Trojan.Crypt.IW (BitDefender), TrojanDownloader:Win32/Dogkild.O (Microsoft), Trojan-Dropper.Win32.Mudrop.bnj (Kaspersky), Trojan.Win32.Generic.pak!cobra (VIPRE), Trojan.MulDrop.32557 (DrWeb), Trojan.Generic!IK (Emsisoft), Generic BackDoor!bfe (McAfee), Infostealer.Tarno.B (Symantec), Trojan.Generic (Ikarus), Trojan:W32/Agent.DQRS (FSecure), Worm/Generic_r.GP (AVG), Win32:Malware-gen (Avast), BKDR_ELAN.X (TrendMicro), Adware.Generic.356429 (AdAware), Backdoor.Win32.PcClient.FD, GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan-Downloader, Trojan, Backdoor, Worm, Adware, WormAutorun, Malware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 47df16553e0ee66761f8d7f76c7f9c68
SHA1: b37802155626012719d5aeffd04bfcb6b3a72436
SHA256: 5abefd84958312c6c7237a898d08c019cd5d561337855310b83468a3690de456
SSDeep: 6144:/R2zP yfCBqacKMBgx/qv zghESlG91Xl2NRM:QzCBqfNSiv85N6RM
Size: 225925 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2005-12-10 07:55:16
Analyzed on: WindowsXP SP3 32-bit
Summary: Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Adware's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Adware creates the following process(es):
taskkill.exe:676
taskkill.exe:1528
taskkill.exe:1232
%original file name%.exe:912
sc.exe:1620
rundll32.exe:1108
cacls.exe:1188
cacls.exe:1264
The Adware injects its code into the following process(es):
22.exe:664
QvodSetupPlus3.0.exe:1300
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:912 makes changes in the file system.
The Adware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\22.exe (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QvodSetupPlus3.0.exe (3497 bytes)
The Adware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsd1.tmp (0 bytes)
The process 22.exe:664 makes changes in the file system.
The Adware creates and/or writes to the following file(s):
%WinDir%\phpq.dll (22141559 bytes)
C:\autorun.inf (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QvodSetupPlus.exe.!qd (1045 bytes)
C:\ (4 bytes)
%WinDir% (96 bytes)
%System%\func.dll (18563831 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (8 bytes)
C:\1.exe (32 bytes)
C:\$Directory (288 bytes)
%System%\config (108 bytes)
%System%\drivers\pcidump.sys (5404535 bytes)
%System%\drivers\etc\hosts (5 bytes)
%System%\drivers (96 bytes)
%System% (744 bytes)
The process rundll32.exe:1108 makes changes in the file system.
The Adware creates and/or writes to the following file(s):
%System%\drivers\acpiec.sys (14 bytes)
The process QvodSetupPlus3.0.exe:1300 makes changes in the file system.
The Adware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\qd.ini (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QvodSetupPlus.exe.!qd (328595 bytes)
Registry activity
The process taskkill.exe:676 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 41 26 79 95 7B DD 39 FF 25 9E 0B 28 D5 81 65"
The process taskkill.exe:1528 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 39 1A 5E B8 9A 05 16 06 CC 99 76 D0 E3 2B BA"
The process taskkill.exe:1232 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 34 52 7D CB 2B C6 60 F9 3B FF 57 83 7B C1 79"
The process %original file name%.exe:912 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A 41 C9 70 FF 60 07 FF CE 9C A3 7E 8C 4F 67 E7"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"22.exe" = "Windows Calculator"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"QvodSetupPlus3.0.exe" = "QvodInstall Module"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process sc.exe:1620 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D9 4F F2 F4 E7 40 C9 B2 03 A7 CB 23 36 25 75 E2"
The process rundll32.exe:1108 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 0D 44 48 23 F5 D6 9B 22 42 91 58 23 6F FA 39"
The process QvodSetupPlus3.0.exe:1300 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "58 C8 EA 85 8E 0B DE 73 8E D8 15 17 B6 38 7F 12"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp]
"QvodSetupPlus3.0.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\QvodSetupPlus3.0.exe:*:Enabled:QVOD"
The process cacls.exe:1188 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 94 E8 EB 75 36 BE B0 89 A9 EF 37 9E 77 E7 C0"
The process cacls.exe:1264 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 50 9B ED E0 21 50 80 7B 3B 94 86 CE 7E B6 33"
Dropped PE files
MD5 | File path |
---|---|
90bf4f7df217c61c1d4de5cd35f575dd | c:\1.exe |
90bf4f7df217c61c1d4de5cd35f575dd | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\22.exe |
813a50e98c2713fe162850040e6d4288 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\QvodSetupPlus3.0.exe |
8d455599edebbc0ff48815b217eee92f | c:\WINDOWS\LastGood\system32\drivers\acpiec.sys |
681a7a72890e60526b04c65130b658ec | c:\WINDOWS\phpq.dll |
9859c0f6936e723e4892d7141b1327d5 | c:\WINDOWS\system32\dllcache\acpiec.sys |
8d455599edebbc0ff48815b217eee92f | c:\WINDOWS\system32\drivers\OLD4.tmp |
601b3f2466bfa6989b9c7586b5ba54aa | c:\WINDOWS\system32\drivers\pcidump.sys |
534efcd3197edc9906072345a4b97ef7 | c:\WINDOWS\system32\func.dll |
HOSTS file anomalies
The Adware modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 5743 bytes in size. The following strings are added to the hosts file listed below:
127.0.0.1 | v.onondown.com.cn |
127.0.0.2 | ymsdasdw1.cn |
127.0.0.3 | h96b.info |
127.0.0.0 | fuck.zttwp.cn |
127.0.0.0 | www.hackerbf.cn |
127.0.0.0 | geekbyfeng.cn |
127.0.0.0 | 121.14.101.68 |
127.0.0.0 | ppp.etimes888.com |
127.0.0.0 | www.bypk.com |
127.0.0.0 | CSC3-2004-crl.verisign.com |
127.0.0.1 | va9sdhun23.cn |
127.0.0.0 | udp.hjob123.com |
127.0.0.2 | bnasnd83nd.cn |
127.0.0.0 | www.gamehacker.com.cn |
127.0.0.0 | gamehacker.com.cn |
127.0.0.3 | adlaji.cn |
127.0.0.1 | 858656.com |
127.1.1.1 | bnasnd83nd.cn |
127.0.0.1 | my123.com |
127.0.0.0 | user1.12-27.net |
127.0.0.1 | 8749.com |
127.0.0.0 | fengent.cn |
127.0.0.1 | 4199.com |
127.0.0.1 | user1.16-22.net |
127.0.0.1 | 7379.com |
127.0.0.1 | 2be37c5f.3f6e2cc5f0b.com |
127.0.0.1 | 7255.com |
127.0.0.1 | user1.23-12.net |
127.0.0.1 | 3448.com |
127.0.0.1 | www.guccia.net |
127.0.0.1 | 7939.com |
127.0.0.1 | a.o1o1o1.nEt |
127.0.0.1 | 8009.com |
127.0.0.1 | user1.12-73.cn |
127.0.0.1 | piaoxue.com |
127.0.0.1 | 3n8nlasd.cn |
127.0.0.1 | kzdh.com |
127.0.0.0 | www.sony888.cn |
127.0.0.1 | about.blank.la |
127.0.0.0 | user1.asp-33.cn |
127.0.0.1 | 6781.com |
127.0.0.0 | www.netkwek.cn |
127.0.0.1 | 7322.com |
127.0.0.0 | ymsdkad6.cn |
127.0.0.0 | www.lkwueir.cn |
127.0.0.1 | 06.jacai.com |
127.0.1.1 | user1.23-17.net |
127.0.0.1 | 1.jopenkk.com |
127.0.0.0 | upa.luzhiai.net |
127.0.0.1 | 1.jopenqc.com |
127.0.0.0 | www.guccia.net |
127.0.0.1 | 1.joppnqq.com |
127.0.0.0 | 4m9mnlmi.cn |
127.0.0.1 | 1.xqhgm.com |
127.0.0.0 | mm119mkssd.cn |
127.0.0.1 | 100.332233.com |
127.0.0.0 | 61.128.171.115:8080 |
127.0.0.1 | 121.11.90.79 |
127.0.0.0 | www.1119111.com |
127.0.0.1 | 121565.net |
127.0.0.0 | win.nihao69.cn |
127.0.0.1 | 125.90.88.38 |
127.0.0.1 | 16888.6to23.com |
127.0.0.1 | 2.joppnqq.com |
127.0.0.0 | puc.lianxiac.net |
127.0.0.1 | 204.177.92.68 |
127.0.0.0 | pud.lianxiac.net |
127.0.0.1 | 210.74.145.236 |
127.0.0.0 | 210.76.0.133 |
127.0.0.1 | 219.129.239.220 |
127.0.0.0 | 61.166.32.2 |
127.0.0.1 | 219.153.40.221 |
127.0.0.0 | 218.92.186.27 |
127.0.0.1 | 219.153.46.27 |
127.0.0.0 | www.fsfsfag.cn |
127.0.0.1 | 219.153.52.123 |
127.0.0.0 | ovo.ovovov.cn |
127.0.0.1 | 221.195.42.71 |
127.0.0.0 | dw.com.com |
127.0.0.1 | 222.73.218.115 |
127.0.0.1 | 203.110.168.233:80 |
127.0.0.1 | 3.joppnqq.com |
127.0.0.1 | 203.110.168.221:80 |
127.0.0.1 | 363xx.com |
127.0.0.1 | www1.ip10086.com.cm |
127.0.0.1 | 4199.com |
127.0.0.1 | blog.ip10086.com.cn |
127.0.0.1 | 43242.com |
127.0.0.1 | www.ccji68.cn |
127.0.0.1 | 5.xqhgm.com |
127.0.0.0 | t.myblank.cn |
127.0.0.1 | 520.mm5208.com |
127.0.0.0 | x.myblank.cn |
127.0.0.1 | 59.34.131.54 |
127.0.0.1 | 210.51.45.5 |
127.0.0.1 | 59.34.198.228 |
127.0.0.1 | www.ew1q.cn |
127.0.0.1 | 59.34.198.88 |
127.0.0.1 | 59.34.198.97 |
127.0.0.1 | 60.190.114.101 |
127.0.0.1 | 60.190.218.34 |
127.0.0.0 | qq-xing.com.cn |
127.0.0.1 | 60.191.124.252 |
127.0.0.1 | 61.145.117.212 |
127.0.0.1 | 61.157.109.222 |
127.0.0.1 | 75.126.3.216 |
127.0.0.1 | 75.126.3.217 |
127.0.0.1 | 75.126.3.218 |
127.0.0.0 | 59.125.231.177:17777 |
127.0.0.1 | 75.126.3.220 |
127.0.0.1 | 75.126.3.221 |
127.0.0.1 | 75.126.3.222 |
127.0.0.1 | 772630.com |
127.0.0.1 | 832823.cn |
127.0.0.1 | 8749.com |
127.0.0.1 | 888.jopenqc.com |
127.0.0.1 | 89382.cn |
127.0.0.1 | 8v8.biz |
127.0.0.1 | 97725.com |
127.0.0.1 | 9gg.biz |
127.0.0.1 | www.9000music.com |
127.0.0.1 | test.591jx.com |
127.0.0.1 | a.topxxxx.cn |
127.0.0.1 | picon.chinaren.com |
127.0.0.1 | www.5566.net |
127.0.0.1 | p.qqkx.com |
127.0.0.1 | news.netandtv.com |
127.0.0.1 | z.neter888.cn |
127.0.0.1 | b.myblank.cn |
127.0.0.1 | wvw.wokutu.com |
127.0.0.1 | unionch.qyule.com |
127.0.0.1 | www.qyule.com |
127.0.0.1 | it.itjc.cn |
127.0.0.1 | www.linkwww.com |
127.0.0.1 | vod.kaicn.com |
127.0.0.1 | www.tx8688.com |
127.0.0.1 | b.neter888.cn |
127.0.0.1 | promote.huanqiu.com |
127.0.0.1 | www.huanqiu.com |
127.0.0.1 | www.haokanla.com |
127.0.0.1 | play.unionsky.cn |
127.0.0.1 | www.52v.com |
127.0.0.1 | www.gghka.cn |
127.0.0.1 | icon.ajiang.net |
127.0.0.1 | new.ete.cn |
127.0.0.1 | www.stiae.cn |
127.0.0.1 | o.neter888.cn |
127.0.0.1 | comm.jinti.com |
127.0.0.1 | www.google-analytics.com |
127.0.0.1 | hz.mmstat.com |
127.0.0.1 | www.game175.cn |
127.0.0.1 | x.neter888.cn |
127.0.0.1 | z.neter888.cn |
127.0.0.1 | p.etimes888.com |
127.0.0.1 | hx.etimes888.com |
127.0.0.1 | abc.qqkx.com |
127.0.0.1 | dm.popdm.cn |
127.0.0.1 | www.yl9999.com |
127.0.0.1 | www.dajiadoushe.cn |
127.0.0.1 | v.onondown.com.cn |
127.0.0.1 | www.interoo.net |
127.0.0.1 | bally1.bally-bally.net |
127.0.0.1 | www.bao5605509.cn |
127.0.0.1 | www.rty456.cn |
127.0.0.1 | www.werqwer.cn |
127.0.0.1 | 1.360-1.cn |
127.0.0.1 | user1.23-16.net |
127.0.0.1 | www.guccia.net |
127.0.0.1 | www.interoo.net |
127.0.0.1 | upa.netsool.net |
127.0.0.1 | js.users.51.la |
127.0.0.1 | vip2.51.la |
127.0.0.1 | web.51.la |
127.0.0.1 | qq.gong2008.com |
127.0.0.1 | 2008tl.copyip.com |
127.0.0.1 | tla.laozihuolaile.cn |
127.0.0.1 | www.tx6868.cn |
127.0.0.1 | p001.tiloaiai.com |
127.0.0.1 | s1.tl8tl.com |
127.0.0.1 | s1.gong2008.com |
127.0.0.1 | 4b3ce56f9g.3f6e2cc5f0b.com |
Rootkit activity
The Adware installs the following kernel-mode hooks:
ZwQuerySystemInformation
Using the driver "%System%\drivers\pcidump.sys" the Adware substitutes IRP handlers in a file system driver (NTFS) to control operations with files:
MJ_CREATE
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Adware's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
taskkill.exe:676
taskkill.exe:1528
taskkill.exe:1232
%original file name%.exe:912
sc.exe:1620
rundll32.exe:1108
cacls.exe:1188
cacls.exe:1264 - Delete the original Adware file.
- Delete or disinfect the following files created/modified by the Adware:
%Documents and Settings%\%current user%\Local Settings\Temp\22.exe (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QvodSetupPlus3.0.exe (3497 bytes)
%WinDir%\phpq.dll (22141559 bytes)
C:\autorun.inf (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QvodSetupPlus.exe.!qd (1045 bytes)
%System%\func.dll (18563831 bytes)
C:\1.exe (32 bytes)
C:\$Directory (288 bytes)
%System%\config (108 bytes)
%System%\drivers\pcidump.sys (5404535 bytes)
%System%\drivers\etc\hosts (5 bytes)
%System%\drivers\acpiec.sys (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qd.ini (144 bytes) - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 25270 | 25600 | 4.44206 | d9f48557c009a2eb7979fc10b0b362ef |
.rdata | 32768 | 4554 | 4608 | 3.66815 | 0562a781a8cdf5785a117a97cc7e5f02 |
.data | 40960 | 269044 | 3072 | 3.33266 | 769f3be831c912dddacbe34424aca6cb |
.ndata | 311296 | 270336 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 581632 | 36864 | 35840 | 3.6078 | b8650ad8ecdce55db94ff645ebd133de |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 28
655ebda89a8c316de7ce5873ff1deb61
f979ad42b1f8cf01c151d3d09a437fb6
b716149de896974bf5d514592e8c7209
268211e652c08efd0d26a3e0d668f571
b97504c04a2f6969dce449c432106672
182cca26974b960089e80cbfbe087428
011819f0d135f70db8601b8a6ff2677b
f045fd21b3c9462938fe27e5ee4f06a3
66e69190d8ef735a301516e348c35190
790ada328637bd837b55fbf63280816d
bfc04c03ea863ac32e915d9255c7d9b8
917a7bea1c81ec3b61eeef59c454ed84
3b962c5e68dc495b9dac718c305f1cce
5ac95b4cbac570ac3674c873669ca552
1fbd74b51c3a6f9f3cea8425d96177fc
963c483fda50e85a28f852983123eb15
e391435dfa53cd9dbfdb42fba8d059f1
5551794e263875a795c680479c97527f
4bf082ed0c0a5e6821c59f6873c506c8
6cfc96e51ddd7beb1294cb8d0836a751
4980695fdfef0015de369e969c0df056
ee881ac1ac662ffa662dd5b30fda6ab3
95759d0e94837f34197e14a949bc6525
dffa87da1c5f035a69fe01d7593329ef
61ce4dd0f1b7482b6cdbed621f45c762
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Adware connects to the servers at the folowing location(s):
Strings from Dumps
QvodSetupPlus3.0.exe_1300:
`.rsrc
`.rsrc
.tTPV
.tTPV
u.hH.C
u.hH.C
FTPjK
FTPjK
FtPj;
FtPj;
F.PjRWj
F.PjRWj
u.WWj
u.WWj
u.VVj
u.VVj
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
user32.dll
user32.dll
portuguese-brazilian
portuguese-brazilian
GET /%s HTTP/1.1
GET /%s HTTP/1.1
Accept: application/vnd.ms-powerpoint, application/msword, */*
Accept: application/vnd.ms-powerpoint, application/msword, */*
Host: %s
Host: %s
%s (%s)
%s (%s)
Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
%s %.2f GB
%s %.2f GB
%s %.2f MB
%s %.2f MB
%s %I64d KB
%s %I64d KB
%s %I64d Byte
%s %I64d Byte
Httpurl
Httpurl
hXXp://update.qvod.com/qd.jpg
hXXp://update.qvod.com/qd.jpg
%s\qd.ini
%s\qd.ini
%s\%s
%s\%s
%s_1.%s
%s_1.%s
QvodSetupPlus.exe
QvodSetupPlus.exe
hXXp://
hXXp://
QVODd2I64X
QVODd2I64X
tcp connecting limit is %d
tcp connecting limit is %d
\drivers\tcpip.sys
\drivers\tcpip.sys
stun01.sipphone.com
stun01.sipphone.com
stun.qvod.com
stun.qvod.com
61.139.219.200
61.139.219.200
track.qvod.com
track.qvod.com
TCP Port
TCP Port
61.139.219.203
61.139.219.203
221.194.134.216
221.194.134.216
agent.qvod.com
agent.qvod.com
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)
Range: bytes=%u-
Range: bytes=%u-
Port Restricted Nat
Port Restricted Nat
, random port
, random port
, preserves ports
, preserves ports
PWindowsFirewallAppIsEnabled failed: 0xlx
PWindowsFirewallAppIsEnabled failed: 0xlx
M-SEARCH * HTTP/1.1
M-SEARCH * HTTP/1.1
HOST: 239.255.255.250:1900
HOST: 239.255.255.250:1900
controlURL
controlURL
URLBase
URLBase
HTTP/1.1
HTTP/1.1
s:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/">
s:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/">
xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/"
xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/"
AddPortMapping
AddPortMapping
NewPortMappingDescription
NewPortMappingDescription
NewInternalPort
NewInternalPort
NewExternalPort
NewExternalPort
DeletePortMapping
DeletePortMapping
External NAT port in use
External NAT port in use
External NAT port in use: Too many retries
External NAT port in use: Too many retries
Port mapping not owned by this class
Port mapping not owned by this class
Error getting StaticPortMappingCollection
Error getting StaticPortMappingCollection
problem parsing Password
problem parsing Password
Password =
Password =
ipv6 not supported
ipv6 not supported
HMAC with password:
HMAC with password:
Encoding Password:
Encoding Password:
About to send msg of len
About to send msg of len
Some problem opening port/interface to send on
Some problem opening port/interface to send on
POST /service HTTP/1.1
POST /service HTTP/1.1
Content-Length: %d
Content-Length: %d
Host: %s:%d
Host: %s:%d
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;)
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;)
127.0.0.1
127.0.0.1
recv %d
recv %d
Opened port
Opened port
Port
Port
for receiving UDP is in use
for receiving UDP is in use
Could not bind UDP receive port
Could not bind UDP receive port
Could not create a UDP socket:
Could not create a UDP socket:
err EAFNOSUPPORT in send
err EAFNOSUPPORT in send
zcÃ
zcÃ
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\QvodSetupPlus3.0.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\QvodSetupPlus3.0.exe
GetCPInfo
GetCPInfo
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.MNe|
@.MNe|
version="5.1.0.0"
version="5.1.0.0"
name="test.exe"/>
name="test.exe"/>
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
VERSION.dll
VERSION.dll
WS2_32.dll
WS2_32.dll
.torrent
.torrent
: %d K/S
: %d K/S
%s ...
%s ...
%s...
%s...
3, 0, 0, 0
3, 0, 0, 0
QvodInstall.exe
QvodInstall.exe
QvodSetupPlus3.0.exe_1300_rwx_00401000_0004A000:
.tTPV
.tTPV
u.hH.C
u.hH.C
FTPjK
FTPjK
FtPj;
FtPj;
F.PjRWj
F.PjRWj
u.WWj
u.WWj
u.VVj
u.VVj
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
user32.dll
user32.dll
portuguese-brazilian
portuguese-brazilian
GET /%s HTTP/1.1
GET /%s HTTP/1.1
Accept: application/vnd.ms-powerpoint, application/msword, */*
Accept: application/vnd.ms-powerpoint, application/msword, */*
Host: %s
Host: %s
%s (%s)
%s (%s)
Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
%s %.2f GB
%s %.2f GB
%s %.2f MB
%s %.2f MB
%s %I64d KB
%s %I64d KB
%s %I64d Byte
%s %I64d Byte
Httpurl
Httpurl
hXXp://update.qvod.com/qd.jpg
hXXp://update.qvod.com/qd.jpg
%s\qd.ini
%s\qd.ini
%s\%s
%s\%s
%s_1.%s
%s_1.%s
QvodSetupPlus.exe
QvodSetupPlus.exe
hXXp://
hXXp://
QVODd2I64X
QVODd2I64X
tcp connecting limit is %d
tcp connecting limit is %d
\drivers\tcpip.sys
\drivers\tcpip.sys
stun01.sipphone.com
stun01.sipphone.com
stun.qvod.com
stun.qvod.com
61.139.219.200
61.139.219.200
track.qvod.com
track.qvod.com
TCP Port
TCP Port
61.139.219.203
61.139.219.203
221.194.134.216
221.194.134.216
agent.qvod.com
agent.qvod.com
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)
Range: bytes=%u-
Range: bytes=%u-
Port Restricted Nat
Port Restricted Nat
, random port
, random port
, preserves ports
, preserves ports
PWindowsFirewallAppIsEnabled failed: 0xlx
PWindowsFirewallAppIsEnabled failed: 0xlx
M-SEARCH * HTTP/1.1
M-SEARCH * HTTP/1.1
HOST: 239.255.255.250:1900
HOST: 239.255.255.250:1900
controlURL
controlURL
URLBase
URLBase
HTTP/1.1
HTTP/1.1
s:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/">
s:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/">
xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/"
xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/"
AddPortMapping
AddPortMapping
NewPortMappingDescription
NewPortMappingDescription
NewInternalPort
NewInternalPort
NewExternalPort
NewExternalPort
DeletePortMapping
DeletePortMapping
External NAT port in use
External NAT port in use
External NAT port in use: Too many retries
External NAT port in use: Too many retries
Port mapping not owned by this class
Port mapping not owned by this class
Error getting StaticPortMappingCollection
Error getting StaticPortMappingCollection
problem parsing Password
problem parsing Password
Password =
Password =
ipv6 not supported
ipv6 not supported
HMAC with password:
HMAC with password:
Encoding Password:
Encoding Password:
About to send msg of len
About to send msg of len
Some problem opening port/interface to send on
Some problem opening port/interface to send on
POST /service HTTP/1.1
POST /service HTTP/1.1
Content-Length: %d
Content-Length: %d
Host: %s:%d
Host: %s:%d
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;)
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;)
127.0.0.1
127.0.0.1
recv %d
recv %d
Opened port
Opened port
Port
Port
for receiving UDP is in use
for receiving UDP is in use
Could not bind UDP receive port
Could not bind UDP receive port
Could not create a UDP socket:
Could not create a UDP socket:
err EAFNOSUPPORT in send
err EAFNOSUPPORT in send
zcÃ
zcÃ
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\QvodSetupPlus3.0.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\QvodSetupPlus3.0.exe
GetCPInfo
GetCPInfo
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
.torrent
.torrent
: %d K/S
: %d K/S
%s ...
%s ...
%s...
%s...
22.exe_664:
.nsp0
.nsp0
.nsp1
.nsp1
.nsp2
.nsp2
GetWindowsDirectoryA
GetWindowsDirectoryA
WinExec
WinExec
\phpq.dll
\phpq.dll
rundll32.exe func.dll, droqp
rundll32.exe func.dll, droqp
\system32\func.dll
\system32\func.dll
cmd /c taskkill /im ScanFrm.exe /f
cmd /c taskkill /im ScanFrm.exe /f
cmd /c taskkill /im egui.exe /f
cmd /c taskkill /im egui.exe /f
cmd /c taskkill /im ekrn.exe /f
cmd /c taskkill /im ekrn.exe /f
cmd /c sc config ekrn start= disabled
cmd /c sc config ekrn start= disabled
cmd /c cacls "%s" /e /p everyone:f
cmd /c cacls "%s" /e /p everyone:f
cmd /c cacls %s /e /p everyone:f
cmd /c cacls %s /e /p everyone:f
\temp\explorer.exe
\temp\explorer.exe
\drivers\gm.dls
\drivers\gm.dls
Explorer.EXE
Explorer.EXE
explorer.EXE
explorer.EXE
EXPLORER.EXE
EXPLORER.EXE
EXPLORER.exe
EXPLORER.exe
Explorer.exe
Explorer.exe
explorer.exe
explorer.exe
GetProcAddressLoadLibraryACloseHandleGetSystemTimeGetModuleHandleASleepGetTempPathACopyFileAGetWindowsDirectoryAGetSystemDirectoryAGetModuleFileNameACreateMutexAGlobalAddAtomAOpenMutexAGlobalFindAtomAstrcpymemsetsprintfstrcatstrstrstrlen
GetProcAddressLoadLibraryACloseHandleGetSystemTimeGetModuleHandleASleepGetTempPathACopyFileAGetWindowsDirectoryAGetSystemDirectoryAGetModuleFileNameACreateMutexAGlobalAddAtomAOpenMutexAGlobalFindAtomAstrcpymemsetsprintfstrcatstrstrstrlen
Ci=l_[n_Msg\ifc]Fche
Ci=l_[n_Msg\ifc]Fche
,-2) ) ),
,-2) ) ),
,-2) ) )-
,-2) ) )-
,-2) ) ).
,-2) ) ).
,-2) ) )
,-2) ) )
,-,),/), ,)13
,-,),/), ,)13
,-2),),),
,-2),),),
,-2) ),),
,-2) ),),
1,),-3),2,),,053 3
1,),-3),2,),,053 3
,-,),,)4 )24
,-,),,)4 )24
,-0)4 )33).3
,-0)4 )33).3
- /),22)4-)13
- /),22)4-)13
-, )2/),/0)-.1
-, )2/),/0)-.1
-, )21) ),..
-, )21) ),..
-,4),-4)-.4)--
-,4),-4)-.4)--
1,),11).-)-
1,),11).-)-
-,4),0.)/ )--,
-,4),0.)/ )--,
-,3)4-),31)-2
-,3)4-),31)-2
-,4),0.)/1)-2
-,4),0.)/1)-2
-,4),0.)0-),-.
-,4),0.)0-),-.
--,),40)/-)2,
--,),40)/-)2,
---)2.)-,3),,0
---)2.)-,3),,0
- .),, ),13)-..53
- .),, ),13)-..53
- .),, ),13)--,53
- .),, ),13)--,53
.1.ss)^jh
.1.ss)^jh
04)./),.,)0/
04)./),.,)0/
-, )0,)/0)0
-, )0,)/0)0
04)./),43)--3
04)./),43)--3
04)./),43)33
04)./),43)33
04)./),43)42
04)./),43)42
1 ),4 ),,/), ,
1 ),4 ),,/), ,
1 ),4 )-,3)./
1 ),4 )-,3)./
1 ),4,),-/)-0-
1 ),4,),-/)-0-
1,),/0),,2)-,-
1,),/0),,2)-,-
1,),02), 4)---
1,),02), 4)---
20),-1).)-,1
20),-1).)-,1
20),-1).)-,2
20),-1).)-,2
20),-1).)-,3
20),-1).)-,3
04),-0)-.,),225,2222
04),-0)-.,),225,2222
20),-1).)--
20),-1).)--
20),-1).)--,
20),-1).)--,
20),-1).)---
20),-1).)---
kjk.om\k)`s`
kjk.om\k)`s`
KERNEL32.DLL
KERNEL32.DLL
MSVCRT.DLL
MSVCRT.DLL
fg.JtTuc
fg.JtTuc
d[%UE
d[%UE
Windows Calculator application file
Windows Calculator application file
5.1.2600.0 (xpclient.010817-1148)
5.1.2600.0 (xpclient.010817-1148)
CALC.EXE
CALC.EXE
Microsoft(R) Windows(R) Operating System
Microsoft(R) Windows(R) Operating System
5.1.2600.0
5.1.2600.0
22.exe_664_rwx_00404000_00017000:
GetWindowsDirectoryA
GetWindowsDirectoryA
WinExec
WinExec
\phpq.dll
\phpq.dll
rundll32.exe func.dll, droqp
rundll32.exe func.dll, droqp
\system32\func.dll
\system32\func.dll
cmd /c taskkill /im ScanFrm.exe /f
cmd /c taskkill /im ScanFrm.exe /f
cmd /c taskkill /im egui.exe /f
cmd /c taskkill /im egui.exe /f
cmd /c taskkill /im ekrn.exe /f
cmd /c taskkill /im ekrn.exe /f
cmd /c sc config ekrn start= disabled
cmd /c sc config ekrn start= disabled
cmd /c cacls "%s" /e /p everyone:f
cmd /c cacls "%s" /e /p everyone:f
cmd /c cacls %s /e /p everyone:f
cmd /c cacls %s /e /p everyone:f
\temp\explorer.exe
\temp\explorer.exe
\drivers\gm.dls
\drivers\gm.dls
Explorer.EXE
Explorer.EXE
explorer.EXE
explorer.EXE
EXPLORER.EXE
EXPLORER.EXE
EXPLORER.exe
EXPLORER.exe
Explorer.exe
Explorer.exe
explorer.exe
explorer.exe
GetProcAddressLoadLibraryACloseHandleGetSystemTimeGetModuleHandleASleepGetTempPathACopyFileAGetWindowsDirectoryAGetSystemDirectoryAGetModuleFileNameACreateMutexAGlobalAddAtomAOpenMutexAGlobalFindAtomAstrcpymemsetsprintfstrcatstrstrstrlen
GetProcAddressLoadLibraryACloseHandleGetSystemTimeGetModuleHandleASleepGetTempPathACopyFileAGetWindowsDirectoryAGetSystemDirectoryAGetModuleFileNameACreateMutexAGlobalAddAtomAOpenMutexAGlobalFindAtomAstrcpymemsetsprintfstrcatstrstrstrlen
Ci=l_[n_Msg\ifc]Fche
Ci=l_[n_Msg\ifc]Fche
,-2) ) ),
,-2) ) ),
,-2) ) )-
,-2) ) )-
,-2) ) ).
,-2) ) ).
,-2) ) )
,-2) ) )
,-,),/), ,)13
,-,),/), ,)13
,-2),),),
,-2),),),
,-2) ),),
,-2) ),),
1,),-3),2,),,053 3
1,),-3),2,),,053 3
,-,),,)4 )24
,-,),,)4 )24
,-0)4 )33).3
,-0)4 )33).3
- /),22)4-)13
- /),22)4-)13
-, )2/),/0)-.1
-, )2/),/0)-.1
-, )21) ),..
-, )21) ),..
-,4),-4)-.4)--
-,4),-4)-.4)--
1,),11).-)-
1,),11).-)-
-,4),0.)/ )--,
-,4),0.)/ )--,
-,3)4-),31)-2
-,3)4-),31)-2
-,4),0.)/1)-2
-,4),0.)/1)-2
-,4),0.)0-),-.
-,4),0.)0-),-.
--,),40)/-)2,
--,),40)/-)2,
---)2.)-,3),,0
---)2.)-,3),,0
- .),, ),13)-..53
- .),, ),13)-..53
- .),, ),13)--,53
- .),, ),13)--,53
.1.ss)^jh
.1.ss)^jh
04)./),.,)0/
04)./),.,)0/
-, )0,)/0)0
-, )0,)/0)0
04)./),43)--3
04)./),43)--3
04)./),43)33
04)./),43)33
04)./),43)42
04)./),43)42
1 ),4 ),,/), ,
1 ),4 ),,/), ,
1 ),4 )-,3)./
1 ),4 )-,3)./
1 ),4,),-/)-0-
1 ),4,),-/)-0-
1,),/0),,2)-,-
1,),/0),,2)-,-
1,),02), 4)---
1,),02), 4)---
20),-1).)-,1
20),-1).)-,1
20),-1).)-,2
20),-1).)-,2
20),-1).)-,3
20),-1).)-,3
04),-0)-.,),225,2222
04),-0)-.,),225,2222
20),-1).)--
20),-1).)--
20),-1).)--,
20),-1).)--,
20),-1).)---
20),-1).)---
kjk.om\k)`s`
kjk.om\k)`s`
KERNEL32.DLL
KERNEL32.DLL
MSVCRT.DLL
MSVCRT.DLL
Windows Calculator application file
Windows Calculator application file
5.1.2600.0 (xpclient.010817-1148)
5.1.2600.0 (xpclient.010817-1148)
CALC.EXE
CALC.EXE
Microsoft(R) Windows(R) Operating System
Microsoft(R) Windows(R) Operating System
5.1.2600.0
5.1.2600.0
22.exe_664_rwx_10000000_00001000:
.data
.data
.rsrc
.rsrc
@.reloc
@.reloc
psapi.dll
psapi.dll
\patch.exe
\patch.exe
\dstdisk.exe
\dstdisk.exe
\defence.exe
\defence.exe
192yuioealdjfiefjsdfas.txt
192yuioealdjfiefjsdfas.txt
%SystemRoot%\System32\DRIVERS\puid.sys
%SystemRoot%\System32\DRIVERS\puid.sys
\drivers\pcidump.sys
\drivers\pcidump.sys
System32\DRIVERS\pcidump.sys
System32\DRIVERS\pcidump.sys
%SystemRoot%\system32\drivers\puid.sys
%SystemRoot%\system32\drivers\puid.sys
\\.\pcidump
\\.\pcidump
\drivers\gm.dls
\drivers\gm.dls
Windows
Windows
1.exe
1.exe
autorun.inf
autorun.inf
Open=1.exe
Open=1.exe
urlmon
urlmon
\setup.exe
\setup.exe
?mac=%s&ver=%s&key=%d&os=windows
?mac=%s&ver=%s&key=%d&os=windows
.html
.html
.hhqg
.hhqg
qq.exe
qq.exe
360safe.exe
360safe.exe
\explorer.exe
\explorer.exe
\temp\explorer.exe
\temp\explorer.exe
nfect_exe
nfect_exe
22.exe_664_rwx_10005000_00001000:
\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\22.exe
\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\22.exe
\??\%WinDir%\explorer.exe
\??\%WinDir%\explorer.exe
ers\gm.dls
ers\gm.dls
WinExec
WinExec
CreatePipe
CreatePipe
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
ADVAPI32.dll
ADVAPI32.dll
InternetOpenUrlA
InternetOpenUrlA
WININET.dll
WININET.dll
rundll32.exe_1108:
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
GDI32.dll
GDI32.dll
USER32.dll
USER32.dll
IMAGEHLP.dll
IMAGEHLP.dll
rundll32.pdb
rundll32.pdb
.....eZXnnnnnnnnnnnn3
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
O3$dS7"%U9
.manifest
.manifest
5.1.2600.5512 (xpsp.080413-2105)
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
RUNDLL.EXE
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
YThere is not enough memory to run the file %s.
YThere is not enough memory to run the file %s.
Please close other windows and try again.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Error in %s
Missing entry:%s
Missing entry:%s
Error loading %s
Error loading %s