Gen.Trojan.Heur.MR.NuZaq4iM4aH_089f96dbbd

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):

svch0st.exe:332
%original file name%.exe:1988
WScript.exe:1632
WScript.exe:700

The Trojan injects its code into the following process(es):

wk7b_update.exe:1968

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process svch0st.exe:332 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\16019826[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\14911066[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wk-login[1].htm (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Program Files%\drivers\wk7b.ini (118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ip-data[1].htm (2144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Program Files%\drivers\wk7b_update.exe (9098 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The process %original file name%.exe:1988 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\drivers\$wdd.bat (199 bytes)
%Program Files%\drivers\wk7b.ini (130 bytes)
%Program Files%\drivers\svch0st.exe (19988 bytes)
%Program Files%\drivers\$wdd.vbs (98 bytes)
%Program Files%\drivers\sc.vbs (381 bytes)

The Trojan deletes the following file(s):

%Program Files%\drivers\__tmp_rar_sfx_access_check_519968 (0 bytes)

The process wk7b_update.exe:1968 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\drivers\svch0st.exe (46914 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\Íþ¿ÍÆæ±ø[1].exe (68699 bytes)

The Trojan deletes the following file(s):

%Program Files%\drivers\svch0st.exe (0 bytes)

The process WScript.exe:700 makes changes in the file system.

The Trojan deletes the following file(s):

%Program Files%\drivers\$wdd.bat (0 bytes)
%Program Files%\drivers\$wdd.vbs (0 bytes)
%Program Files%\drivers\sc.vbs (0 bytes)

Registry activity

The process svch0st.exe:332 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 C3 59 07 30 3E DB 60 15 AB 25 69 B9 D7 E5 C0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1988 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE FF A1 0D 59 95 13 01 88 BF A0 21 73 15 E1 21"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"wscript.exe" = "Microsoft (R) Windows Based Script Host"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process wk7b_update.exe:1968 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 1D 65 0E A5 77 5B EA 23 B4 A8 3F 2E 79 35 B7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process WScript.exe:1632 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 0F 3C FB 95 C1 3B 47 02 1A 31 95 64 67 DB C3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\progra~1\drivers]
"$wdd.bat" = "$wdd"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The process WScript.exe:700 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "87 46 A8 01 FD D4 94 A9 AE 46 9A 85 1C 60 6F FC"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\progra~1\drivers]
"SVCH0ST.EXE" = "www.wk7b.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

MD5	File path
16ea8a19663cf76909faeff7e122a219	c:\Program Files\drivers\wk7b_update.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   svch0st.exe:332
   %original file name%.exe:1988
   WScript.exe:1632
   WScript.exe:700

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\16019826[1].js (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\14911066[1].js (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\wk-login[1].htm (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Program Files%\drivers\wk7b.ini (118 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ip-data[1].htm (2144 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Program Files%\drivers\wk7b_update.exe (9098 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Program Files%\drivers\$wdd.bat (199 bytes)
   %Program Files%\drivers\svch0st.exe (19988 bytes)
   %Program Files%\drivers\$wdd.vbs (98 bytes)
   %Program Files%\drivers\sc.vbs (381 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\Íþ¿ÍÆæ±ø[1].exe (68699 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	72754	73216	4.54391	894f17ef0a4e766fe486a080522d2539
.rdata	77824	7221	7680	3.38071	76315cc3ce7c7f34b89c00e96fd3d919
.data	86016	87804	512	2.4627	6f9415022853d8e925bcb178dd62e322
.CRT	176128	16	512	0.152104	d8690a66757c8eeab6988f4a858f4dcd
.rsrc	180224	14048	14336	3.6528	2949e1284c3723af5de5cd5df098fdbb

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3
6a6bccd9f2152490fc5406c43f356cab
ed8af42c61e9c629c8734e28e4cce5f3
40667f8e13fab2dfb391d6e350bee6dd

Network Activity

URLs

URL	IP
hxxp://js.users.51.la/14911066.js	113.107.42.34
hxxp://js.users.51.la/16019826.js	113.107.42.34
hxxp://icon.51.la/icon_9.gif	42.236.73.3
web.51.la	222.187.225.122
web2.51.la	119.147.144.50
sys.rradmin.com	221.233.60.44

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /icon_9.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: icon.51.la

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: image/gif

Last-Modified: Fri, 26 May 2006 14:28:04 GMT

Accept-Ranges: bytes

ETag: "0b24a99d080c61:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sun, 30 Aug 2015 09:11:44 GMT

Content-Length: 893

GIF89a0............`..6..4.........f.........................!..NETSCAPE2.0.....!.......,....0........I..8S.;'.'.cX.dj..hv ...A.5......I.@..r......vN..G....k...0.....n..XN.{K..>.n>..q..V...9GOaes..r5VW.=2\.o.......u....$Ik.2..#.............D.9.5.ZD............7.T.9.5...............!.......,....-.....].I2........f.H(..v.$6.-..i... ......oW..Z.`'..._..r.*..V.U..n..NX.5 ....a...b.Z.>...TYR...y...!.......,....-....._.I1........&...!.........0...[.....VEc...H Ng.....O2......V..vM.a:..JM...d}.o..j....kY\...zvxw..!.......,.... .....d.I2........f.H(..v..Eb.."...eJ.....X...../RH...S.YS.C.t.B...li...[. ...&l8s..3.M...[|.....:l~Z{o.....!.......,....-.....o.I1........&...!.U".."....i^.F.U....I...F....`9q....#15MI3.d.x,..D....K.m../.. .[.`.K...?Yc*)._.\'.p%\cs.&...'..!.......,.... .....j.I2........f.H(...J..J$6.1B.......0..gy..../.".bD.........T.u%..!.6..bD.\..s5.Y.F....7.V.-imd.f{9r.ayu.....;HTTP/1.1 200 OK..Cache-Control: no-cache..Content-Type: image/gif..Last-Modified: Fri, 26 May 2006 14:28:04 GMT..Accept-Ranges: bytes..ETag: "0b24a99d080c61:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Sun, 30 Aug 2015 09:11:44 GMT..Content-Length: 893..GIF89a0............`..6..4.........f.........................!..NETSCAPE2.0.....!.......,....0........I..8S.;'.'.cX.dj..hv ...A.5......I.@..r......vN..G....k...0.....n..XN.{K..>.n>..q..V...9GOaes..r5VW.=2\.o.......u....$Ik.2..#.............D.9.5.ZD............7.T.9.5...............!.......,....-.....].I2........f.H(..v.$6.-..i... ......oW..Z.`'..._..r.*..V.

<<< skipped >>>

GET /16019826.js HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js.users.51.la

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: max-age=300

Content-Length: 1983

Content-Type: application/x-javascript

Last-Modified: Fri, 07 Aug 2015 04:06:40 GMT

Accept-Ranges: bytes

ETag: "1c165276c6d0d01:2eff"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Sun, 30 Aug 2015 08:59:47 GMT

Connection: close

document.write ('<a href="hXXp://VVV.51.la/?16019826" target="_blank" title="51.La 网站流量统计系统"><img alt="51.La 网站流量统计系统" src="hXXp://icon.51.la/icon_9.gif" style="border:none" /></a>\n');..var a9826tf="51la";var a9826pu="";var a9826pf="51la";var a9826su=window.location;var a9826sf=document.referrer;var a9826of="";var a9826op="";var a9826ops=1;var a9826ot=1;var a9826d=new Date();var a9826color="";if (navigator.appName=="Netscape"){a9826color=screen.pixelDepth;} else {a9826color=screen.colorDepth;}..try{a9826tf=top.document.referrer;}catch(e){}..try{a9826pu =window.parent.location;}catch(e){}..try{a9826pf=window.parent.document.referrer;}catch(e){}..try{a9826ops=document.cookie.match(new RegExp("(^| )AJSTAT_ok_pages=([^;]*)(;|$)"));a9826ops=(a9826ops==null)?1: (parseInt(unescape((a9826ops)[2])) 1);var a9826oe =new Date();a9826oe.setTime(a9826oe.getTime() 60*60*1000);document.cookie="AJSTAT_ok_pages=" a9826ops ";path=/;expires=" a9826oe.toGMTString();a9826ot=document.cookie.match(new RegExp("(^| )AJSTAT_ok_times=([^;]*)(;|$)"));if(a9826ot==null){a9826ot=1;}else{a9826ot=parseInt(unescape((a9826ot)[2])); a9826ot=(a9826ops==1)?(a9826ot 1):(a9826ot);}a9826oe.setTime(a9826oe.getTime() 365*24*60*60*1000);document.cookie="AJSTAT_ok_times=" a9826ot ";path=/;expires=" a9826oe.toGMTString();}catch(e){}..try{if(document.cookie==""){a9826ops=-1;a9826ot=-1;}}catch(e){}..a9826of=a9826sf;if(a9826pf!=="

<<< skipped >>>

GET /14911066.js HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js.users.51.la

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: max-age=300

Content-Length: 1985

Content-Type: application/x-javascript

Last-Modified: Fri, 07 Aug 2015 03:47:20 GMT

Accept-Ranges: bytes

ETag: "2b32c3c3d0d01:2eff"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Sun, 30 Aug 2015 08:59:46 GMT

Connection: close

document.write ('<a href="hXXp://VVV.51.la/?14911066" target="_blank" title="51.La 网站流量统计系统"><img alt="51.La 网站流量统计系统" src="hXXp://icon.51.la/icon_9.gif" style="border:none" /></a>\n');..var a1066tf="51la";var a1066pu="";var a1066pf="51la";var a1066su=window.location;var a1066sf=document.referrer;var a1066of="";var a1066op="";var a1066ops=1;var a1066ot=1;var a1066d=new Date();var a1066color="";if (navigator.appName=="Netscape"){a1066color=screen.pixelDepth;} else {a1066color=screen.colorDepth;}..try{a1066tf=top.document.referrer;}catch(e){}..try{a1066pu =window.parent.location;}catch(e){}..try{a1066pf=window.parent.document.referrer;}catch(e){}..try{a1066ops=document.cookie.match(new RegExp("(^| )AJSTAT_ok_pages=([^;]*)(;|$)"));a1066ops=(a1066ops==null)?1: (parseInt(unescape((a1066ops)[2])) 1);var a1066oe =new Date();a1066oe.setTime(a1066oe.getTime() 60*60*1000);document.cookie="AJSTAT_ok_pages=" a1066ops ";path=/;expires=" a1066oe.toGMTString();a1066ot=document.cookie.match(new RegExp("(^| )AJSTAT_ok_times=([^;]*)(;|$)"));if(a1066ot==null){a1066ot=1;}else{a1066ot=parseInt(unescape((a1066ot)[2])); a1066ot=(a1066ops==1)?(a1066ot 1):(a1066ot);}a1066oe.setTime(a1066oe.getTime() 365*24*60*60*1000);document.cookie="AJSTAT_ok_times=" a1066ot ";path=/;expires=" a1066oe.toGMTString();}catch(e){}..try{if(document.cookie==""){a1066ops=-1;a1066ot=-1;}}catch(e){}..a1066of=a1066sf;if(a1066pf!=="

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

wk7b_update.exe_1968:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t%SVh

t%SVh

t$(SSh

t$(SSh

~%UVW

~%UVW

u$SShe

u$SShe

User32.dll

User32.dll

WinINet.dll

WinINet.dll

Wininet.dll

Wininet.dll

urlmon.dll

urlmon.dll

kernel32.dll

kernel32.dll

user32.dll

user32.dll

wininet.dll

wininet.dll

winmm.dll

winmm.dll

ComCtl32.dll

ComCtl32.dll

KERNEL32.DLL

KERNEL32.DLL

Oleacc.dll

Oleacc.dll

OLEACC.DLL

OLEACC.DLL

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

HttpOpenRequestA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindCloseUrlCache

FindCloseUrlCache

DeleteUrlCacheEntryA

DeleteUrlCacheEntryA

URLDownloadToFileA

URLDownloadToFileA

UrlMkSetSessionOption

UrlMkSetSessionOption

EnumWindows

EnumWindows

{B6F7542F-B8FE-46a8-9605-98856A687097}

{B6F7542F-B8FE-46a8-9605-98856A687097}

{EB5A8679-6C96-4465-A329-7911418F2582}

{EB5A8679-6C96-4465-A329-7911418F2582}

WebBrowser

WebBrowser

wk7b_update.exe

wk7b_update.exe

\wk7b.ini

\wk7b.ini

rasphone.exe -d

rasphone.exe -d

/wk-login.asp?banben=3.0&username=

/wk-login.asp?banben=3.0&username=

hXXp://

hXXp://

116.208.1.26:8090

116.208.1.26:8090

sys.rradmin.com:8090

sys.rradmin.com:8090

sys.wk7b.com:8090

sys.wk7b.com:8090

3598123.exe

3598123.exe

http=

http=

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.1

HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

wk7b_update.exe

wk7b_update.exe

/3.0/ip-data.asp

/3.0/ip-data.asp

/3.0/pv-data.asp

/3.0/pv-data.asp

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_USERS

hXXp://VVV.wk7b.com/wk_tx.asp

hXXp://VVV.wk7b.com/wk_tx.asp

hXXp://sys.rradmin.com:8090/

hXXp://sys.rradmin.com:8090/

ws2_32.dll

ws2_32.dll

Shell.Explorer.2

Shell.Explorer.2

Winmm.dll

Winmm.dll

dsound.dll

dsound.dll

S@Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.2a1pre) Gecko/20110324 Firefox/4.2a1pre

S@Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.2a1pre) Gecko/20110324 Firefox/4.2a1pre

Mozilla/5.0 (Windows; U; Windows NT 6.1; tr-TR) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27

Mozilla/5.0 (Windows; U; Windows NT 6.1; tr-TR) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27

Mozilla/5.0 (Windows; U; Windows NT 6.0) AppleWebKit/533.1 (KHTML, like Gecko) Maxthon/3.0.8.2 Safari/533.1

Mozilla/5.0 (Windows; U; Windows NT 6.0) AppleWebKit/533.1 (KHTML, like Gecko) Maxthon/3.0.8.2 Safari/533.1

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; QQDownload 1.7; GTB6.6; TencentTraveler 4.0; SLCC1; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.5.30729; .NET CLR 3.0.30729)

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; QQDownload 1.7; GTB6.6; TencentTraveler 4.0; SLCC1; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.5.30729; .NET CLR 3.0.30729)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; Media Center PC 6.0; InfoPath.3; MS-RTC LM 8; Zune 4.7)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; Media Center PC 6.0; InfoPath.3; MS-RTC LM 8; Zune 4.7)

Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; Alexa Toolbar; .NET CLR 2.0.50727)

Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; Alexa Toolbar; .NET CLR 2.0.50727)

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.53 Safari/534.30

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.53 Safari/534.30

Mozilla/4.0 (compatible; MSIE 6.1; Windows XP; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

Mozilla/4.0 (compatible; MSIE 6.1; Windows XP; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0; Media Center PC 4.0; SLCC1; .NET CLR 3.0.04320)

Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0; Media Center PC 4.0; SLCC1; .NET CLR 3.0.04320)

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36 SE 2.X MetaSr 1.0

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36 SE 2.X MetaSr 1.0

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SV1) ; 360SE)

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SV1) ; 360SE)

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.43 BIDUBrowser/2.x Safari/537.31

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.43 BIDUBrowser/2.x Safari/537.31

Opera/9.80 (Android 4.2.2; Linux; Opera Mobi/ADR-1012211514; U; cn) Presto/2.6.35 Version/10.1

Opera/9.80 (Android 4.2.2; Linux; Opera Mobi/ADR-1012211514; U; cn) Presto/2.6.35 Version/10.1

Mozilla/5.0 (Linux;U;Android 4.2.2;zh-cn;I7500 Build FRG83) AppleWebKit/533.1 (KHTML, like Gecko)Version/4.0 Mobile Safari/533.1

Mozilla/5.0 (Linux;U;Android 4.2.2;zh-cn;I7500 Build FRG83) AppleWebKit/533.1 (KHTML, like Gecko)Version/4.0 Mobile Safari/533.1

Mozilla/5.0 (Linux; U; Android 4.1.2; zh-cn; Coolpad 5890 Build/JZO54K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30; 360browser(securitypay,securityinstalled); 360(android,uppayplugin); 360 Aphone Browser (4.9.0)

Mozilla/5.0 (Linux; U; Android 4.1.2; zh-cn; Coolpad 5890 Build/JZO54K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30; 360browser(securitypay,securityinstalled); 360(android,uppayplugin); 360 Aphone Browser (4.9.0)

Mozilla/5.0 (Android 4.2.2; zh-cn; HTC_DesireS_S510e Build/GRI40) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1

Mozilla/5.0 (Android 4.2.2; zh-cn; HTC_DesireS_S510e Build/GRI40) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1

Mozilla/5.0 (Android 4.2.2; zh-cn; Build/FRF91) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1

Mozilla/5.0 (Android 4.2.2; zh-cn; Build/FRF91) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1

Mozilla/5.0 (Linux; U; Android 4.2.2; zh-cn; MI-ONE Plus Build/GINGERBREAD) UC AppleWebKit/534.31 (KHTML, like Gecko) Mobile Safari/534.31

Mozilla/5.0 (Linux; U; Android 4.2.2; zh-cn; MI-ONE Plus Build/GINGERBREAD) UC AppleWebKit/534.31 (KHTML, like Gecko) Mobile Safari/534.31

Opera/9.80 (Android 4.2.2; Opera Mini/7.6.32764/28.3234; U; zh) Presto/2.8.119 Version/11.10

Opera/9.80 (Android 4.2.2; Opera Mini/7.6.32764/28.3234; U; zh) Presto/2.8.119 Version/11.10

Opera/9.80 (Android 4.2.2; Linux; Opera Mobi/ADR-1012221546; U; cn) Presto/2.7.60 Version/10.5

Opera/9.80 (Android 4.2.2; Linux; Opera Mobi/ADR-1012221546; U; cn) Presto/2.7.60 Version/10.5

hXXp://VVV.baidu.com

hXXp://VVV.baidu.com

hXXp://VVV.baidu.com/s?cl=3&wd=

hXXp://VVV.baidu.com/s?cl=3&wd=

hXXp://VVV.google.com/search?complete=1&hl=zh-CN&btnG=Google 搜索&meta=&q=

hXXp://VVV.google.com/search?complete=1&hl=zh-CN&btnG=Google 搜索&meta=&q=

hXXp://VVV.so.com/s?ie=utf-8&src=360sou_home&q=

hXXp://VVV.so.com/s?ie=utf-8&src=360sou_home&q=

hXXps://

hXXps://

onkeydown

onkeydown

&7item.taobao.com/item.htm?id=20282100201

&7item.taobao.com/item.htm?id=20282100201

s.taobao.com/search?initiative_id=staobaoz_20130419&q=»ù´¡µçÐÅÐéÄâÖ÷»ú¿Õ¼ä 100MÐÍ

s.taobao.com/search?initiative_id=staobaoz_20130419&q=»ù´¡µçÐÅÐéÄâÖ÷»ú¿Õ¼ä 100MÐÍ

item.htm

item.htm

?baidu.com,google-analytics.com

?baidu.com,google-analytics.com

hXXp://VVV.wk7b.com/TaskForum.asp?ForumID=19

hXXp://VVV.wk7b.com/TaskForum.asp?ForumID=19

hXXp://VVV.wk7b.com

hXXp://VVV.wk7b.com

hXXp://iframe.ip138.com/ic.asp

hXXp://iframe.ip138.com/ic.asp

hXXp://VVV.wk7b.com/wk_dama.asp

hXXp://VVV.wk7b.com/wk_dama.asp

2012-1-1

2012-1-1

hXXp://VVV.wk7b.com/wk_soft.asp?userid=

hXXp://VVV.wk7b.com/wk_soft.asp?userid=

hXXp://VVV.wk7b.com/CreateUser.asp

hXXp://VVV.wk7b.com/CreateUser.asp

hXXp://VVV.wk7b.com/wk_help.asp

hXXp://VVV.wk7b.com/wk_help.asp

\wk7b_update.exe

\wk7b_update.exe

.js">

.js">

hXXp://sys.rradmin.com/tools.asp

hXXp://sys.rradmin.com/tools.asp

ieframe.dll

ieframe.dll

fNsQL

fNsQL

6=get 7.post 8.sina

6=get 7.post 8.sina

Q%*.*f

Q%*.*f

CNotSupportedException

CNotSupportedException

commctrl_DragListMsg

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

Afx:%x:%x

COMCTL32.DLL

COMCTL32.DLL

CCmdTarget

CCmdTarget

MSH_SCROLL_LINES_MSG

MSH_SCROLL_LINES_MSG

MSWHEEL_ROLLMSG

MSWHEEL_ROLLMSG

ole32.dll

ole32.dll

__MSVCRT_HEAP_SELECT

__MSVCRT_HEAP_SELECT

RASAPI32.dll

RASAPI32.dll

iphlpapi.dll

iphlpapi.dll

SHLWAPI.dll

SHLWAPI.dll

MPR.dll

MPR.dll

WINMM.dll

WINMM.dll

WS2_32.dll

WS2_32.dll

VERSION.dll

VERSION.dll

GetProcessHeap

GetProcessHeap

WinExec

WinExec

KERNEL32.dll

KERNEL32.dll

GetKeyState

GetKeyState

RegisterHotKey

RegisterHotKey

UnregisterHotKey

UnregisterHotKey

SetWindowsHookExA

SetWindowsHookExA

UnhookWindowsHookEx

UnhookWindowsHookEx

EnumChildWindows

EnumChildWindows

USER32.dll

USER32.dll

GetViewportOrgEx

GetViewportOrgEx

GDI32.dll

GDI32.dll

MSIMG32.dll

MSIMG32.dll

WINSPOOL.DRV

WINSPOOL.DRV

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyA

RegCreateKeyA

RegOpenKeyA

RegOpenKeyA

RegCreateKeyExA

RegCreateKeyExA

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

OLEAUT32.dll

OLEAUT32.dll

COMCTL32.dll

COMCTL32.dll

oledlg.dll

oledlg.dll

WSOCK32.dll

WSOCK32.dll

WININET.dll

WININET.dll

ATL.DLL

ATL.DLL

GetCPInfo

GetCPInfo

CreateDialogIndirectParamA

CreateDialogIndirectParamA

SetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

SetViewportExtEx

ScaleViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

GetViewportExtEx

comdlg32.dll

comdlg32.dll

.PAVCException@@

.PAVCException@@

Shell32.dll

Shell32.dll

Mpr.dll

Mpr.dll

Advapi32.dll

Advapi32.dll

Gdi32.dll

Gdi32.dll

Kernel32.dll

Kernel32.dll

(&07-034/)7 '

(&07-034/)7 '

?? / %d]

?? / %d]

%d / %d]

%d / %d]

.PAVCFileException@@

.PAVCFileException@@

: %d]

: %d]

(*.*)|*.*||

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

(*.CUR)|*.CUR|

%s:%d

%s:%d

windows

windows

.PAVCNotSupportedException@@

.PAVCNotSupportedException@@

out.prn

out.prn

(*.prn)|*.prn|

(*.prn)|*.prn|

%d.%d

%d.%d

%d/%d

%d/%d

%d / %d

%d / %d

Bogus message code %d

Bogus message code %d

(%d-%d):

(%d-%d):

%ld%c

%ld%c

ReleaseNamedPipe

ReleaseNamedPipe

DisConnectNamedPipe

DisConnectNamedPipe

WriteNamedPipe

WriteNamedPipe

ReadNamedPipe

ReadNamedPipe

ConnectNamedPipe

ConnectNamedPipe

ListenNamedPipe

ListenNamedPipe

CreateNamedPipe

CreateNamedPipe

\\.\mailslot\

\\.\mailslot\

%s

%s

Reply-To: %s

Reply-To: %s

From: %s

From: %s

To: %s

To: %s

Subject: %s

Subject: %s

Date: %s

Date: %s

Cc: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

%a, %d %b %Y %H:%M:%S

SMTP

SMTP

%s\%s.lnk

%s\%s.lnk

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

%d%d%d

%d%d%d

rundll32.exe shell32.dll,

rundll32.exe shell32.dll,

1.1.3

1.1.3

;3 #>6.&

;3 #>6.&

'2, / 0&7!4-)1#

'2, / 0&7!4-)1#

SERVER_PORT_SECURE

SERVER_PORT_SECURE

SERVER_PORT

SERVER_PORT

REMOTE_PORT

REMOTE_PORT

HTTPS_SERVER_SUBJECT

HTTPS_SERVER_SUBJECT

HTTPS_SERVER_ISSUER

HTTPS_SERVER_ISSUER

HTTPS_SECRETKEYSIZE

HTTPS_SECRETKEYSIZE

HTTPS_KEYSIZE

HTTPS_KEYSIZE

HTTPS

HTTPS

HTTP_HeaderName

HTTP_HeaderName

CERT_SUBJECT

CERT_SUBJECT

CERT_SERVER_SUBJECT

CERT_SERVER_SUBJECT

CERT_SERVER_ISSUER

CERT_SERVER_ISSUER

CERT_SERIALNUMBER

CERT_SERIALNUMBER

CERT_SECRETKEYSIZE

CERT_SECRETKEYSIZE

CERT_KEYSIZE

CERT_KEYSIZE

CERT_ISSUER

CERT_ISSUER

CERT_FLAGS

CERT_FLAGS

CERT_COOKIE

CERT_COOKIE

AUTH_PASSWORD

AUTH_PASSWORD

ALL_HTTP

ALL_HTTP

(*.htm;*.html)|*.htm;*.html

(*.htm;*.html)|*.htm;*.html

.PAVCOleException@@

.PAVCOleException@@

.PAVCObject@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCResourceException@@

.PAVCUserException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

.PAVCArchiveException@@

zcÁ

zcÁ

right-curly-bracket

right-curly-bracket

left-curly-bracket

left-curly-bracket

0123456789

0123456789

C:\progra~1\drivers\wk7b_update.exe

C:\progra~1\drivers\wk7b_update.exe

#include "l.chs\afxres.rc" // Standard components

#include "l.chs\afxres.rc" // Standard components

(*.*)

(*.*)

3.0.0.0

3.0.0.0

VVV.wk7b.com

VVV.wk7b.com

wzw@wk7b.com

wzw@wk7b.com