆ’Ã¢â‚¬â€œÃƒÆ’Ã‹Å“ÃƒÆ’Ã¢â‚¬Å“Ãƒâ€šÃ‚Â°ÃƒÆ’Ã‚ÂÃƒÆ’Ã‚Â¬ÃƒÆ’Ã‚ÂÃƒâ€šÃ‚ÂµÃƒÆ’Ã‚ÂÃƒâ€šÃ‚Â³Ãƒâ€šÃ‚ÂµÃƒÆ’Ã¢â‚¬Å¾ÃƒÆ’Ã…Â½ÃƒÆ’Ã‹â€ Ãƒâ€šÃ‚Â¶Ãƒâ€šÃ‚Â¨ÃƒÆ’Ã‚ÂÃƒÆ’Ã¢â‚¬ÂÃƒâ€šÃ‚Â£Ãƒâ€šÃ‚Â¬Ãƒâ€šÃ‚Â½Ãƒâ€šÃ‚Â¨ÃƒÆ’Ã¢â‚¬â„¢ÃƒÆ’Ã‚Â©Ãƒâ€šÃ‚Â²Ãƒâ€šÃ‚Â»ÃƒÆ’Ã¢â‚¬â„¢Ãƒâ€šÃ‚ÂªÃƒâ€šÃ‚Â½ÃƒÆ’Ã‚Â»ÃƒÆ’Ã¢â‚¬â€œÃƒâ€šÃ‚Â¹Ãƒâ€šÃ‚Â£Ãƒâ€šÃ‚Â¡" = "%Documents and Settings%\%current user%\Application Data\9ifz\Ãƒâ€šÃ‚Â¾ÃƒÆ’Ã‚ÂÃƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â®Ãƒâ€šÃ‚Â¸Ãƒâ€šÃ‚Â¨ÃƒÆ’Ã¢â‚¬â€œÃƒÆ’Ã‚Âº.exe"

Dropped PE files

MD5	File path
66504b12f4f8f5b70a8574e0370937a4	c:\Documents and Settings\"%CurrentUserName%"\Application Data\9ifz\dlcore.dll
4e636c45b40b2ff461e786206e74ce55	c:\Documents and Settings\"%CurrentUserName%"\Application Data\9ifz\Ã‚Â¾ÃƒÂÃ‚Â°Ã‚Â®Ã‚Â¸Ã‚Â¨Ãƒâ€“ÃƒÂº.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
Ãƒâ€šÃ‚Â¾ÃƒÆ’Ã‚ÂÃƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â®Ãƒâ€šÃ‚Â¸Ãƒâ€šÃ‚Â¨ÃƒÆ’Ã¢â‚¬â€œÃƒÆ’Ã‚Âº.exe:944
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KHYZ412V\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\K5MFCXY3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\9ifz\Ãƒâ€šÃ‚Â¾ÃƒÆ’Ã‚ÂÃƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â®Ãƒâ€šÃ‚Â¸Ãƒâ€šÃ‚Â¨ÃƒÆ’Ã¢â‚¬â€œÃƒÆ’Ã‚Âº.exe (1632 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\N4QZRPF3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\9ifz\dlcore.dll (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\I41HJ4J3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Desktop\Internet Explorer.lnk (809 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (44 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Internet Explorer.lnk (815 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ãƒâ€šÃ‚Â½ÃƒÆ’Ã‚Â»ÃƒÆ’Ã¢â‚¬â€œÃƒâ€šÃ‚Â¹Ãƒâ€šÃ‚ÂºÃƒÆ’Ã‚Â³Ãƒâ€šÃ‚Â¿ÃƒÆ’Ã¢â‚¬Â°ÃƒÆ’Ã¢â‚¬Å¾ÃƒÆ’Ã…â€œÃƒâ€šÃ‚Â»ÃƒÆ’Ã‚Â¡ÃƒÆ’Ã¢â‚¬ËœÃƒÆ’Ã‚ÂÃƒÆ’Ã¢â‚¬â€œÃƒÆ’Ã‹Å“ÃƒÆ’Ã¢â‚¬Å“Ãƒâ€šÃ‚Â°ÃƒÆ’Ã‚ÂÃƒÆ’Ã‚Â¬ÃƒÆ’Ã‚ÂÃƒâ€šÃ‚ÂµÃƒÆ’Ã‚ÂÃƒâ€šÃ‚Â³Ãƒâ€šÃ‚ÂµÃƒÆ’Ã¢â‚¬Å¾ÃƒÆ’Ã…Â½ÃƒÆ’Ã‹â€ Ãƒâ€šÃ‚Â¶Ãƒâ€šÃ‚Â¨ÃƒÆ’Ã‚ÂÃƒÆ’Ã¢â‚¬ÂÃƒâ€šÃ‚Â£Ãƒâ€šÃ‚Â¬Ãƒâ€šÃ‚Â½Ãƒâ€šÃ‚Â¨ÃƒÆ’Ã¢â‚¬â„¢ÃƒÆ’Ã‚Â©Ãƒâ€šÃ‚Â²Ãƒâ€šÃ‚Â»ÃƒÆ’Ã¢â‚¬â„¢Ãƒâ€šÃ‚ÂªÃƒâ€šÃ‚Â½ÃƒÆ’Ã‚Â»ÃƒÆ’Ã¢â‚¬â€œÃƒâ€šÃ‚Â¹Ãƒâ€šÃ‚Â£Ãƒâ€šÃ‚Â¡" = "%Documents and Settings%\%current user%\Application Data\9ifz\Ãƒâ€šÃ‚Â¾ÃƒÆ’Ã‚ÂÃƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â®Ãƒâ€šÃ‚Â¸Ãƒâ€šÃ‚Â¨ÃƒÆ’Ã¢â‚¬â€œÃƒÆ’Ã‚Âº.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	606710	610304	4.5393	a5447e93e825d09573b62f74f55725fe
.rdata	614400	654016	655360	4.5704	3691855c2e0dced4d96cc1fef92a8f52
.data	1269760	187208	73728	3.51461	51f92e5c7c9b6e604fd6e1384f0bba44
.rsrc	1458176	33536	36864	3.24504	ff3013ea99dc8aca07048f5c9fe5c3d6

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://captcha.qq.com/getimage?aid=1007901&r=0.8991660715926585	112.90.83.73

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /getimage?aid=1007901&r=0.8991660715926585 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: captcha.qq.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: tencent http server

Accept-Ranges: bytes

Pragma: No-cache

P3P: CP=CAO PSA OUR

Content-Length: 1662

Set-Cookie: verifysession=h01b15ac50ade777dac301024403ae7083c0eb98bcac15a7b5305e83b2819fbfc807475158e07e26a5f; PATH=/; DOMAIN=qq.com;

Connection: close

Content-Type: image/jpeg

......JFIF............."f4a1b3c....F.......F....w.A........C................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc...C......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc......5...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..|..|...wc..Tnw.........q..9....Z.i%E....8...q.H.m....g..>..)!kR..G...`r.p>..n...A.#...TL.q>..K{. gk..........Y...,...#.....RX\Ird.......O....5-...U.....X..6...O8=..n.q#.....,.........j...5..P9.,.J:...#..~4..$E.t..{*......g...-.9.S<..O..F/...&...e.......6..,Z...e.dB.......T.GLc/.e ..6...0.......up..(((...(......ko1.^&...J.]Z0F H...*R......8.w....t~....4...#.......1..e#.c....E...J....*.....j....b...c....LB.JX`./...A)l..V.{l>.,.{.....~...r.6...w...........W..f.M..9B....G...t[..2I ..I.7......?.@.^.R.......w.....i..Z...."....@...........:". ~jMAsn..k<..!;.......@84.OFL..Y..D.......,..yA...s...um..C.........I}v.V.h....-.....$mJ...r.[n.I......e/<o.x... .?...~..^K..2L...qT..F.......l....x.2ra..@.=.3s.....\.G2....MY.f.Kh...l.x. .9#...A.].aE.PPQE..UK....i....:.......m.._...T..8rf..L...Y.U.~F.$...Rbm.....-s...d..P...!F9.....}.u*FV$#.W..S..~5r..]..

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_584:

.text

`.rdata

@.data

.rsrc

t$(SSh

~%UVW

u$SShe

atl.dll

wininet.dll

user32.dll

kernel32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

MsgWaitForMultipleObjects

GetWindowsDirectoryA

hXXp://captcha.qq.com/getimage?aid=1007901&r=0.8991660715926585

1061036080@qq.com

&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone

&clientkey=

hXXp://ptlogin2.qq.com/jump?clientuin=

hXXp://qzs.qq.com/qzone/v5/loginsucc.html?para=izone

skey

#home&syn_tweet_verson=1&richtype=&richval=&special_url=&subrichtype=&who=1&con=qm

qzreferrer=http://user.qzone.qq.com/

hXXp://taotao.qq.com/cgi-bin/emotion_cgi_publish_v6?g_tk=

qzreferrer=http://cnc.qzs.qq.com/qzone/v6/setting/profile/profile.html?tab=base&nickname=

hXXp://w.qzone.qq.com/cgi-bin/user/cgi_apply_updateuserinfo_new?g_tk=

qzreferrer=http://cnc.qzs.qq.com/qzone/v6/setting/profile/profile.html?tab=space&spacename=

hXXp://w.cnc.qzone.qq.com/cgi-bin/user/cgi_apply_updateuserinfo_new?g_tk=

&secverifykey=28Q12062209183668_2209183668

&source=1&blogType=0&lp_type=0&lp_flag=0&lp_id=79208&lp_style=16843520&autograph=1&topFlag=0&feeds=1&tweetFlag=0&rightType=1&uin=

&html=

qzreferrer=http://cnc.qzs.qq.com/qzone/newblog/v5/editor.html#opener=refererurl&source=1&refererurl=http%3A%2F%2Fcnc.qzs.qq.com%2Fqzone%2Fapp%2Fblog%2Fv6%2Fbloglist.html%23nojump%3D1%26page%3D1%26catalog%3Dlist&cate=

hXXp://b11.cnc.qzone.qq.com/cgi-bin/blognew/add_blog?g_tk=

SSOAxCtrlForPTLogin.SSOForPTLogin2

hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin

document.body.innerHTML=GetuinKey();

function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

https

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

len = str.length; i

var t = QZONE.FormSender;

if (t && t.pluginsPool) t.pluginsPool.formHandler.push(function(fm) {

var a = QZFL.string.trim(fm.action);

a = (a.indexOf("?") > -1 ? "&": "?") "g_tk=" QZFL.pluginsDefine.getACSRFToken();

fm.action = a

\dlcore.dll

.reloc

GetProcessHeap

KERNEL32.dll

CryptDeriveKey

CryptDestroyKey

RegCloseKey

RegCreateKeyExA

RegOpenKeyA

ADVAPI32.dll

SHELL32.dll

USER32.dll

SHLWAPI.dll

ole32.dll

MSVCRT.dll

dlcore.dll

hXXp://VVV.2345.com/?k59918823

VVV.9ifz.org

3|CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command|"%Program Files%\Internet Explorer\iexplore.exe" hXXp://VVV.2345.com/?k59918823

3|Software\Microsoft\Internet Explorer\Main\Start Page|hXXp://VVV.2345.com/?k59918823

3|Software\Microsoft\Internet Explorer\Main\Default_Page_URL|hXXp://VVV.2345.com/?k59918823

3|Software\Policies\Microsoft\Internet Explorer\Main\Default_Page_URL|hXXp://VVV.2345.com/?k59918823

3|Software\Policies\Microsoft\Internet Explorer\Main\Search Bar|hXXp://VVV.2345.com/?k59918823

3|Software\Policies\Microsoft\Internet Explorer\Main\Search Page|hXXp://VVV.2345.com/?k59918823

3|Software\Policies\Microsoft\Internet Explorer\Main\Start Page|hXXp://VVV.2345.com/?k59918823

4|SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL|hXXp://VVV.2345.com/?k59918823

4|SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL|hXXp://VVV.2345.com/?k59918823

4|SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Use_Async_DNS|hXXp://VVV.2345.com/?k59918823

4|SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Bar|hXXp://VVV.2345.com/?k59918823

4|SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page|hXXp://VVV.2345.com/?k59918823

4|SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page|hXXp://VVV.2345.com/?k59918823

4|SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page|hXXp://VVV.2345.com/?k59918823

4|SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\Start Page|hXXp://VVV.2345.com/?k59918823

4|SOFTWARE\Microsoft\Internet Explorer\MAIN\Start Page|hXXp://VVV.2345.com/?k59918823

5|S-1-5-21-3053028586-37942918-3155121407-500\Software\Microsoft\Internet Explorer\Main\Start Page|hXXp://VVV.2345.com/?k59918823*.lnk

1027663760

iexplore.exe,Internet Explorer

sogouexplorer.exe,

Firefox.exe,

opera.exe,opera

360se.exe,360

chrome.exe,google

360chrome.exe,360

baidubrowser.exe,

QQbrowser.exe,QQ

leibao.exe,

2345Explorer.exe,2345

2345Chrome.exe,2345

firefox.exe,

maxthon.exe,

Juzi.exe,

taobrowser.exe,

yybrowser.exe,YY

yyexplorer.exe,YY

http\shell\open\command\

advapi32.dll

shlwapi.dll

program internal error number is %d.

:"%s"

:"%s".

.ndata

@.reloc

;~TtCP

FtPj

RegDeleteKeyExW

Kernel32.DLL

PSAPI.DLL

operator

GetProcessWindowStation

127.0.0.1

0.0.0.0

,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u

upload_data.qq.com

121.14.102.16

COMM:%u,%u,%u,%I64u,%I64u,%d,%d,%d,%d,%d,%d,%d,%d,%d

,0,0,0,0,0

User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows Xp)

Host: %s:%d

(%d) d:d:d.d000 %s: %s

pdlxf.qq.com

fs-tcp-conn.qq.com

stun.qq.com

xuanfengnet.qq.com

fs-hello.qq.com

fs-conn.qq.com

fs-h2u.qq.com

fs-report.qq.com

R:\TempView\Misc\Setup3\build\Release\QQSetupEx.pdb

WS2_32.dll

NETAPI32.dll

VERSION.dll

CreatePipe

GetWindowsDirectoryW

GDI32.dll

RegOpenKeyExW

RegCreateKeyW

RegDeleteKeyW

RegEnumKeyW

RegCreateKeyExW

SHFileOperationW

ShellExecuteExW

ShellExecuteW

CryptCATCatalogInfoFromContext

WTHelperGetProvCertFromChain

WINTRUST.dll

CertGetNameStringW

CRYPT32.dll

GetCPInfo

.?AVCVideoMsg@@

zcÃ

^SQLS^

'%cMMV#)

Hummer Backup Setup EXE

5;7,8084888

>#> >[>

?#?-?2?7?

5_5X5o5

7&8 80888

>#>(>->7>

?)?.?3?=?

0'1?1.6:6

4!4%4)4-4

7|7g7

? ?$?(?,?0?

6 6$6(6,60646

Thawte Certification1

hXXp://ocsp.thawte.com0

.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

hXXp://ts-ocsp.ws.symantec.com07

hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0

hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

.Class 3 Public Primary Certification Authority0

hXXp://crl.verisign.com/pca3.crl0

hXXps://VVV.verisign.com/cps0

#hXXp://logo.verisign.com/vslogo.gif04

hXXp://ocsp.verisign.com0>

2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,

/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D

hXXps://VVV.verisign.com/rpa0

hXXp://ocsp.verisign.com0;

/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0

hXXps://VVV.verisign.com/cps0*

#hXXp://crl.verisign.com/pca3-g5.crl04

hXXp://ocsp.verisign.com0

admin@9ifz.org

_r=Ã¨Â¯Â·Ã¨Â¾â€œÃ¥â€¦Â¥Ã©â€šÂ®Ã§Â®Â±Ã¥Å“Â°Ã¥Ââ‚¬Ã¯Â¼Å’Ã¥Â¦â€šzhangsan@text.com_s=

_t=

&type=anonymous&arg=f=

hXXp://tool.chacuo.net/mailanonymous/

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

MSIMG32.dll

MSVFW32.dll

SkinH_EL.dll

@atl.dll

g

l#7l%x

(.eYQ%l

%d&&'

123456789

00003333

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

RASAPI32.dll

WinExec

GetKeyState

GetViewportOrgEx

WINMM.dll

WINSPOOL.DRV

RegOpenKeyExA

ShellExecuteA

OLEAUT32.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

libpng error: %s

libpng warning: %s

1.1.3

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

Software\Microsoft\Windows\CurrentVersion

*?|/":

invalid registry key

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

RMDir: RemoveDirectory failed("%s")

RMDir: RemoveDirectory("%s")

RMDir: RemoveDirectory invalid input("%s")

Delete: DeleteFile failed("%s")

Delete: DeleteFile("%s")

install.log

Section: "%s"

.DEFAULT\Control Panel\International

logging set to %d

settings logging to %d

WriteReg: error creating key "%s\%s"

WriteReg: error writing into "%s\%s" "%s"

WriteRegDWORD: "%s\%s" "%s"="0xx"

WriteRegExpandStr: "%s\%s" "%s"="%s"

WriteRegStr: "%s\%s" "%s"="%s"

DeleteRegKey: "%s\%s"

DeleteRegValue: "%s\%s" "%s"

WriteINIStr: wrote [%s] %s=%s in %s

CopyFiles "%s"->"%s"

Exec: failed createprocess ("%s")

Exec: success ("%s")

Exec: command="%s"

ExecShell: success ("%s": file:"%s" params:"%s")

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d

Exch: stack

RMDir: "%s"

MessageBox: %d,"%s"

Delete: "%s"

Rename failed: %s

Rename: %s

IfFileExists: file "%s" does not exist, jumping %d

IfFileExists: file "%s" exists, jumping %d

CreateDirectory: "%s" created

CreateDirectory: can't create "%s" - a file already exists

CreateDirectory: can't create "%s" (err=%d)

CreateDirectory: "%s" (%d)

SetFileAttributes: "%s":X

Sleep(%d)

detailprint: %s

Call: %d

Aborting: "%s"

Jump: %d

HKERNEL32.DLL

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

hXXp://dldir1.qq.com/qqfile/qq/plugin/setuppkg.7z.output

_TX~QQSetupEx~0503~A1C22B84-CE8D-437A-AA60-6D3ABCB18ACF

RCreateWindowsDirTemp

R:\TempView\Misc\Setup3\BackupDownloader\BackupDownload.cpp

create folder :%s error, errcode:%lu

dir:%s

ParseCmdLine

`anonymous-namespace'::ParseCmdLine

cmd line

r:\tempview\misc\setup3\backupdownloader\installobject\InstallObject.h

GetExitCodeProcess exit code : %u

CInstallObjectAgent::CloseProcessHandle

ID=%d

r:\tempview\misc\setup3\backupdownloader\installobject\InstallObjectDefault.h

%d.%d.%d.%d

R:\TempView\Misc\Setup3\BackupDownloader\InstallObject\InstallObjectDefault.cpp

%s\drivers\usbvideo.sys

usbvideo.sys file version: %s

5.1.2600.2729

usbvideo.sys file version is big than 5.1.2600.2729, no need install KB899271

SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB899271

has register key:SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB899271 , no need install KB899271

hXXp://download.microsoft.com/download/4/6/0/460ca2ec-55b8-46d6-afb6-b644a7e03d71/WindowsXP-KB899271-v4-x86-CHS.exe

hXXp://dldir1.qq.com/music/clntupate/QzoneMusicInstall.exe

hXXp://dldir1.qq.com/music/clntupate/QQPhotoDrawExSetupForQQ.exe

hXXp://dldir1.qq.com/P2PUpdate/P2PSetup.exe

hXXp://dldir1.qq.com/qqfile/qq/videomsg/VideoMsgInstall.exe

hXXp://dldir1.qq.com/qqfile/qq/plugin/VideoShowPlayerInstall.exe

hXXp://dldir1.qq.com/qqfile/qq/plugin/VideoBeautyInstall.exe

hXXp://dldir1.qq.com/invc/cyclone/QQMiniDL_Setup.exe

hXXp://dlied6.qq.com/invc/xfspeed/kxg/versetup/QQWifiDL.exe

Copy File : %s to %s error, errcode:%lu

hXXp://dldir1.qq.com/qqfile/qq/plugin/QQGameMicro_setup.exe

\QQGame.exe

QQGame.exe

hXXp://dldir1.qq.com/qqfile/qq/plugin/HotWordInstall.exe

hXXp://androidpc.app.qq.com/app1/vertis.do?id=201409090001

BrowserInstaller.exe

@hXXp://dldl.qq.com/dl/qqie8

hXXp://dldl.qq.com/dl/qq

hXXp://dldir1.qq.com/music/clntupate/QQMusicDownloader.exe

hXXp://dldir1.qq.com/qqtv/qqlivesetup.exe

QQBrowser_Setup_QQ.exe

hXXp://dldir3.qq.com/minigamefile/QQGameDownloader.exe

hXXp://ws.sj.qq.com/webservices/download.do?yw=qq

QQPhoneManager_700024.exe

\rundll32.exe

R:\TempView\Misc\Setup3\BackupDownloader\Util\7zUtil.cpp

decoder doesn't support this archive

ERROR #%d

gfile path : %s

R:\TempView\Misc\Setup3\BackupDownloader\Util\DecryptUtil.cpp

Open file failed, error code : %u

Get file size failed, error code : %u

File size too large, HighPart = %u

AR:\TempView\Misc\Setup3\BackupDownloader\DataReport\DataReport.cpp

DataReport::UploadInstallResult

log.tlg

\\.\PhysicalDrive0

Siphlpapi.dll

ACreateDownloader. uiCustomID = %d

strFilePath = %s

uiCustomID = %d

CDownload::IsWorking(). m_bInited = %d

strUrl = %s

strFileName = %s

CDownload::DeleteTask(). uiTaskID = %d

CDownload::HandleDeleteTask(). uiTaskID = %d

CDownload::DeleteTask(). strUrl = %s

CDownload::HandleDeleteTask(). strUrl = %s

CDownload::SetDownloadSpeed(). uiSpeed = %d

CDownload::SetP2PUploadSpeed(). uiSpeed = %d

CDownload::HandleSetP2PUploadSpeed(). uiSpeed = %d

CDownload::SetSafeMode(). bSafeMode = %d

CDownload::HandleSetSafeMode(). bSafeMode = %d

stProxyInfo.eProxyType = %d

stProxyInfo.strProxyIP = %s

stProxyInfo.usProxyPort = %d

CDownload::OnNotify()->OnDownloadComplete. uiTaskID = %d, uiResult = %d, uiErrorCode = %d, uiDetailErrorCode = %d

Adlcore.dll

QQPCDetector.dll

R:\TempView\Misc\Setup3\BackupDownloader\Network\BizInstallerMgr.cpp

task:%lu, download error code:%d

task:%lu, filename:%s

%d not need to download

%d need to download

name = %s

url = %s

args = %s

filename = %s

dlcore dll not exist, file:%s

iter->bFinished:%d

Start ObjectId:%u

m_oDownloadMgr.StartTask returns:%d

default file %s download ok, local file : %s

optional file %s download ok, local file : %s

%s...

ObjId: %u

Name: %s

Url: %s

Args: %s

Filename: %s

install a file:%s

run install failed, error code : %u

GetDectectorResult() successed, wording: %s

RunDetector successed, dwOperator == %d

RunDetector failed, dwOperator == %d

dwOperator Invaild, dwOperator == %d

GetInstallObjsReportString

CBizInstallerMgr::GetInstallObjsReportString

R:\TempView\Misc\Setup3\BackupDownloader\Network\BizInstallerWindow.cpp

WM_TASKTRAY_MSG

dwCookie:%d

R:\TempView\Misc\Setup3\BackupDownloader\Network\DownloadMgr.cpp

CreateDownloadTask,Url:%s, localPath:%s

CDownloadMgr::CreateHttpDownloadTask

m_oDownloader.StartTask, dwCookie:%d, return %d

CDownloadMgr::DeleteTask, dwCookie:%d

m_mapCookieToTask.erase, dwCookie:%d

szFileName = %s

7.1.14522.0

1, 0, 6, 6

- Skin.dll

(*.*)

%original file name%.exe_584_rwx_10000000_0003E000:

`.rsrc

L$(h%f

SSh0j

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ã