HEUR:Trojan.Win32.Generic (Kaspersky), Dropped:Generic.Malware.SBdldg.977F6406 (B) (Emsisoft), Dropped:Generic.Malware.SBdldg.977F6406 (AdAware), mzpefinder_pcap_file.YR, GenericDownloader.YR (Lavasoft MAS)Behaviour: Trojan, Malware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 4a17cdde6644a7626acda7d712055c08
SHA1: c3b05b2244817191e22c07aed57a09c4ca371029
SHA256: b38e7fa11d5672ecbde91958574d86a832e03f66e6b5e80dc2d04f9c2977185d
SSDeep: 768:WssAbLVB6whGSeNs64aeciekinz3FBAJhAg6w/eb6mU1JiSOnJol9:g2LVBRGSey642RnwAgHcdGqSl9
Size: 70332 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2007-03-03 12:01:51
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Dropped creates the following process(es):
comine.exe:1376
ll5266.exe:664
%original file name%.exe:644
awx5266.exe:568
dh5266.exe:1360
cccccc.exe:1388
ping.exe:2000
The Dropped injects its code into the following process(es):
conime5266.exe:820
spolsv.exe:136
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:644 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
%WinDir%\spolsv.exe (601 bytes)
The process spolsv.exe:136 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2TYR8BIN\conime5266[1].exe (8084 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8HQTA5YJ\awx5266[1].exe (16073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2TYR8BIN\desktop.ini (67 bytes)
%WinDir%\Help\dh5266.exe (3343 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8HQTA5YJ\dh5266[1].exe (10369 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EFQX0RSV\desktop.ini (67 bytes)
%WinDir%\Help\ll5266.exe (24 bytes)
%WinDir%\Help\conime5266.exe (576 bytes)
%WinDir%\Help\awx5266.exe (10570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2TYR8BIN\ll5266[1].exe (2907 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8HQTA5YJ\desktop.ini (67 bytes)
%System%\drivers\etc\hosts (402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YJOFEZGX\desktop.ini (67 bytes)
The Dropped deletes the following file(s):
%System%\drivers\etc\hosts (0 bytes)
The process awx5266.exe:568 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EFQX0RSV\iplookup[1].htm (203 bytes)
The process dh5266.exe:1360 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
The process cccccc.exe:1388 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
%Program Files%\Windows Media Player\comine.exe (61 bytes)
The Dropped deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\~DFE673.tmp (0 bytes)
Registry activity
The process conime5266.exe:820 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D 4C BD A6 AE 2D 15 D6 7D 3A 46 47 2A 13 5E 5C"
The process comine.exe:1376 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"NetHood" = "%Documents and Settings%\%current user%\NetHood"
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCR\yali]
"ID" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCR\yali]
"mac" = "a6:5d:83:95:7b:3e"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"
[HKCR\yali]
"(Default)" = "daohang"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8F B7 81 87 69 E1 9B DD AE 57 37 A4 9F 79 F0 6D"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
The process ll5266.exe:664 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 E4 EA 5E AE A3 D7 54 4E CB 80 45 91 71 F1 6E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
The process %original file name%.exe:644 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 D7 29 63 CE B0 91 BA BB 2D 17 9C 13 39 F8 7E"
The process spolsv.exe:136 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 EE 7E 75 30 B4 88 C8 85 53 7E 2A B5 76 77 A5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"conime" = "%WinDir%\spolsv.exe"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Dropped deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process awx5266.exe:568 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F6 6B 1E CE 15 2C F2 81 39 64 97 7D B4 F5 C7 B0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Dropped deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process dh5266.exe:1360 makes changes in the system registry.
The Dropped deletes the following value(s) in system registry:
The Dropped disables automatic startup of the application by deleting the following autorun value:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows"
The process cccccc.exe:1388 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A DB 7C AC 8C 38 63 78 74 36 B3 77 29 B4 C2 9F"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Windows Media Player]
"comine.exe" = "comine"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows" = "%Program Files%\Windows Media Player\comine.exe"
The process ping.exe:2000 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 F3 06 69 F0 4E CE D6 C9 90 F3 CF E9 72 0E 87"
Dropped PE files
MD5 | File path |
---|---|
57a20c291ac47a75e0274d52a2aab36b | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\2TYR8BIN\conime5266[1].exe |
433a350a9c531e431fe5ffa91e3c0d3c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\2TYR8BIN\ll5266[1].exe |
e415565ea9d7f3936c07aee187396f26 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\8HQTA5YJ\awx5266[1].exe |
391545ec6af518ed54a155b5e544c8c8 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\8HQTA5YJ\dh5266[1].exe |
e6fdd746e4d611e4d41f8a1504577768 | c:\Program Files\Windows Media Player\comine.exe |
e415565ea9d7f3936c07aee187396f26 | c:\WINDOWS\Help\awx5266.exe |
57a20c291ac47a75e0274d52a2aab36b | c:\WINDOWS\Help\conime5266.exe |
391545ec6af518ed54a155b5e544c8c8 | c:\WINDOWS\Help\dh5266.exe |
433a350a9c531e431fe5ffa91e3c0d3c | c:\WINDOWS\Help\ll5266.exe |
HOSTS file anomalies
The Dropped modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 402 bytes in size. The following strings are added to the hosts file listed below:
127.0.0.1 | www.360.cn |
127.0.0.1 | www.kaspersky.com.cn |
127.0.0.1 | www.ijinshan.com |
127.0.0.1 | www.rising.com.cn |
127.0.0.1 | cn.trendmicro.com |
127.0.0.1 | www.symantec.com |
127.0.0.1 | sd.360.cn |
127.0.0.1 | www.eset.com.cn |
127.0.0.1 | www.avast.com |
127.0.0.1 | www.micropoint.com.cn |
127.0.0.1 | www.avira.com |
127.0.0.1 | www.avg.com |
127.0.0.1 | www.jiangmin.com |
127.0.0.1 | www.ggsafe.com |
127.0.0.1 | guanjia.qq.com |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
comine.exe:1376
ll5266.exe:664
%original file name%.exe:644
awx5266.exe:568
dh5266.exe:1360
cccccc.exe:1388
ping.exe:2000 - Delete the original Dropped file.
- Delete or disinfect the following files created/modified by the Dropped:
%WinDir%\spolsv.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2TYR8BIN\conime5266[1].exe (8084 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8HQTA5YJ\awx5266[1].exe (16073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2TYR8BIN\desktop.ini (67 bytes)
%WinDir%\Help\dh5266.exe (3343 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8HQTA5YJ\dh5266[1].exe (10369 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EFQX0RSV\desktop.ini (67 bytes)
%WinDir%\Help\ll5266.exe (24 bytes)
%WinDir%\Help\conime5266.exe (576 bytes)
%WinDir%\Help\awx5266.exe (10570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2TYR8BIN\ll5266[1].exe (2907 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8HQTA5YJ\desktop.ini (67 bytes)
%System%\drivers\etc\hosts (402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YJOFEZGX\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EFQX0RSV\iplookup[1].htm (203 bytes)
%Program Files%\Windows Media Player\comine.exe (61 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"conime" = "%WinDir%\spolsv.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows" = "%Program Files%\Windows Media Player\comine.exe" - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 40960 | 40960 | 4.53877 | dfde67b273e1bccb4b526d16e11a3e85 |
.rdata | 45056 | 5028 | 8192 | 2.43557 | ae167dac5cd7096a69a89a3fb1a988ed |
.data | 53248 | 49152 | 17084 | 0.643872 | 2ba1128c1f5b388fa05a0b3482c8f371 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://int.dpool.sina.com.cn/iplookup/iplookup.php?format=js&t=21484.08 | 180.149.136.250 |
hxxp://www.it885.com.cn/num3.html | 124.248.254.82 |
hxxp://www.it885.com.cn/num3_51la.asp | 124.248.254.82 |
hxxp://www.it885.com.cn/web/get_ad3.asp?type=loadall&machinename=XP10-A8A67A25&cr=yes | 124.248.254.82 |
dk.23145.com | 124.232.141.61 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /num3.html HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.it885.com.cn
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Mon, 15 Dec 2014 07:59:55 GMT
Accept-Ranges: bytes
ETag: "90466b1d3d18d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 07 Feb 2015 03:58:16 GMT
Content-Length: 37
<script src="num3_51la.asp"></script>....
GET /num3_51la.asp HTTP/1.1
Accept: */*
Referer: hXXp://VVV.it885.com.cn/num3.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.it885.com.cn
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 0
Content-Type: text/html
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDSCTDQARB=DFKOJJGCNGIMOHFLFHJGLOMH; path=/
X-Powered-By: ASP.NET
Date: Sat, 07 Feb 2015 03:58:16 GMT
HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 0..Content-Type: text/html..Server: Microsoft-IIS/7.5..Set-Cookie: ASPSESSIONIDSCTDQARB=DFKOJJGCNGIMOHFLFHJGLOMH; path=/..X-Powered-By: ASP.NET..Date: Sat, 07 Feb 2015 03:58:16 GMT..
GET /num3.html HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Mon, 15 Dec 2014 07:59:55 GMT
If-None-Match: "90466b1d3d18d01:0"
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.it885.com.cn
Connection: Keep-Alive
HTTP/1.1 304 Not Modified
Date: Sat, 07 Feb 2015 03:58:36 GMT
Etag: "90466b1d3d18d01:0"
....
GET /num3_51la.asp HTTP/1.1
Accept: */*
Referer: hXXp://VVV.it885.com.cn/num3.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.it885.com.cn
Connection: Keep-Alive
HTTP/1.1 304 Not Modified
Date: Sat, 07 Feb 2015 03:58:36 GMT
Etag: "90466b1d3d18d01:0"
HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 0..Content-Type: text/html..Server: Microsoft-IIS/7.5..Set-Cookie: ASPSESSIONIDSCTDQARB=PCMOJJGCBIILJNCFBCDFALCO; path=/..X-Powered-By: ASP.NET..Date: Sat, 07 Feb 2015 03:58:36 GMT..HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 0..Content-Type: text/html..Server: Microsoft-IIS/7.5..Set-Cookie: ASPSESSIONIDSCTDQARB=PCMOJJGCBIILJNCFBCDFALCO; path=/..X-Powered-By: ASP.NET..Date: Sat, 07 Feb 2015 03:58:36 GMT..
GET /iplookup/iplookup.php?format=js&t=21484.08 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: int.dpool.sina.com.cn
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 Feb 2015 03:58:24 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
DPOOL_HEADER: tyr100
Content-Encoding: gzip
SINA-LB:aGEuMTA4LmczLnlmLmxiLnNpbmFub2RlLmNvbQ==
SINA-TS:OTVmMjk2Y2UgMCAwIDAgNSAwCg==
a9............].M..0.....q#.h....]....8..m.&. .wo.t......`.C....z.=.......,O....%...T.9T...N....g..M...1...f..vs....>......._..&\b1.q..&r......K.#F&....0..x.....f.............0..
GET /web/get_ad3.asp?type=loadall&machinename=XP10-A8A67A25&cr=yes HTTP/1.1
Accept: */*
Referer:
Accept-Language: zh-cn
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50215)
Host: VVV.it885.com.cn
Connection: Keep-Alive
Cookie:
HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 8
Content-Type: text/html
Expires: Sat, 07 Feb 2015 03:57:35 GMT
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDSCTDQARB=LAMOJJGCMGJNMGMAPJEEFJOF; path=/
X-Powered-By: ASP.NET
Date: Sat, 07 Feb 2015 03:58:35 GMT
No ChinaHTTP/1.1 200 OK..Cache-Control: no-cache..Pragma: no-cache..Content-Length: 8..Content-Type: text/html..Expires: Sat, 07 Feb 2015 03:57:35 GMT..Server: Microsoft-IIS/7.5..Set-Cookie: ASPSESSIONIDSCTDQARB=LAMOJJGCMGJNMGMAPJEEFJOF; path=/..X-Powered-By: ASP.NET..Date: Sat, 07 Feb 2015 03:58:35 GMT..No China..
Map
The Dropped connects to the servers at the folowing location(s):
Strings from Dumps
spolsv.exe_136:
.text
.text
.rdata
.rdata
@.data
@.data
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
user32.dll
user32.dll
WinExec
WinExec
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegOpenKeyA
RegOpenKeyA
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
InternetOpenUrlA
InternetOpenUrlA
FindCloseUrlCache
FindCloseUrlCache
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
DeleteUrlCacheEntry
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
WININET.dll
WININET.dll
URLDownloadToFileA
URLDownloadToFileA
urlmon.dll
urlmon.dll
GetCPInfo
GetCPInfo
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
127.0.0.1 VVV.360.cn
127.0.0.1 VVV.360.cn
127.0.0.1 VVV.kaspersky.com.cn
127.0.0.1 VVV.kaspersky.com.cn
127.0.0.1 VVV.ijinshan.com
127.0.0.1 VVV.ijinshan.com
127.0.0.1 VVV.rising.com.cn
127.0.0.1 VVV.rising.com.cn
127.0.0.1 cn.trendmicro.com
127.0.0.1 cn.trendmicro.com
127.0.0.1 VVV.symantec.com
127.0.0.1 VVV.symantec.com
127.0.0.1 sd.360.cn
127.0.0.1 sd.360.cn
127.0.0.1 VVV.eset.com.cn
127.0.0.1 VVV.eset.com.cn
127.0.0.1 VVV.avast.com
127.0.0.1 VVV.avast.com
127.0.0.1 VVV.micropoint.com.cn
127.0.0.1 VVV.micropoint.com.cn
127.0.0.1 VVV.avira.com
127.0.0.1 VVV.avira.com
127.0.0.1 VVV.avg.com
127.0.0.1 VVV.avg.com
127.0.0.1 VVV.jiangmin.com
127.0.0.1 VVV.jiangmin.com
127.0.0.1 VVV.ggsafe.com
127.0.0.1 VVV.ggsafe.com
127.0.0.1 guanjia.qq.com
127.0.0.1 guanjia.qq.com
hXXp://192.253.233.21:8914/test/shua.txt
hXXp://192.253.233.21:8914/test/shua.txt
hXXp://192.253.233.21:8914/test/down.txt
hXXp://192.253.233.21:8914/test/down.txt
%Program Files%\Internet Explorer\iexplore.exe
%Program Files%\Internet Explorer\iexplore.exe
del "%s"
del "%s"
if exist "%s" goto nimei
if exist "%s" goto nimei
del_.bat
del_.bat
hXXp://
hXXp://
spolsv.exe
spolsv.exe
\spolsv.exe
\spolsv.exe
conime.exe
conime.exe
%WinDir%\spolsv.exe
%WinDir%\spolsv.exe
spolsv.exe_136_rwx_0040D000_00001000:
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
127.0.0.1 VVV.360.cn
127.0.0.1 VVV.360.cn
127.0.0.1 VVV.kaspersky.com.cn
127.0.0.1 VVV.kaspersky.com.cn
127.0.0.1 VVV.ijinshan.com
127.0.0.1 VVV.ijinshan.com
127.0.0.1 VVV.rising.com.cn
127.0.0.1 VVV.rising.com.cn
127.0.0.1 cn.trendmicro.com
127.0.0.1 cn.trendmicro.com
127.0.0.1 VVV.symantec.com
127.0.0.1 VVV.symantec.com
127.0.0.1 sd.360.cn
127.0.0.1 sd.360.cn
127.0.0.1 VVV.eset.com.cn
127.0.0.1 VVV.eset.com.cn
127.0.0.1 VVV.avast.com
127.0.0.1 VVV.avast.com
127.0.0.1 VVV.micropoint.com.cn
127.0.0.1 VVV.micropoint.com.cn
127.0.0.1 VVV.avira.com
127.0.0.1 VVV.avira.com
127.0.0.1 VVV.avg.com
127.0.0.1 VVV.avg.com
127.0.0.1 VVV.jiangmin.com
127.0.0.1 VVV.jiangmin.com
127.0.0.1 VVV.ggsafe.com
127.0.0.1 VVV.ggsafe.com
127.0.0.1 guanjia.qq.com
127.0.0.1 guanjia.qq.com
hXXp://192.253.233.21:8914/test/shua.txt
hXXp://192.253.233.21:8914/test/shua.txt
hXXp://192.253.233.21:8914/test/down.txt
hXXp://192.253.233.21:8914/test/down.txt
%Program Files%\Internet Explorer\iexplore.exe
%Program Files%\Internet Explorer\iexplore.exe
del "%s"
del "%s"
if exist "%s" goto nimei
if exist "%s" goto nimei
del_.bat
del_.bat
hXXp://
hXXp://
spolsv.exe
spolsv.exe
\spolsv.exe
\spolsv.exe
conime.exe
conime.exe
spolsv.exe_136_rwx_0040F000_0000A000:
%WinDir%\spolsv.exe
%WinDir%\spolsv.exe
conime5266.exe_820:
.text
.text
`.rdata
`.rdata
@.data
@.data
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
user32.dll
user32.dll
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
WS2_32.dll
WS2_32.dll
GetCPInfo
GetCPInfo
.rsrc
.rsrc
GET %s HTTP/1.1
GET %s HTTP/1.1
Referer: %s
Referer: %s
Accept-Language: %s
Accept-Language: %s
User-Agent: %s
User-Agent: %s
Host: %s
Host: %s
Cookie: %s
Cookie: %s
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50215)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50215)
hXXp://192.253.234.50/toopu.png
hXXp://192.253.234.50/toopu.png
Applications\iexplore.exe\shell\open\command
Applications\iexplore.exe\shell\open\command
%s "%s"
%s "%s"
hXXp://VVV.it885.com.cn/num3.html
hXXp://VVV.it885.com.cn/num3.html
%WinDir%\Help\conime5266.exe
%WinDir%\Help\conime5266.exe
comine.exe_1376:
.text
.text
`.data
`.data
.rsrc
.rsrc
MSVBVM60.DLL
MSVBVM60.DLL
vb6chs.dll
vb6chs.dll
d:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
d:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
psapi.dll
psapi.dll
kernel32.dll
kernel32.dll
NTDLL.DLL
NTDLL.DLL
shell32.dll
shell32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
VBA6.DLL
VBA6.DLL
1.vbp
1.vbp
hXXp://VVV.hao12338.com/?index
hXXp://VVV.hao12338.com/?index
IEXPLORE.EXE|TTRAVELER.EXE|SOGOUEXPLORER.EXE|360SE.EXE|GREENBROWSER.EXE|FIREFOX.EXE|MAXTHON.EXE|THEWORLD.EXE|OPERA.EXE|CHROME.EXE|SAFARI.EXE|NETSCAPE.EXE
IEXPLORE.EXE|TTRAVELER.EXE|SOGOUEXPLORER.EXE|360SE.EXE|GREENBROWSER.EXE|FIREFOX.EXE|MAXTHON.EXE|THEWORLD.EXE|OPERA.EXE|CHROME.EXE|SAFARI.EXE|NETSCAPE.EXE
%Program Files%\Windows Media Player
%Program Files%\Windows Media Player
%Program Files%
%Program Files%
explorer.exe
explorer.exe
WScript.Shell
WScript.Shell
Iexplore.exe
Iexplore.exe
wscript.shell
wscript.shell
cmd /c ping 127.0.0.1 -n 2&del
cmd /c ping 127.0.0.1 -n 2&del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows
%Program Files%\Windows Media Player\comine.exe
%Program Files%\Windows Media Player\comine.exe
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
%Program Files%\Internet Explorer\iexplore.exe
%Program Files%\Internet Explorer\iexplore.exe
WindowStyle
WindowStyle
Hotkey
Hotkey
serv.dat
serv.dat
ll5266.exe_664:
.text
.text
`.rdata
`.rdata
@.data
@.data
KERNEL32.dll
KERNEL32.dll
EnumWindows
EnumWindows
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
WS2_32.dll
WS2_32.dll
MSVCP60.dll
MSVCP60.dll
MSVCRT.dll
MSVCRT.dll
DeleteUrlCacheEntry
DeleteUrlCacheEntry
WININET.dll
WININET.dll
URLDownloadToFileA
URLDownloadToFileA
urlmon.dll
urlmon.dll
hXXp://623968.6600.org:99/3.htm
hXXp://623968.6600.org:99/3.htm
201411261939
201411261939
124.232.158.160
124.232.158.160
dk.23145.com
dk.23145.com
Applications\iexplore.exe\SHELL\OPEN\COMMAND
Applications\iexplore.exe\SHELL\OPEN\COMMAND
%s?%c%c%c%c%c
%s?%c%c%c%c%c
%s%c%c%c%c%c.htm
%s%c%c%c%c%c.htm
hXXp://VVV.ok1500.com/
hXXp://VVV.ok1500.com/
hXXp://VVV.fmk268.com/
hXXp://VVV.fmk268.com/
hXXp://VVV.021wb.com/
hXXp://VVV.021wb.com/
hXXp://115.231.231.61:155/
hXXp://115.231.231.61:155/
124.232.141.61
124.232.141.61
seo5266.exe_1180:
.text
.text
.data
.data
.rsrc
.rsrc
.aspack
.aspack
.adata
.adata
2014919
2014919
ieframe.dll
ieframe.dll
SHDocVwCtl.WebBrowser
SHDocVwCtl.WebBrowser
WebBrowser
WebBrowser
shell32.dll
shell32.dll
ShellExecuteA
ShellExecuteA
wininet.dll
wininet.dll
RegisterHotKey
RegisterHotKey
UnregisterHotKey
UnregisterHotKey
VBA6.DLL
VBA6.DLL
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
!Web1
!Web1
%System%\ieframe.oca
%System%\ieframe.oca
cmdStop
cmdStop
Webdata
Webdata
cmdMana
cmdMana
lblURL
lblURL
urlmon.dll
urlmon.dll
UrlMkSetSessionOption
UrlMkSetSessionOption
user32.dll
user32.dll
GetWindowsDirectoryA
GetWindowsDirectoryA
winmm.dll
winmm.dll
keybd_event
keybd_event
MapVirtualKeyA
MapVirtualKeyA
EnumWindows
EnumWindows
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
FindCloseUrlCache
DeleteUrlCacheEntryA
DeleteUrlCacheEntryA
advapi32.dll
advapi32.dll
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
advapi32.dll
advapi32.dll
RegDeleteKeyA
RegDeleteKeyA
vurl
vurl
MSVBVM60.DLL
MSVBVM60.DLL
kernel32.dll
kernel32.dll
The procedure entry point %s could not be located in the dynamic link library %s
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
msvbvm60.dll
msvbvm60.dll
@isual Studio\VB98\C2.EXE
@isual Studio\VB98\C2.EXE
@isual Studio\VB98\C2.EXE.Manif
@isual Studio\VB98\C2.EXE.Manif
@ual Studio\VB98\C2.EXE.Manifes
@ual Studio\VB98\C2.EXE.Manifes
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
wscript.shell
wscript.shell
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
hXXp://60.173.26.44:6666/Getnews.asp?t=
hXXp://60.173.26.44:6666/Getnews.asp?t=
hXXp://
hXXp://
window.alert=null;
window.alert=null;
window.confirm=null;
window.confirm=null;
window.showModalDialog=null;
window.showModalDialog=null;
window.open=null;
window.open=null;
hXXp://VVV.baidu.com/
hXXp://VVV.baidu.com/
hXXp://VVV.so.com/
hXXp://VVV.so.com/
http=
http=
Software\Microsoft\Windows\CurrentVersion\Internet Settings\
Software\Microsoft\Windows\CurrentVersion\Internet Settings\
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\
hXXp://VVV.51proxied.com/http_non_anonymous.html
hXXp://VVV.51proxied.com/http_non_anonymous.html
8.00.0002
8.00.0002
2014919.exe
2014919.exe
iexplore.exe_1820:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.fg>
IIIIIB(II<.fg>
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512