Trojan.NSIS.StartPage_ad3f7a0d2d – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:1392

Mutexes

The following mutexes were created/opened:

CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003ZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexRasPbFileWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!_!MSFTHISTORY!_c:!documents and settings!adm!local settings!temporary internet files!content.ie5!c:!documents and settings!adm!cookies!ShimCacheMutex

File activity

The process %original file name%.exe:1392 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\data.txt (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\button.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\close.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp (429478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\KPTool.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsp4.tmp (1446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\bg.bmp (22552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\Banner.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\LinkConfig[1].htm (299 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\data.xml (299 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\shrltj1[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsisXML.dll (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\check.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\browse.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\sndsock.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\ToolTips.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\Button.dll (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\EmbedWeb.dll (784 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\data.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\data.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk1.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1392 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B2 D2 A9 E8 AD 95 E2 61 84 FA 99 53 2B EE B8 0A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar]
"Enabled" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
aea3ac67fa68fd3f00edfbf9b43a2770	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\Banner.dll
92debab0caea94c3e571e892fdde60dd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\Button.dll
2312a7ac514325c2f1efc6f4cfdecd61	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\EmbedWeb.dll
cb06abc67418f1f8310ec8ac47427107	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\KPTool.dll
a5a4cee2eb89d2687c05ef74299f0dba	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\NSISdl.dll
960a5c48e25cf2bca332e74e11d825c9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\System.dll
9a0da2692764bb842411a8b9687ebbb7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\ToolTips.dll
c498ae64b4971132bba676873978de1e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\inetc.dll
8ced0b79f7b9033d0795aab3be6d627c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\nsDialogs.dll
9f3d5344e7ede1f41f99d8fc37fd01ad	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\nsisXML.dll
e9a68378671dfc74e7715b47291e141a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nse3.tmp\sndsock.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\data.txt (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\button.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\close.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp (429478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\KPTool.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsp4.tmp (1446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\bg.bmp (22552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\Banner.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\LinkConfig[1].htm (299 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\data.xml (299 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\shrltj1[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\nsisXML.dll (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\check.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\browse.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\sndsock.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\ToolTips.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\Button.dll (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse3.tmp\EmbedWeb.dll (784 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ????
Product Version: 1.2.3.0
Legal Copyright: (C)????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.2.3.0
File Description: ????????
Comments:
Language: Chinese (Simplified, PRC)

Company Name: Product Name: ????Product Version: 1.2.3.0Legal Copyright: (C)????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.2.3.0File Description: ????????Comments: Language: Chinese (Simplified, PRC)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23374	23552	4.49744	1148141f447100d2c0522bb22c280fcb
.rdata	28672	5212	5632	3.53504	2534d97c1d4120f21c49ba079594f2de
.data	36864	171196	512	0.987624	fb7b95ad7fc29391fcbc684e4c4e0ed8
.ndata	208896	282624	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	491520	26672	27136	2.76631	0ab556df8d5defa3a78b6da0708f350b

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 36
86d84b83df2d44e91f1a7b24b68064ba
c92036160c25fa5484663cfaf789c339
16bd8eead4b10d7b078ebaa65d68dd6a
12f3fba390c048301f59fe2a36bf2da8
12858e2eb5cfd4266bc8cb2d94d469de
ea57ef02ac0f05fb4c559b89e23cc840
e6425e446169d6e2a2d90fb6590ec67f
3cc71968574c406e90099f956cf97f94
d2d86c816db9dc3e758e23ae500cf459
90d1d3f2ad56ce4123941b5991753d21
33756f8aac0008508fbc50d61ed70ee2
a44b5dc5b995b3271caed5727f7224c2
75dd697af0567832ec4eec5b0d312331
3ff2ae1c97b170fb972008d81dd9bc94
b0b7076d95f8d5c595b0df77667b14c8
2de0b8c03cc7b55d6ea5938c544903f2
29a94ec5f185b98da32b574b09d794cb
155f280897d92aebc1e465508c035ba1
585c902fea61c606c7a555a253454c48
7c6014c2942fb5ed3375a9281526cb95
26c739d9e4e14056634374b83a9c468d
caa37ffc95c53156c36600939026e7fe
95a8c39ebf5aab4f448b61a2f544fd16
e295f96ad974dcf08e7a20865c322519
7f285691ea72ae5347e8bf1d63ce01a2

Network Activity

URLs

URL	IP
hxxp://aly.ys.dns-vip.net/20141128/14.html
hxxp://c01.i07.rpnic.lv3.cloudglb.com/xml/LinkConfig.xml
hxxp://aly.ys.dns-vip.net/xml/LinkConfig.php
hxxp://xiazai.rilibiao.com.cn/xml/LinkConfig.xml	113.207.30.140
hxxp://confignew.3lsoft.com/20141128/14.html	112.124.60.81
hxxp://confignew.3lsoft.com/xml/LinkConfig.php	112.124.60.81
downcdn1.shgaoxin.net

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /20141128/14.html HTTP/1.0

Host: confignew.3lsoft.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html

Server: Microsoft-IIS/7.5

X-Powered-By: PHP/5.3.28

X-Powered-By: ASP.NET

Date: Wed, 23 Sep 2015 21:43:59 GMT

Connection: close

Content-Length: 8385

[rec]..N_4=360..........Z_4=46..O_4=1..B_4=0..D_4=..............I_4=http://downcdn1.shgaoxin.net/shichangbu/ico/360sd.ico..U_4=hXXp://downcdn1.shgaoxin.net/ysqd/20140415/qh.gif..F_4=Setup_oemyinsudz1.exe..P_4=/S..C_4=..R_4=..S_4=..V_4=..M_4=..X_4=..FN_4=..FU_4=..N_1=..........Z_1=171..O_1=1..B_1=0..D_1=..............I_1=hXXp://downcdn1.shgaoxin.net/shichangbu/ico/game_cqby.ico..U_1=hXXp://downcdn1.shgaoxin.net/sc/37cs_wd_916217.gif..F_1=37cs_wd_916217.exe..P_1=..C_1=..R_1=..S_1=..V_1=..M_1=..X_1=1..Y_1=1..L_1=1..FN_1=..FU_1=..N_2=........Z_2=145..O_2=1..B_2=0..D_2=..............I_2=hXXp://downcdn1.shgaoxin.net/shichangbu/ico/ttk.ico..U_2=hXXp://downcdn1.shgaoxin.net/shichangbu2/TTK_8020010020140313_setup.gif..F_2=TTK_8020010020140313_setup.exe..P_2=/S..C_2=2..R_2=1..S_2=Software\TaoTaoSou\TTK..V_2=Installed..M_2=..X_2=1..Y_2=..N_3=..........Z_3=150..O_3=1..B_3=0..D_3=................I_3=hXXp://downcdn1.shgaoxin.net/shichangbu/ico/game_thdrawal.ico..U_3=hXXp://downcdn1.shgaoxin.net/shichangbu/thdrawal.gif..F_3=thdrawal.exe..Y_3=..X_3=1..N_5=......Z_5=123..O_5=1..B_5=0..U_5=hXXp://downcdn1.shgaoxin.net/shichangbu2/HY_Setup_gaoxin.gif..F_5=HY_Setup_gaoxin.exe..P_5=/S /A..C_5=2..R_5=2..S_5=SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HaoYing..V_5=UninstallString..N_6=..........Z_6=130..O_6=1..B_6=0..D_6=..............I_6=hXXp://downcdn1.shgaoxin.net/shichangbu/ico/youxun.ico..U_6=hXXp://downcdn1.shgaoxin.net/shichangbu2/gaoxintg.gif..F_6=gaoxintg.exe..P_6=..C_6=2..R_6=1..S_6=Software\Microsoft\Windows\Curren

<<< skipped >>>

GET /xml/LinkConfig.php HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: confignew.3lsoft.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/html

Server: Microsoft-IIS/7.5

X-Powered-By: PHP/5.3.28

X-Powered-By: ASP.NET

Date: Wed, 23 Sep 2015 21:44:02 GMT

Content-Length: 299

<?xml version="1.0" encoding="utf-8" standalone="yes" ?>..<Infoconfig>...<Date>20150729</Date>.. <LinkUrl>http://ai.taobao.com?pid=mm_47495283_4270322_35440572</LinkUrl>...<IconUrl>hXXp://downcdn1.shgaoxin.net/shichangbu/ico/tao.ico</IconUrl>...<IconLabel>...............</IconLabel>..</Infoconfig>HTTP/1.1 200 OK..Content-Type: text/html..Server: Microsoft-IIS/7.5..X-Powered-By: PHP/5.3.28..X-Powered-By: ASP.NET..Date: Wed, 23 Sep 2015 21:44:02 GMT..Content-Length: 299..<?xml version="1.0" encoding="utf-8" standalone="yes" ?>..<Infoconfig>...<Date>20150729</Date>.. <LinkUrl>hXXp://ai.taobao.com?pid=mm_47495283_4270322_35440572</LinkUrl>...<IconUrl>http://downcdn1.shgaoxin.net/shichangbu/ico/tao.ico</IconUrl>...<IconLabel>...............</IconLabel>..</Infoconfig>..

GET /xml/LinkConfig.xml HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: xiazai.rilibiao.com.cn

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 302 Redirect

Date: Wed, 23 Sep 2015 21:44:06 GMT

Content-Length: 169

Location: hXXp://confignew.3lsoft.com/xml/LinkConfig.php

Content-Type: text/html; charset=UTF-8

Connection: Keep-Alive

X-Powered-By: ASP.NET

Fw-Via: Combine HIT from CTL_ZJ_091_146.fcd, Configured MISS from CTL_ZJ_091_142.fcd, Combine MISS from 113.207.30.159, Configured MISS from 113.207.30.143

<head><title>...............</title></head>.<body><h1>...............</h1>......<a HREF="http://confignew.3lsoft.com/xml/LinkConfig.php">......</a>...............</body>..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1392:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

.DEFAULT\Control Panel\International

RegDeleteKeyExA

Software\Microsoft\Windows\CurrentVersion

*?|/":

%s=%s

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegDeleteKeyA

RegCloseKey

RegEnumKeyA

RegOpenKeyExA

RegCreateKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse3.tmp\nsDialogs.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse3.tmp\nsDialogs.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse3.tmp

nsp4.tmp

Yu.ky%

OLEAUT32.dll

MSVCRT.dll

nsisXML.dll

{88d96a05-f192-11d4-a65f-0040963251e5}

{88d969c0-f192-11d4-a65f-0040963251e5}

{f5078f32-c551-11d3-89b9-0000f81fe221}

{f5078f1b-c551-11d3-89b9-0000f81fe221}

{f6d90f11-9c73-11d3-b32e-00c04f990bb4}

{2933bf90-7b36-11d2-b20e-00c04f983e60}

.Class 3 Public Primary Certification Authority0

hXXp://crl.verisign.com/pca3.crl0

hXXps://VVV.verisign.com/cps0

#hXXp://logo.verisign.com/vslogo.gif04

hXXp://ocsp.verisign.com0>

2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,

/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D

hXXps://VVV.verisign.com/rpa0

hXXp://ocsp.verisign.com0;

/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0

hXXps://VVV.verisign.com/cps0*

#hXXp://crl.verisign.com/pca3-g5.crl04

hXXp://ocsp.verisign.com0

hXXp://VVV.usertrust.com1

@.reloc

CabDLL.dll

SHLWAPI.dll

Cabinet.dll

bddll.dll

bdmzip.dll

bdimesetup.dll

.reloc

GetProcessHeap

ToolTips.dll

PluginA.dll

MSIMG32.dll

GdiplusShutdown

gdiplus.dll

All Files|*.*

0 0$0(0,0

\resource\EmbedWeb\nsweb.h

n%D,3

user32.dll

kernel32.dll

invalid executable code

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse3.tmp\data.txt

data.txt

1048876

\LOCALS~1\Temp\nse3.tmp

1048896

1179918

1114304

c:\%original file name%.exe

%Program Files%\shanhurili

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsk1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse3.tmp\nsp4.tmp

-2147483647

Software\Microsoft\Windows\CurrentVersion\Uninstall\YouXunBox

4899916664210980926

-2063532032

-2147284440

Nullsoft Install System v2.46

hXXp://nsis.sf.net/

{"supply_id":"%s"}

1202000063

1.2.3.0

%original file name%.exe_1392_rwx_003E4000_00001000:

callback%d

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps