Gen.Variant.Strictor.80808_33d3c84e95 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:484

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:484 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\50[1].jpg (73 bytes)
%Documents and Settings%\%current user%\Application Data\ÃƒÂÃƒÂ¨Ã‚Â¸ÃƒÂ§Ã‚Â¸Ã‚Â¨Ãƒâ€“ÃƒÂº\9ifz.exe (1632 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qzone.qq[1].htm (8977 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cgi_get_portrait[1].htm (129 bytes)
%Documents and Settings%\%current user%\Application Data\ÃƒÂÃƒÂ¨Ã‚Â¸ÃƒÂ§Ã‚Â¸Ã‚Â¨Ãƒâ€“ÃƒÂº\dlcore.dll (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1027663760[1].htm (22283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\getonline[1].htm (12 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\getonline[1].htm (0 bytes)

Registry activity

The process %original file name%.exe:484 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 59 6B 9D 7F 6A 10 BB 79 07 8C 94 5C F0 C8 84"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
4e636c45b40b2ff461e786206e74ce55	c:\Documents and Settings\"%CurrentUserName%"\Application Data\ÃÃ¨Â¸Ã§Â¸Â¨Ã–Ãº\9ifz.exe
836fc9d7fdf690d023e3b0a38a980420	c:\Documents and Settings\"%CurrentUserName%"\Application Data\ÃÃ¨Â¸Ã§Â¸Â¨Ã–Ãº\dlcore.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\50[1].jpg (73 bytes)
%Documents and Settings%\%current user%\Application Data\ÃƒÂÃƒÂ¨Ã‚Â¸ÃƒÂ§Ã‚Â¸Ã‚Â¨Ãƒâ€“ÃƒÂº\9ifz.exe (1632 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qzone.qq[1].htm (8977 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cgi_get_portrait[1].htm (129 bytes)
%Documents and Settings%\%current user%\Application Data\ÃƒÂÃƒÂ¨Ã‚Â¸ÃƒÂ§Ã‚Â¸Ã‚Â¨Ãƒâ€“ÃƒÂº\dlcore.dll (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1027663760[1].htm (22283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\getonline[1].htm (12 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	592214	593920	4.54431	60e8816f5df9675805d3ea5851e728d3
.rdata	598016	751670	753664	4.42488	2beae175ae5436d3ee071c43e9f168bc
.data	1351680	312906	73728	3.56456	2053f1869a536a13511157dbfae1a702
.rsrc	1667072	54672	57344	4.21988	5a3903b921de038c11d4dd45366d18c8

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://q.qlogo.cn/headimg_dl?bs=qq&dst_uin=1027663760&src_uin=1027663760&fid=1027663760&spec=40&url_enc=0&referer=bu_interface&term_type=PC
hxxp://qqshow-user.tencent.com/1027663760/10/	58.251.139.139
hxxp://a1165.b.akamai.net/
hxxp://webproxy-sz.qplus.com/getonline?Type=1&1027663760:
hxxp://users.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?get_nick=1&uins=1027663760	194.146.191.112
hxxp://q3.qlogo.cn/headimg_dl?bs=qq&dst_uin=1027663760&src_uin=1027663760&fid=1027663760&spec=40&url_enc=0&referer=bu_interface&term_type=PC	1.113.192.15
hxxp://g.cnc.qzone.qq.com/cgi-bin/friendshow/cgi_get_visitor_simple?uin=1027663760	1.103.192.18
hxxp://user.qzone.qq.com/1027663760?ptlang=2052	194.146.191.104
hxxp://webpresence.qq.com/getonline?Type=1&1027663760:	103.7.30.103
hxxp://qzone.qq.com/	1.105.192.18
hxxp://qlogo3.store.qq.com/qzone/1027663760/1027663760/50	37.29.0.112

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Accept: */*

Referer: hXXp://g.cnc.qzone.qq.com/cgi-bin/friendshow/cgi_get_visitor_simple?uin=1027663760

Accept-Language: zh-cn

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Cache-Control: no-cache

Host: qzone.qq.com

HTTP/1.1 200 OK

Server: org-imgcache

Last-Modified: Wed, 20 May 2015 02:49:50 GMT

Content-Type: text/html

Location: hXXp://qzone.qq.com/index.html

ETag: "555bf64e-8c34"

Cache-Control: max-age=600

Date: Mon, 08 Jun 2015 06:19:50 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Connection: Transfer-Encoding

00008C34..<!doctype html>..<html>...<head>....<meta charset="UTF-8" />....<meta http-equiv="content-type" content="text/html; charset=UTF-8" />....<meta http-equiv="X-UA-Compatible" content="IE=edge">....<title>QQ......-...........................</title>....<meta name="keywords" content="QQ...... Qzone ............ ......QQ...... QQ...... QQ......" />....<meta name="description" content="QQ......(Qzone)....................................QQ................................................................................................................................................................................................QQ........................................................................................................................................................." />....<link rel="apple-touch-icon" href="hXXp://qzonestyle.gtimg.cn/qzone/v8/index/touch-icon-ipad-retina.png">....<link rel="apple-touch-icon" sizes="76x76" href="hXXp://qzonestyle.gtimg.cn/qzone/v8/index/touch-icon-ipad.png">....<link rel="apple-touch-icon" sizes="120x120" href="hXXp://qzonestyle.gtimg.cn/qzone/v8/index/touch-icon-iphone-retina.png">....<link rel="apple-touch-icon" sizes="152x152" href="hXXp://qzonestyle.gtimg.cn/qzone/v8/index/touch-icon-ipad-retina.png">....<link rel="icon" sizes="any" mask href="hXXp://qzonestyle.gtimg.cn/qzone/v8/img/Qzone.svg">....<meta name="theme-color" content="#FFC028">....<script type="te

<<< skipped >>>

GET /cgi-bin/friendshow/cgi_get_visitor_simple?uin=1027663760 HTTP/1.1

Accept: */*

Referer: hXXp://g.cnc.qzone.qq.com/cgi-bin/friendshow/cgi_get_visitor_simple?uin=1027663760

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: g.cnc.qzone.qq.com

Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily

Server: QZHTTP-2.38.18

Content-Encoding: gzip

Content-Type: text/html

Location: hXXp://qzone.qq.com

Date: Mon, 08 Jun 2015 06:19:49 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Connection: Transfer-Encoding

Set-Cookie: qzone_check=; EXPIRES=Fri, 02-Jan-1970 00:00:00 GMT; PATH=/; DOMAIN=qq.com

Set-Cookie: _qz_referrer=; expires=Mon, 26 Jul 1997 05:00:00 GMT; PATH=/; DOMAIN=qq.com

0000000A..............00000000..

GET /1027663760?ptlang=2052 HTTP/1.1

Accept: */*

Referer: hXXp://user.qzone.qq.com/1027663760?ptlang=2052

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: user.qzone.qq.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: QZHTTP-2.38.18

X-Frame-Options: SAMEORIGIN

X-UA-Compatible: IE=Edge

Last-Modified: Mon, 08 Jun 2015 06:19:54 GMT

Cache-Control: max-age=0, no-transform, proxy-revalidate

Content-Type: text/html; charset=utf-8

Date: Mon, 08 Jun 2015 06:19:55 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Connection: Transfer-Encoding

Set-Cookie: qzone_check=; EXPIRES=Fri, 02-Jan-1970 00:00:00 GMT; PATH=/; DOMAIN=qq.com

Set-Cookie: _qz_referrer=; expires=Mon, 26 Jul 1997 05:00:00 GMT; PATH=/; DOMAIN=qq.com

Set-Cookie: rv2=80104B63807AC267E197218EB32EB7B5D911532979C6DC8651; PATH=/; DOMAIN=qq.com;

Set-Cookie: property20=2DB2D252FA309516759C00D97B075A48BF8C561223F148053B62D7207C68FC12F74C72BD993768CE; PATH=/; DOMAIN=qq.com;

0000B853................................................<!DOCTYPE HTML>..<html lang="zh-cn" class="skin-dark pg-profile">..<head>..<noscript><meta http-equiv="refresh" content="0; url=hXXp://os.qzs.qq.com/qzone/v6/troubleshooter/noscript.html" /></noscript>..<meta charset="UTF-8" />..<meta http-equiv="content-type" content="text/html; charset=UTF-8" />..<title>............... VVV.9ifz.org [hXXp://ling9ifz.qzone.qq.com]</title>..<meta name="keywords" content="QQ......,......,............,............,QQ......,QQ......" />.....<meta name="description" content="" />..<link rel="apple-touch-icon" href="hXXp://qzonestyle.gtimg.cn/qzone/v8/index/touch-icon-ipad-retina.png">..<link rel="apple-touch-icon" sizes="76x76" href="hXXp://qzonestyle.gtimg.cn/qzone/v8/index/touch-icon-ipad.png">..<link rel="apple-touch-icon" sizes="120x120" href="hXXp://qzonestyle.gtimg.cn/qzone/v8/index/touch-icon-iphone-retina.png">..<link rel="apple-touch-icon" sizes="152x152" href="hXXp://qzonestyle.gtimg.cn/qzone/v8/index/touch-icon-ipad-retina.png">..<link rel="icon" sizes="any" mask href="hXXp://qzonestyle.gtimg.cn/qzone/v8/img/Qzone.svg">..<meta name="theme-color" content="#FFC028">.........<script type="text/javascript">..... .var g_domain = "qq.com";.. .. document.domain=g_domain;.. var _s_=new Date(),g_T={},siDomain="os.qzonestyle.gtimg.cn",imgcacheDomain="os.qzs." g_domain,g_iUin=1027663760,g_iLoginUin=0;g_T

<<< skipped >>>

GET /headimg_dl?bs=qq&dst_uin=1027663760&src_uin=1027663760&fid=1027663760&spec=40&url_enc=0&referer=bu_interface&term_type=PC HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: q3.qlogo.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: ImgHttp3.0.0

Connection: keep-alive

Content-Type: image/jpeg

Content-Length: 876

Last-Modified: Wed, 03 Jun 2015 14:25:27 GMT

Cache-Control: max-age=2592000

X-Delay: 25147 us

X-Info: real data

X-Cpt: filename=0

User-ReturnCode:0

Size: 876

chid: 0

fid: 0

X-Region: sz

X-RtFlag: 1

......JFIF.....`.`......Exif.....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......(.(.."........................................ ...........................!1.Aa..".#Qq........................................................!A............?..;.\q..KqIB.6T...r}N...b...%......4......{....s.".. .....x.-Q..V....P.H;..o....\b.6|.srk,&....`...J.....c.dy......a........i!.....Q.3..q.qt...#.WC.....1.....*....m.Q(qgA*Rv...r.cN.IM.G...ZYS..Kz.Ro......g1..Em.... %..mi.B.R.........w.wL...Y../.[G.b.y.g.O .........>.'9..Q..#...?...V#./*{.Xi._0.............n..W..F..{.m..lm....G.0.$(->O"..}...\..%byD..H.I.DF..-...2<(.c`.%.\@.m.O$....u.d.XI.l...=.N.B....%;H).vI.Z.2,]>........t6..........*:.......u.X9....]......q. ......d......o}..a...aE......(.H.A#.{QR.@.z_.k^.hy|.HQ....F.\..4.......@S..QL...HTTP/1.1 200 OK..Server: ImgHttp3.0.0..Connection: keep-alive..Content-Type: image/jpeg..Content-Length: 876..Last-Modified: Wed, 03 Jun 2015 14:25:27 GMT..Cache-Control: max-age=2592000..X-Delay: 25147 us..X-Info: real data..X-Cpt: filename=0..User-ReturnCode:0..Size: 876..chid: 0..fid: 0..X-Region: sz..X-RtFlag: 1........JFIF.....`.`......Exif.....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......(.(.."........................................ ...........................!1.Aa..".#Qq........................................................!A...........

<<< skipped >>>

GET /qzone/1027663760/1027663760/50 HTTP/1.1

Accept: */*

Referer: hXXp://qlogo3.store.qq.com/qzone/1027663760/1027663760/50

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: qlogo3.store.qq.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 06:19:41 GMT

Server: PWS/8.1.20.9

X-Px: ms h0-s1136.v0-mow ( h0-s1145.v0-mow), ms h0-s1145.v0-mow ( h0-s1530.p21-nrt), rf-ht h0-s1530.p21-nrt ( origin)

Cache-Control: max-age=600

Expires: Mon, 08 Jun 2015 06:29:42 GMT

Age: 0

Content-Length: 2167

Content-Type: image/jpeg

Last-Modified: Thu, 30 Apr 2015 01:43:21 GMT

Connection: keep-alive

......JFIF.....&.&.....C....................................................................C.......................................................................2.2..........................................6............................!1"AQa..q.23..#BCRs.....................................0........................!1..AQq...#2a...."B...............?.. 6|8.VjQ...!...vJ@K.V.Q....a|.U{.e.F....w.j..i...1\HC......'.*'$..I..V1.b4m......5-..:.\..i...Z...z.^.....`KE...P...Z9C..B.t)'.p{.F}.......!.E..&\........J?.@.z}...:..V.0. &.@p.d...\.Q...e*..?.G..Q.I..Y......lM...Fq......A...f.l{>....U..E....!..N.Oo>...i.F.t(~$...cu.].V..5:uMr.O.@s.V.N.g._.....,..1..T.....s....>...w&...$DO...m.'.<...3w...o.....).sQ.........7..M......3\.r.6"t.d@..?.$...%...%...6#.d.6(......b.....)...._.*7--.'.S.a......g..?mG..j.bh.....)...=.;...m.E#.#...T.P....Mr......B.....Y...m.. $.u....W"c%xB.....^./..|d.sC...1i..E..#....Q...`aD.3.G.........z.Z..{......[.F.U.2..}......vg..:d..F%...a..#.*.9.....Nj....... IS$...<I..k7..r......~.5kX......5fe.\.-.JSi["!J.R...?......bd.....y...m8.?.}.?.8.1...wx.....}.e ...:.a.../f..>...Z........).~.P.#Qi.....!:`R.7V......^..7%..V.....X?...rr...V.....}......U..[....2])...!C.=t.....@a...i.}..P.(v....j...).`.S........%.#...p....K.4.?.F X.........v...>...U;....w....A.G...H!..00;A.......)W...Sc...S..Z.S...... ....kE......).W..2-P/..'...C Sk....eC.qJ.'.....M;.. .....Z..W>.w.JJ.J.H.2;i....(..Y.......!...:Zv9..R...!#........J......P...........T....$..P...L0....R.'...G~........h.u.V....%..... h...mje

<<< skipped >>>

GET /fcg-bin/cgi_get_portrait.fcg?get_nick=1&uins=1027663760 HTTP/1.1

Accept: */*

Referer: hXXp://users.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?get_nick=1&uins=1027663760

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: users.qzone.qq.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: QZHTTP-2.37.1

Cache-Control: max-age=86400

Content-Type: text/html

Date: Mon, 08 Jun 2015 06:19:51 GMT

Content-Length: 129

Connection: keep-alive

portraitCallBack({"1027663760":["hXXp://qlogo1.store.qq.com/qzone/1027663760/1027663760/100",34125,-1,7,0,1,"..............",0]})HTTP/1.1 200 OK..Server: QZHTTP-2.37.1..Cache-Control: max-age=86400..Content-Type: text/html..Date: Mon, 08 Jun 2015 06:19:51 GMT..Content-Length: 129..Connection: keep-alive..portraitCallBack({"1027663760":["hXXp://qlogo1.store.qq.com/qzone/1027663760/1027663760/100",34125,-1,7,0,1,"..............",0]})..

GET /1027663760/10/ HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: qqshow-user.tencent.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Connection: close

Server: QZHTTP-2.1

Date: Mon, 08 Jun 2015 06:19:47 GMT

Accept-Ranges: bytes

Cache-Control: max-age=7200

Content-Length: 13770

Content-Type: image/gif

GIF87a...............(.PZ.............T{B. ...G)6...............bE5[-U.........{_[m..e-O....j.mF_.......2B.......r2...Q91..q.-9.......aG./4.....P...kOB.........%..............kTdc7,.......w..x......................sIZ............ .!.r..........C.2.[mke.....q^....Jn...s1[~ks...cBP.........W8J.............j..kp...gk.............R,%j9VT,D.......Ni~@g.Js..................................u.J<.7.*....[.sK.....GK.....................439......OAC.................$.[`..................VP.............................[b...^$K.............sx...............UJT..................................=J...wTH...............N"B..........0=7(2........................n. .;G.^.}a..TT.zt....AL\.#..................................&%...yw.....xi.|.X 1..........lR.................................s?f,...............H......*\......#J.H.....3j...... C..I....(S.\.....0c..I....8s.......@...J.....1.s.I)R...a...F.xOuJ....R.YkFEB..Y.H....u*3?~.z..6f..f. Y.TmH.t.".:..Y?M....1j.....u4.p^LH.1...kTf.6c.LP.#.......Y_..aGe......... .Y.......;....k;..h...k.R]..z.....v...U.R..cbN.x].X.Q_.....\...b~p[$....{...E]9b.".Ag.l.!.[`..V.{.m...k.F.g.......w......~U.( ._...g`...t.r...|l......Z..96...y.........Xqbv...`..E)em7R........6zX..t)u[nFb6.U.^v.Y&..#..-...t...~T..e.NL......UU.....H|.WZ.%....X...h...mvfj...].%.....~_zw.[.......h&...8.\...h._.i...1....X....N.....-..^....q.!x..q.....Xa.........kg......{.K..S.:...-@...~eg.z.e..XX....h.....k...N.^....C.].f.^.^e..tIE.k...b...eiB...).....?.O...N.y.m..&...>Y.}q-`........6.(.s..t.1....{..r..r...92.s..%.Y.Xh....l

<<< skipped >>>

GET /getonline?Type=1&1027663760: HTTP/1.1

Accept: */*

Referer: hXXp://webpresence.qq.com/getonline?Type=1&1027663760:

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: webpresence.qq.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: tws

Date: Mon, 08 Jun 2015 06:19:17 GMT

Content-Type: text/html; charset=ISO-8859-1

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

c..online[0]=0;..0..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_484:

.text

`.rdata

@.data

.rsrc

t$(SSh

~%UVW

u$SShe

wininet.dll

kernel32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1027663760

hXXp://qlogo3.store.qq.com/qzone/

hXXp://qqshow-user.tencent.com/

hXXp://g.cnc.qzone.qq.com/cgi-bin/friendshow/cgi_get_visitor_simple?uin=

hXXp://users.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?get_nick=1&uins=

hXXp://webpresence.qq.com/getonline?Type=1&

hXXp://user.qzone.qq.com/

https

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

http=

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

&spec=40&url_enc=0&referer=bu_interface&term_type=PC

hXXp://q3.qlogo.cn/headimg_dl?bs=qq&dst_uin=

\9ifz.exe

\dlcore.dll

.reloc

CCmdTarget

%*.*f

CNotSupportedException

commctrl_DragListMsg

COMCTL32.DLL

__MSVCRT_HEAP_SELECT

user32.dll

GetProcessHeap

KERNEL32.dll

EnumWindows

MsgWaitForMultipleObjects

RegCloseKey

RegCreateKeyExA

RegOpenKeyA

ADVAPI32.dll

SHLWAPI.dll

comdlg32.dll

iphlpapi.dll

GetWindowsDirectoryA

GetCPInfo

SetWindowsHookExA

GetKeyState

UnhookWindowsHookEx

RegOpenKeyExA

SHELL32.dll

ole32.dll

MPR.dll

WINMM.dll

WS2_32.dll

VERSION.dll

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

WINSPOOL.DRV

WININET.dll

dlcore.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

&_*.lnk

iexplore.exe,Internet Explorer

sogouexplorer.exe,

Firefox.exe,

opera.exe,opera

360se.exe,360

chrome.exe,google

360chrome.exe,360

baidubrowser.exe,

QQbrowser.exe,QQ

leibao.exe,

2345Explorer.exe,

2345Chrome.exe,

firefox.exe,

maxthon.exe,

Juzi.exe,

taobrowser.exe,

yybrowser.exe,YY

yyexplorer.exe,YY

C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch

C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu

C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs

C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu

C:\Users\

%Documents and Settings%\

\AppData\Roaming\Microsoft\Windows\Start Menu\Programs

\AppData\Roaming\Microsoft\Windows\Start Menu

http\shell\open\command\

Kernel32.dll

Comdlg32.dll

shlwapi.dll

advapi32.dll

program internal error number is %d.

:"%s"

:"%s".

%s,%d

%s.lnk

1.1.3

;3 #>6.&

'2, / 0&7!4-)1#

.?AVCCmdTarget@@

.PAVCException@@

.?AVCCmdUI@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCArchiveException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.?AVCTestCmdUI@@

zcÁ

6-6}6

:$:(:,:0:4:8:<:>

0 0$0(0,0004080

2 2$2(2,2

2!2%2)2-2125292

.ndata

@.reloc

;~TtCP

FtPj

RegDeleteKeyExW

Kernel32.DLL

PSAPI.DLL

operator

GetProcessWindowStation

127.0.0.1

0.0.0.0

,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u

upload_data.qq.com

121.14.102.16

COMM:%u,%u,%u,%I64u,%I64u,%d,%d,%d,%d,%d,%d,%d,%d,%d

,0,0,0,0,0

User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows Xp)

Host: %s:%d

(%d) d:d:d.d000 %s: %s

pdlxf.qq.com

fs-tcp-conn.qq.com

stun.qq.com

xuanfengnet.qq.com

fs-hello.qq.com

fs-conn.qq.com

fs-h2u.qq.com

fs-report.qq.com

R:\TempView\Misc\Setup3\build\Release\QQSetupEx.pdb

NETAPI32.dll

CreatePipe

GetWindowsDirectoryW

RegOpenKeyExW

RegCreateKeyW

RegDeleteKeyW

RegEnumKeyW

RegCreateKeyExW

SHFileOperationW

ShellExecuteExW

ShellExecuteW

CryptCATCatalogInfoFromContext

WTHelperGetProvCertFromChain

WINTRUST.dll

CertGetNameStringW

CRYPT32.dll

.?AVCVideoMsg@@

^SQLS^

'%cMMV#)

Hummer Backup Setup EXE

5;7,8084888

>#> >[>

?#?-?2?7?

5_5X5o5

7&8 80888

>#>(>->7>

?)?.?3?=?

0'1?1.6:6

4!4%4)4-4

7|7g7

? ?$?(?,?0?

6 6$6(6,60646

Thawte Certification1

hXXp://ocsp.thawte.com0

.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

hXXp://ts-ocsp.ws.symantec.com07

hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0

hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

.Class 3 Public Primary Certification Authority0

hXXp://crl.verisign.com/pca3.crl0

hXXps://VVV.verisign.com/cps0

#hXXp://logo.verisign.com/vslogo.gif04

hXXp://ocsp.verisign.com0>

2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,

/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D

hXXps://VVV.verisign.com/rpa0

hXXp://ocsp.verisign.com0;

/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0

hXXps://VVV.verisign.com/cps0*

#hXXp://crl.verisign.com/pca3-g5.crl04

hXXp://ocsp.verisign.com0

@wininet.dll

%d&&'

123456789

00003333

F%*.*f

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

Broken pipe

Inappropriate I/O control operation

Operation not permitted

RASAPI32.dll

WinExec

GetViewportOrgEx

ShellExecuteA

OLEAUT32.dll

WSOCK32.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

CreateDialogIndirectParamA

GetViewportExtEx

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

VVV.dywt.com.cn

.PAVCResourceException@@

.PAVCUserException@@

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

1, 0, 6, 6

- Skin.dll

Software\Microsoft\Windows\CurrentVersion

*?|/":

invalid registry key

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

RMDir: RemoveDirectory failed("%s")

RMDir: RemoveDirectory("%s")

RMDir: RemoveDirectory invalid input("%s")

Delete: DeleteFile failed("%s")

Delete: DeleteFile("%s")

install.log

Section: "%s"

.DEFAULT\Control Panel\International

logging set to %d

settings logging to %d

WriteReg: error creating key "%s\%s"

WriteReg: error writing into "%s\%s" "%s"

WriteRegDWORD: "%s\%s" "%s"="0xx"

WriteRegExpandStr: "%s\%s" "%s"="%s"

WriteRegStr: "%s\%s" "%s"="%s"

DeleteRegKey: "%s\%s"

DeleteRegValue: "%s\%s" "%s"

WriteINIStr: wrote [%s] %s=%s in %s

CopyFiles "%s"->"%s"

Exec: failed createprocess ("%s")

Exec: success ("%s")

Exec: command="%s"

ExecShell: success ("%s": file:"%s" params:"%s")

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d

Exch: stack

RMDir: "%s"

MessageBox: %d,"%s"

Delete: "%s"

Rename failed: %s

Rename: %s

IfFileExists: file "%s" does not exist, jumping %d

IfFileExists: file "%s" exists, jumping %d

CreateDirectory: "%s" created

CreateDirectory: can't create "%s" - a file already exists

CreateDirectory: can't create "%s" (err=%d)

CreateDirectory: "%s" (%d)

SetFileAttributes: "%s":X

Sleep(%d)

detailprint: %s

Call: %d

Aborting: "%s"

Jump: %d

HKERNEL32.DLL

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

hXXp://dldir1.qq.com/qqfile/qq/plugin/setuppkg.7z.output

_TX~QQSetupEx~0503~A1C22B84-CE8D-437A-AA60-6D3ABCB18ACF

RCreateWindowsDirTemp

R:\TempView\Misc\Setup3\BackupDownloader\BackupDownload.cpp

create folder :%s error, errcode:%lu

dir:%s

ParseCmdLine

`anonymous-namespace'::ParseCmdLine

cmd line

r:\tempview\misc\setup3\backupdownloader\installobject\InstallObject.h

GetExitCodeProcess exit code : %u

CInstallObjectAgent::CloseProcessHandle

ID=%d

r:\tempview\misc\setup3\backupdownloader\installobject\InstallObjectDefault.h

%d.%d.%d.%d

R:\TempView\Misc\Setup3\BackupDownloader\InstallObject\InstallObjectDefault.cpp

%s\drivers\usbvideo.sys

usbvideo.sys file version: %s

5.1.2600.2729

usbvideo.sys file version is big than 5.1.2600.2729, no need install KB899271

SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB899271

has register key:SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB899271 , no need install KB899271

hXXp://download.microsoft.com/download/4/6/0/460ca2ec-55b8-46d6-afb6-b644a7e03d71/WindowsXP-KB899271-v4-x86-CHS.exe

hXXp://dldir1.qq.com/music/clntupate/QzoneMusicInstall.exe

hXXp://dldir1.qq.com/music/clntupate/QQPhotoDrawExSetupForQQ.exe

hXXp://dldir1.qq.com/P2PUpdate/P2PSetup.exe

hXXp://dldir1.qq.com/qqfile/qq/videomsg/VideoMsgInstall.exe

hXXp://dldir1.qq.com/qqfile/qq/plugin/VideoShowPlayerInstall.exe

hXXp://dldir1.qq.com/qqfile/qq/plugin/VideoBeautyInstall.exe

hXXp://dldir1.qq.com/invc/cyclone/QQMiniDL_Setup.exe

hXXp://dlied6.qq.com/invc/xfspeed/kxg/versetup/QQWifiDL.exe

Copy File : %s to %s error, errcode:%lu

hXXp://dldir1.qq.com/qqfile/qq/plugin/QQGameMicro_setup.exe

\QQGame.exe

QQGame.exe

hXXp://dldir1.qq.com/qqfile/qq/plugin/HotWordInstall.exe

hXXp://androidpc.app.qq.com/app1/vertis.do?id=201409090001

BrowserInstaller.exe

@hXXp://dldl.qq.com/dl/qqie8

hXXp://dldl.qq.com/dl/qq

hXXp://dldir1.qq.com/music/clntupate/QQMusicDownloader.exe

hXXp://dldir1.qq.com/qqtv/qqlivesetup.exe

QQBrowser_Setup_QQ.exe

hXXp://dldir3.qq.com/minigamefile/QQGameDownloader.exe

hXXp://ws.sj.qq.com/webservices/download.do?yw=qq

QQPhoneManager_700024.exe

\rundll32.exe

R:\TempView\Misc\Setup3\BackupDownloader\Util\7zUtil.cpp

decoder doesn't support this archive

ERROR #%d

gfile path : %s

R:\TempView\Misc\Setup3\BackupDownloader\Util\DecryptUtil.cpp

Open file failed, error code : %u

Get file size failed, error code : %u

File size too large, HighPart = %u

AR:\TempView\Misc\Setup3\BackupDownloader\DataReport\DataReport.cpp

DataReport::UploadInstallResult

log.tlg

\\.\PhysicalDrive0

Siphlpapi.dll

ACreateDownloader. uiCustomID = %d

strFilePath = %s

uiCustomID = %d

CDownload::IsWorking(). m_bInited = %d

strUrl = %s

strFileName = %s

CDownload::DeleteTask(). uiTaskID = %d

CDownload::HandleDeleteTask(). uiTaskID = %d

CDownload::DeleteTask(). strUrl = %s

CDownload::HandleDeleteTask(). strUrl = %s

CDownload::SetDownloadSpeed(). uiSpeed = %d

CDownload::SetP2PUploadSpeed(). uiSpeed = %d

CDownload::HandleSetP2PUploadSpeed(). uiSpeed = %d

CDownload::SetSafeMode(). bSafeMode = %d

CDownload::HandleSetSafeMode(). bSafeMode = %d

stProxyInfo.eProxyType = %d

stProxyInfo.strProxyIP = %s

stProxyInfo.usProxyPort = %d

CDownload::OnNotify()->OnDownloadComplete. uiTaskID = %d, uiResult = %d, uiErrorCode = %d, uiDetailErrorCode = %d

Adlcore.dll

QQPCDetector.dll

R:\TempView\Misc\Setup3\BackupDownloader\Network\BizInstallerMgr.cpp

task:%lu, download error code:%d

task:%lu, filename:%s

%d not need to download

%d need to download

name = %s

url = %s

args = %s

filename = %s

dlcore dll not exist, file:%s

iter->bFinished:%d

Start ObjectId:%u

m_oDownloadMgr.StartTask returns:%d

default file %s download ok, local file : %s

optional file %s download ok, local file : %s

%s...

ObjId: %u

Name: %s

Url: %s

Args: %s

Filename: %s

install a file:%s

run install failed, error code : %u

GetDectectorResult() successed, wording: %s

RunDetector successed, dwOperator == %d

RunDetector failed, dwOperator == %d

dwOperator Invaild, dwOperator == %d

GetInstallObjsReportString

CBizInstallerMgr::GetInstallObjsReportString

R:\TempView\Misc\Setup3\BackupDownloader\Network\BizInstallerWindow.cpp

WM_TASKTRAY_MSG

dwCookie:%d

R:\TempView\Misc\Setup3\BackupDownloader\Network\DownloadMgr.cpp

CreateDownloadTask,Url:%s, localPath:%s

CDownloadMgr::CreateHttpDownloadTask

m_oDownloader.StartTask, dwCookie:%d, return %d

CDownloadMgr::DeleteTask, dwCookie:%d

m_mapCookieToTask.erase, dwCookie:%d

szFileName = %s

7.1.14522.0

(*.*)

%original file name%.exe_484_rwx_10000000_0003E000:

`.rsrc

L$(h%f

SSh0j

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ð

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1, 0, 6, 6

- Skin.dll

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps