Gen:Variant.Graftor.266801 (B) (Emsisoft), Gen:Variant.Graftor.266801 (AdAware), Packed.Win32.Themida.FD, Trojan-Downloader.Win32.Karagany.1.FD, Trojan-PSW.Win32.Bzub.2.FD, Trojan-PSW.Win32.MSNPassword.FD, Trojan.NSIS.StartPage.FD, Trojan.Win32.BHO.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.Swrort.3.FD, GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan-PSW, Trojan, Packed
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 2131ce152d43b7fa0b5e554c2040f666
SHA1: 2dd74461ffef7fc913b2d083d488a0d07f147fb9
SHA256: ada83e84dd406624c193860e04596b8208fbdf197305acecab92f6d8c2c519b7
SSDeep: 49152:xNXnGzBs1xtHmD05o4wN7aRlhwZkjhXzGmi2PvD7BwNmjS1iCCdHZWekK:DGNkGYWObGeymVvAB1ibQekK
Size: 2870352 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, ACProtect141
Company: no certificate found
Created at: 2015-11-27 10:12:53
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:740
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:740 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\UUWiseHelper.dll (291 bytes)
C:\ZMApi.dll (7972 bytes)
C:\dc.dll (122 bytes)
C:\KZSZ.ini (170 bytes)
C:\%original file name%.exe (17629 bytes)
The Trojan deletes the following file(s):
C:\uygqjgwuzpzhqdqfklvr.dfg (0 bytes)
Registry activity
The process %original file name%.exe:740 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 9B 83 35 41 08 A4 BE 56 80 1E C4 A0 08 25 D7"
[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"
Dropped PE files
MD5 | File path |
---|---|
dedbe5273cec04d40d36b4583aec378c | c:\%original file name%.exe |
dc6b73cbd1f6f5cec640a8c634ae50c8 | c:\UUWiseHelper.dll |
3acaceed9edcf17193c69b5409cec1e0 | c:\ZMApi.dll |
f803ad370a8649a143429f179af5f3ab | c:\dc.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\UUWiseHelper.dll (291 bytes)
C:\ZMApi.dll (7972 bytes)
C:\dc.dll (122 bytes)
C:\KZSZ.ini (170 bytes)
C:\%original file name%.exe (17629 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: ?????
Product Name: ???????? Www.52Dfg.Com
Product Version: 1.0.0.0
Legal Copyright: ??????????[www.52dfg.com],??????,?????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ??,??,????????,????
Comments: ???????
Language: English (United States)
Company Name: ?????Product Name: ???????? Www.52Dfg.ComProduct Version: 1.0.0.0Legal Copyright: ??????????[www.52dfg.com],??????,?????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ??,??,????????,????Comments: ???????Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 3936256 | 1616896 | 5.5451 | d25e31c21911a21cd2c61d40a275b0d0 |
UPX | 3940352 | 1155072 | 1153024 | 5.10318 | 04e30e82204d96c20189e8a5b0dd8e3e |
.idata | 5095424 | 4096 | 1536 | 2.49204 | 1e0753d2fa21a44287efccbfbc31a5e8 |
.rsrc | 5099520 | 86016 | 85504 | 2.30297 | 3bd46c4e50c6c686dd16f8de66e481ce |
UPX | 5185536 | 4096 | 4096 | 5.5324 | 53632e6c739200c4840e36771f5d548e |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://92wg.sinaapp.com/softtj.php?act=add&softname=MZDS | 220.181.136.30 |
apisoft.df0535.com | 182.140.245.38 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /softtj.php?act=add&softname=MZDS HTTP/1.1
Referer: hXXp://92wg.sinaapp.com/softtj.php?act=add&softname=MZDS
Accept: */*
Accept-Language: zh-CN
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Host: 92wg.sinaapp.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Server: nginx
Date: Mon, 04 Apr 2016 06:56:03 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 208
Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /softtj.php was not found on this server.</p>.</body></html>.HTTP/1.1 404 Not Found..Server: nginx..Date: Mon, 04 Apr 2016 06:56:03 GMT..Content-Type: text/html; charset=iso-8859-1..Content-Length: 208..Connection: keep-alive..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /softtj.php was not found on this server.</p>.</body></html>...
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_740:
.text
.text
h.idata
h.idata
H.rsrc
H.rsrc
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
&scope&view&daylist&uinlist&gid&flag&filter&applist&refresh&aisortEndTime&aisortOffset&getAisort&aisortBeginTime&pagenum&externparam&firstGetGroup&icServerTime&mixnocache&scene&begintime&count&dayspac&sidomain&useutf8&outputhtmlfeed&rd
&scope&view&daylist&uinlist&gid&flag&filter&applist&refresh&aisortEndTime&aisortOffset&getAisort&aisortBeginTime&pagenum&externparam&firstGetGroup&icServerTime&mixnocache&scene&begintime&count&dayspac&sidomain&useutf8&outputhtmlfeed&rd
&curkey
&curkey
&unikey
&unikey
&syn_tweet_verson¶mstr&pic_template&richtype&richval&special_url&subrichtype&who&con
&syn_tweet_verson¶mstr&pic_template&richtype&richval&special_url&subrichtype&who&con
&special_url&subrichtype&pic_bo
&special_url&subrichtype&pic_bo
&SSh
&SSh
&daid&pt_qzone_sig&hide_title_bar&low_login&qlogin_auto_login&no_verifyimg&link_target&appid&style&target&s_url&pt_qr_app&pt_qr_link&self_regurl&pt_qr_help_link
&daid&pt_qzone_sig&hide_title_bar&low_login&qlogin_auto_login&no_verifyimg&link_target&appid&style&target&s_url&pt_qr_app&pt_qr_link&self_regurl&pt_qr_help_link
&u1&r
&u1&r
&appid&js_ver&js_type&login_sig
&appid&js_ver&js_type&login_sig
&pt_tea&pt_vcode&uin
&pt_tea&pt_vcode&uin
&aid&uin
&aid&uin
&uin
&uin
&js_ver&js_type&login_sig
&js_ver&js_type&login_sig
&pt_randsalt&u1&ptredirect&h&t&g&from_ui&ptlang&action
&pt_randsalt&u1&ptredirect&h&t&g&from_ui&ptlang&action
&uin
&uin
&&&&&&
&&&&&&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&&navigator.appVersion
&&navigator.appVersion
&
&
&
&
&
&
&
&
&
&
&
&
&&
&&
&
&
&
&
&&
&&
&
&
&password
&password
&softkey
&softkey
&&
&&
&
&
&
&
&
&
&
&
&
&
&&&&
&&&&
&Q
&Q
&k
&k
&
&
&
&
&password&repassword&email&qq&phone&name&softwareid
&password&repassword&email&qq&phone&name&softwareid
&password&repassword&email&qq&phone&name&softwareid
&password&repassword&email&qq&phone&name&softwareid
&password&prepaid_card&softwareid
&password&prepaid_card&softwareid
&password&prepaid_card&softwareid
&password&prepaid_card&softwareid
&password
&password
&password
&password
&
&
&softname
&softname
&
&
&scope&view&daylist&uinlist&gid&flag&filter&applist&refresh&aisortEndTime&aisortOffset&getAisort&aisortBeginTime&pagenum&externparam&firstGetGroup&icServerTime&mixnocache&scene&begintime&count&dayspac&sidomain&useutf8&outputhtmlfeed&rd
&scope&view&daylist&uinlist&gid&flag&filter&applist&refresh&aisortEndTime&aisortOffset&getAisort&aisortBeginTime&pagenum&externparam&firstGetGroup&icServerTime&mixnocache&scene&begintime&count&dayspac&sidomain&useutf8&outputhtmlfeed&rd
&curkey
&curkey
&unikey
&unikey
&syn_tweet_verson¶mstr&pic_template&richtype&richval&special_url&subrichtype&who&con
&syn_tweet_verson¶mstr&pic_template&richtype&richval&special_url&subrichtype&who&con
&special_url&subrichtype&pic_bo
&special_url&subrichtype&pic_bo
&SSh
&SSh
&daid&pt_qzone_sig&hide_title_bar&low_login&qlogin_auto_login&no_verifyimg&link_target&appid&style&target&s_url&pt_qr_app&pt_qr_link&self_regurl&pt_qr_help_link
&daid&pt_qzone_sig&hide_title_bar&low_login&qlogin_auto_login&no_verifyimg&link_target&appid&style&target&s_url&pt_qr_app&pt_qr_link&self_regurl&pt_qr_help_link
&u1&r
&u1&r
&appid&js_ver&js_type&login_sig
&appid&js_ver&js_type&login_sig
&pt_tea&pt_vcode&uin
&pt_tea&pt_vcode&uin
&aid&uin
&aid&uin
&uin
&uin
&js_ver&js_type&login_sig
&js_ver&js_type&login_sig
&pt_randsalt&u1&ptredirect&h&t&g&from_ui&ptlang&action
&pt_randsalt&u1&ptredirect&h&t&g&from_ui&ptlang&action
&uin
&uin
&&&&&&
&&&&&&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&&navigator.appVersion
&&navigator.appVersion
&
&
&
&
&
&
&
&
&
&
&
&
&&
&&
&
&
&
&
&&
&&
&
&
&password
&password
&softkey
&softkey
&&
&&
&
&
&
&
&
&
&
&
&
&
&&&&
&&&&
&
&
&
&
&password&repassword&email&qq&phone&name&softwareid
&password&repassword&email&qq&phone&name&softwareid
&password&repassword&email&qq&phone&name&softwareid
&password&repassword&email&qq&phone&name&softwareid
&password&prepaid_card&softwareid
&password&prepaid_card&softwareid
&password&prepaid_card&softwareid
&password&prepaid_card&softwareid
&password
&password
&password
&password
&
&
&
&
&:
&:
&
&
&
&
&
&
&
&
&
&
&joiner
&joiner
&non-joiner
&non-joiner
&More
&More
&en
&en
&ft
&ft
&y1
&y1
&
&
<:>
<:>
&
&
<:_:>
<:_:>