Gen.Variant.Strictor.48211_977421d378 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:340

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:340 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S3GBEVGJ\core[1].htm (457 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7EIOH7RW\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MA7TLD31\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S3GBEVGJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TB3FMPNX\regposont[1].htm (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TB3FMPNX\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7EIOH7RW\register[1].jpg (138 bytes)

Registry activity

The process %original file name%.exe:340 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.2345.com/?k158189458"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL bak" = "http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page bak" = "about:blank"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"HomePage" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 71 B3 20 48 43 69 AF DE C8 54 92 53 D5 7E DB"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.2345.com/?k158189458"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S3GBEVGJ\core[1].htm (457 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7EIOH7RW\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MA7TLD31\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S3GBEVGJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TB3FMPNX\regposont[1].htm (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TB3FMPNX\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7EIOH7RW\register[1].jpg (138 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: BY:?? Q158189458
Product Name: ????YY???
Product Version: 2.1.0.0
Legal Copyright: BY:?? Q158189458 ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.1.0.0
File Description: ????YY???
Comments: ????YY???
Language: Russian (Russia)

Company Name: BY:?? Q158189458Product Name: ????YY???Product Version: 2.1.0.0Legal Copyright: BY:?? Q158189458 ????Legal Trademarks: Original Filename: Internal Name: File Version: 2.1.0.0File Description: ????YY???Comments: ????YY???Language: Russian (Russia)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	638976	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	643072	516096	513024	5.47654	763f0c233900ef7fd112501d18880126
.rsrc	1159168	16384	12800	1.69798	82e5b54f2847aedb9b434ce368d9d5cd

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://udb.yy.com/regposont.do?act=regfrm&r=1414214835910	120.132.133.53
hxxp://udb.yy.com/register/core.do?regType=inner&appid=1&url=	120.132.133.53
hxxp://udb.duowan.com/verify/register.do?t=r	120.132.133.52
iframe.ip138.com	175.43.122.72

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /verify/register.do?t=r HTTP/1.1

Referer: hXXp://udb.duowan.com/verify/register.do?t=r

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

Cookie: UDBSESSIONID=19ce13db53bfa488644452979147756abb096a2b; _h=fa4a6c520a9130ac40cb955fadbaabcada4e0e4a; UDBRJESSESSIONID=aaa5ui5NnhEmva43BXfLu

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: udb.duowan.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 25 Oct 2014 05:27:09 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Sat, 25 Oct 2014 05:27:09 GMT

Cache-Control: max-age=0

Pragma: no-cache

a46........JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......F...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Z(..2.(...(...(...(...(...(...(...(...(...(...(...(...(...(.......T...$.kWX.-.Z.#={1.;...gJT.R\.&RQWe.......tm......b&...._....0>b@.p....\...W.#r.s.KYUQ\p.s...D.$.........MV.[.......J......4..4..gH.]$.p....J....9........|...t:..B.E...x[_.h"..u.(.....r.;.....N....i.k..O"Iaqf.....LLs...a....W.xo.V....Y<f.L....N.P}GJ.._...A......'.oKm.c.v.EEzN)...[.....O.:7.......f......`..g..&..WF...u/.~...{x....#..!.S..^s..S.....E....;F.O...V..N....u...(.)u=.i......#Q.f8.W&.>...k=..}JppL.*..5.x...7...t]6F.*..v.y...]...x_.zTV.j..t.4...._V......_.....l..>0..K5....!,..pM?[..iZ%..je.o.}..e.$.3..3..X.;.....1w...@...p0.o.k;...?......s.=.z...'.u.5I..k`......~....@-..8p...iCU.]|..R...5..._j..x...^n..$...?.......=..FIm......(.vV>s\.'g.....k.........d... ... .V.....p..,..<Q...Y.j6...t.WQ/...'.q.#.;...#~...Z.v3Y^...L.^6.G.=....q.......xO_..3......W4|...,;.O\.6.J.p.w_........wE.V...Q@.T.#..K..L.(/.2!.T.

<<< skipped >>>

GET /register/core.do?regType=inner&appid=1&url= HTTP/1.1

Referer: hXXp://udb.yy.com/register/core.do?regType=inner&appid=1&url=

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: udb.yy.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 25 Oct 2014 05:27:07 GMT

Content-Type: text/html; charset=UTF-8

Content-Length: 5462

Connection: keep-alive

Cache-Control: max-age=0

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Language: zh-CN

Set-Cookie: UDBSESSIONID=19ce13db53bfa488644452979147756abb096a2b; domain=udb.yy.com; path=/;HttpOnly

Set-Cookie: _h=fa4a6c520a9130ac40cb955fadbaabcada4e0e4a; domain=udb.yy.com; path=/

Set-Cookie: UDBRJESSESSIONID=aaa5ui5NnhEmva43BXfLu; path=/

Expires: Sat, 25 Oct 2014 05:27:07 GMT

..........<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">......<head>....<meta http-equiv="Content-Type" content="text/html;charset=utf-8" />....<meta name="keywords" content="" />....<meta name="description" content="" />........<title>.................. ...... ......</title>....<link href="hXXp://res.udb.duowan.com/css/core.css" rel="stylesheet" type="text/css" />..........<link href="hXXp://res.udb.duowan.com/udb/css/style-yy.130402.css" rel="stylesheet" type="text/css" />......<link href="hXXp://res.udb.duowan.com/css/regtips.css" rel="stylesheet" type="text/css" />.............<script type="text/javascript" src="hXXp://res.udb.duowan.com/js/ajax.js"></script>....<script type="text/javascript" src="hXXp://res.udb.duowan.com/js/jquery-1.4.2.min.js"></script>....<script type="text/javascript" src="hXXp://res.udb.duowan.com/js/message.js"></script>....<script type="text/javascript" src="hXXp://res.udb.duowan.com/js/constant.js"></script>..................<script type="text/javascript" src="hXXp://res.udb.duowan.com/js/regv2.min.js?140121"></script>................</head>...<body onload="RegisterV2.init();">...... .<img id="oko" src="" style="display:none;width:0px;height:0px" />.....<script type="text/javascript" charset="utf-8">.....document.ge

<<< skipped >>>

GET /regposont.do?act=regfrm&r=1414214835910 HTTP/1.1

Referer: hXXp://udb.yy.com/regposont.do?act=regfrm&r=1414214835910

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

Cookie: UDBSESSIONID=19ce13db53bfa488644452979147756abb096a2b;_h=fa4a6c520a9130ac40cb955fadbaabcada4e0e4a;UDBRJESSESSIONID=aaa5ui5NnhEmva43BXfLu

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: udb.yy.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 25 Oct 2014 05:27:08 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Sat, 25 Oct 2014 05:27:08 GMT

Cache-Control: max-age=0

e..Error,removed!..0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 25 Oct 2014 05:27:08 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Expires: Sat, 25 Oct 2014 05:27:08 GMT..Cache-Control: max-age=0..e..Error,removed!..0..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_340:

`.rsrc

t$(SSh

~%UVW

u$SShe

wininet.dll

kernel32.dll

FastVerCode.dll

ole32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

ReportError

hXXp://udb.yy.com/ajax.do?action=existUsername&username1=

hXXp://udb.yy.com/ajax.do?action=checkSecurityCode&ajax=true&securityCode1=

hXXp://udb.yy.com/ajaxreg.do?action=chklmt&uname=

hXXp://udb.duowan.com/regin/

&password=

url=&appid=1&regType=inner&_vs=

Content-Type: application/x-www-form-urlencoded

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

https

HTTP/1.1

hXXps://

hXXp://

udb.yy.com

udb.duowan.com

hXXp://udb.yy.com/register/core.do?regType=inner&appid=1&url=

var passwordBackup = document.getElementById("passwordBackup").value;

if (passwordBackup != "") {

this.getForm()["password"].value = passwordBackup;

document.getElementById("password2").value = passwordBackup

document.getElementById("submitButton").disabled = true;

var flag = this.doSubmit1();

var password = this.getForm()["password"].value;

document.getElementById("passwordBackup").value = password;

document.getElementById("submitButton").disabled = false;

var form = this.getForm();

flag = RegisterV2.check.username();

flag = RegisterV2.check.password();

RegisterV2.check.alertMsg();

flag = RegisterV2.check.password2();

var securityCode1 = form["securityCode1"].value;

Message.error("item_securityCode", "

if (securityCode1.length

Message.empty("item_securityCode", "")

var agreement = document.getElementById("agreement");

if (agreement && !agreement.checked) {

agreement.focus();

this.submitCheckUsername()

var username = form["username"].value;

Message.error("item_username", "

RegisterV2.setMessage("username", "

RegisterV2.hideRecommend();

var url = "/ajax.do?action=existUsername&username1=" Constant.encode(username);

RegisterV2.existUsername.username = username;

Ajax.get(url,

var body = obj.responseText;

RegisterV2.submitCheckSecurityCode();

if ("keyword" == body) {

var msg = "

Message.error("item_username", msg);

RegisterV2.setMessage("username", msg);

[" RegisterV2.existUsername.username "]

Message.error("item_username", body);

RegisterV2.setMessage("username", body)

var securityCode1 = form["securityCode1"].value;

Message.error("item_securityCode", "

var url = "/ajax.do?action=checkSecurityCode&ajax=true&securityCode1=" Constant.encode(securityCode1) "&time=" (new Date().getTime());

RegisterV2.formSubmit();

RegisterV2.changeSecurityCode();

RegisterV2.setMessage("securityCode1", "

Message.error("item_securityCode", body);

RegisterV2.setMessage("securityCode1", body)

var form = RegisterV2.getForm();

var rdmCode = form["rcall"].value;

var p = RegisterV2.check.computechildpath(deRdmCode);

form.action = "hXXps://" window.location.hostname "/regin/" p ".do";

$.post("/regposont.do", {

"act": "webregbegin",

"r": Math.random()

form.submit()

var flag = this.doSubmitMobile2();

flag = RegisterV2.check.mobile();

this.submitCheckMobile()

var mobile = form["mobile"].value;

Message.error("item_mobile", "

RegisterV2.setMessage("mobile", "

var url = "/ajax.do?action=existMobile&mobile=" Constant.encode(mobile);

Message.error("item_mobile", msg);

RegisterV2.setMessage("mobile", msg);

[

Message.error("item_mobile", body);

RegisterV2.setMessage("mobile", body)

form[id].msg = message

return form[id].msg

var form = document.forms["frmpost"];

form[name].focus()

var url = "/ajax.do?action=recommend&username=" Constant.encode(username);

if (body == null || body.length == 0) return;

var ir = document.getElementById("item_recommend");

ir.style.display = "block";

var mr = document.getElementById("msg_recommend");

var users = body.split(";");

len = users.length; i

html = '' (i 1) '.' users[i] '';

mr.innerHTML = html

var ir = document.getElementById("item_recommend");

if (ir) ir.style.display = "none";

var mr = document.getElementById("msg_recommend");

if (mr) mr.innerHTML = ""

form["username"].value = span.innerHTML;

RegisterV2.existUsername()

c.style.cursor = "pointer";

c.style.color = "#ff6600"

c.style.cursor = "auto";

c.style.color = "#1797B3"

Message.success("item_username", "

RegisterV2.setMessage("username", "");

RegisterV2.hideRecommend();

RegisterV2.recommendUsername(username)

RegisterV2.setMessage("username", body);

Message.success("item_mobile", "

RegisterV2.setMessage("mobile", "");

RegisterV2.setMessage("mobile", body);

Message.success("item_securityCode", "");

RegisterV2.setMessage("securityCode1", "");

RegisterV2.setMessage("securityCode1", body);

var imgSecurityCode = document.getElementById("imgSecurityCode");

imgSecurityCode.src = "/verify/register.do?t=r&r=" today.getTime()

"sendStatistics": function(url) {

img.width = 0;

img.height = 0;

img.src = url

RegisterV2.keyup = {

var username = RegisterV2.getForm()["username"];

if (username.value == "") {

Message.empty("item_username", "");

if (username.isInited != "true") {

if (username.value.length

username.isInited = "true"

return RegisterV2.check.username()

var mobile = RegisterV2.getForm()["mobile"];

if (mobile.value == "") {

Message.empty("item_mobile", "");

if (mobile.isInited != "true") {

if (mobile.value.length

mobile.isInited = "true"

return RegisterV2.check.mobile()

"password": function() {

var password = form["password"];

if (password.value == "") {

Message.empty("item_password", "");

if (password.isInited != "true") {

if (password.value.length

password.isInited = "true"

return RegisterV2.check.password()

"password2": function() {

Message.empty("item_password2", "");

var password2 = document.getElementById("password2");

if (password2.isInited != "true") {

if (password2.value.length

password2.isInited = "true"

return RegisterV2.check.password2()

return RegisterV2.check.securityCode()

RegisterV2.check = {

var message = Constant.isLetterUsername(username.value);

Message.error("item_username", message);

var message = Constant.isValidMobile(mobile.value);

Message.error("item_mobile", message);

Message.success("item_mobile", "")

"isValidPassword": function(password, username) {

var message = Constant.isValidNewPassword(password, username);

if (password.length

if (password.length > 20) {

Message.error("item_password", "

var message = this.isValidPassword(password.value, username.value);

Message.error("item_password", message);

message = Constant.isSafetyPassword(password.value);

Message.notice("item_password", message "

Message.error("item_password2", "

if (password.value != password2.value) {

Message.success("item_password2", "")

if (securityCode1.length

Message.success("item_securityCode", "");

RegisterV2.checkSecurityCode();

"alertMsg": function() {

if (password.value.length == 0) {

password.nofocus = true;

password.focus();

if (password.value.length

if (password.value.length > 20) {

var base = code.charAt(0).charCodeAt();

return code.substring(start, start len)

RegisterV2.blur = {

var flag = RegisterV2.check.username();

RegisterV2.existUsername()

var flag = RegisterV2.check.mobile();

RegisterV2.existMobile()

RegisterV2.check.password();

var isError = Message.isError("item_password");

Message.empty("item_password", "")

RegisterV2.check.password2();

var isError = Message.isError("item_password2");

Message.empty("item_password2", "")

RegisterV2.focus = {

Message.notice("item_username", "4-16

Message.notice("item_password", "

RegisterV2.check.password()

if (password2.value == "") {

Message.notice("item_password2", "

RegisterV2.check.password2()

a[d] = Str4ToLong(c.slice(d * 4, (d 1) * 4))

for (d = 0; d

b[0] = Str4ToLong(f.slice(d, d 4));

b[1] = Str4ToLong(f.slice(d 4, d 8));

e = e.replace(/\0 $/, "");

a |= c.charCodeAt(b)

var b = String.fromCharCode(a & 255, a >> 8 & 255, a >> 16 & 255, a >> 24 & 255);

return a.replace(/!\d\d?\d?!/g,

return String.fromCharCode(b.slice(1, -1))

for (var i = 0; i

if (base64Count >= base64Str.length) {

var a = base64Str.charAt(base64Count);

a = a.toString(16);

if (a.length == 1) {

openLogin: function(redirect) {

if (Login.hasSecurityCode()) {

var obj = document.getElementById("item_securityCode");

obj.style.display = "block";

Login.showSecurityCode()

if (UdbCookie.isLogined()) {

window.location.href = redirect

$("#loginError").text("");

$("#password").val("");

$("#loginbox").fadeIn();

$("#shroud").show();

$("#loginRedirect").val(redirect);

Constant.center("loginbox");

$("#loginbox").bind('keyup',

if (event.keyCode == 13) {

ValidateAccount.login()

closeLogin: function() {

$("#loginbox").fadeOut(300);

$("#shroud").hide()

login: function() {

var username = $("#username").val();

var password = $("#password").val();

var securityCode = $("#securityCode").val();

var redirect = $("#loginRedirect").val();

var loginError = document.getElementById("loginError");

loginError.style.display = "none";

if (username.trim() == "") {

loginError.style.display = "";

loginError.innerHTML = "

if (password.trim() == "") {

if (obj != null && obj.style.display != "none") {

var securityCode = $("#securityCode").val();

if (securityCode.trim() == "") {

loginError.style.display = "";

loginError.innerHTML = "

p.add('username', username);

p.add('password', password);

p.add('securityCode', securityCode);

p.add('redirect', redirect);

var param = p.toString();

Ajax.post("/account_login.do?ajax=true&json=true", param,

if (obj && obj.responseText) {

var msg = obj.responseText;

loginError.style.display = "";

document.getElementById("loginError").innerHTML = msg;

ValidateAccount.loginResponse(msg)

window.location.href = redirect

"loginResponse": function(msg) {

var p = RegisterV2.check.computechildpath(deRdmCode);

==

hXXp://udb.yy.com/regposont.do?act=regfrm&r=

hXXp://iframe.ip138.com/ic.asp

hXXp://udb.duowan.com/verify/register.do?t=r

158189458

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies

\ADSL.ini

scripting.FileSystemObject

\*.txt

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

hXXp://VVV.2345.com/?k158189458

BF95.NET

[VVV.bf95.net] |

[140885636] |

158189458 |

Software\Microsoft\Internet Explorer\Main\Default_Page_URL bak

Software\Microsoft\Internet Explorer\Main\Default_Page_URL

hXXp://ip.qq.com/

WinHttp.WinHttpRequest.5.1

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

hXXp://VVV.jsdati.com/index.php/do/register

VBScript.RegExp

return(Math.random());

return(date.getTime());

$@wininet.dll

hXXp://158189458.7958.com/down_10671972.html

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

user32.dll

iphlpapi.dll

SHLWAPI.dll

MPR.dll

VERSION.dll

WSOCK32.dll

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

VVV.dywt.com.cn

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÃ

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

GetCPInfo

WinExec

GetProcessHeap

RegCreateKeyExA

RegCloseKey

RegOpenKeyExA

RegCreateKeyA

GetViewportExtEx

ScaleViewportExtEx

SetViewportExtEx

OffsetViewportOrgEx

SetViewportOrgEx

GetViewportOrgEx

ShellExecuteA

GetKeyState

SetWindowsHookExA

CreateDialogIndirectParamA

UnhookWindowsHookEx

.text

.rdata

@.data

PAD

ADVAPI32.dll

comdlg32.dll

OLEAUT32.dll

RASAPI32.dll

SHELL32.dll

WININET.dll

WINMM.dll

WINSPOOL.DRV

WS2_32.dll

1, 0, 6, 6

- Skin.dll

(*.*)

2.1.0.0

%original file name%.exe_340_rwx_00401000_00119000:

t$(SSh

~%UVW

u$SShe

wininet.dll

kernel32.dll

FastVerCode.dll

ole32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

ReportError

hXXp://udb.yy.com/ajax.do?action=existUsername&username1=

hXXp://udb.yy.com/ajax.do?action=checkSecurityCode&ajax=true&securityCode1=

hXXp://udb.yy.com/ajaxreg.do?action=chklmt&uname=

hXXp://udb.duowan.com/regin/

&password=

url=&appid=1&regType=inner&_vs=

Content-Type: application/x-www-form-urlencoded

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

https

HTTP/1.1

hXXps://

hXXp://

udb.yy.com

udb.duowan.com

hXXp://udb.yy.com/register/core.do?regType=inner&appid=1&url=

var passwordBackup = document.getElementById("passwordBackup").value;

if (passwordBackup != "") {

this.getForm()["password"].value = passwordBackup;

document.getElementById("password2").value = passwordBackup

document.getElementById("submitButton").disabled = true;

var flag = this.doSubmit1();

var password = this.getForm()["password"].value;

document.getElementById("passwordBackup").value = password;

document.getElementById("submitButton").disabled = false;

var form = this.getForm();

flag = RegisterV2.check.username();

flag = RegisterV2.check.password();

RegisterV2.check.alertMsg();

flag = RegisterV2.check.password2();

var securityCode1 = form["securityCode1"].value;

Message.error("item_securityCode", "

if (securityCode1.length

Message.empty("item_securityCode", "")

var agreement = document.getElementById("agreement");

if (agreement && !agreement.checked) {

agreement.focus();

this.submitCheckUsername()

var username = form["username"].value;

Message.error("item_username", "

RegisterV2.setMessage("username", "

RegisterV2.hideRecommend();

var url = "/ajax.do?action=existUsername&username1=" Constant.encode(username);

RegisterV2.existUsername.username = username;

Ajax.get(url,

var body = obj.responseText;

RegisterV2.submitCheckSecurityCode();

if ("keyword" == body) {

var msg = "

Message.error("item_username", msg);

RegisterV2.setMessage("username", msg);

[" RegisterV2.existUsername.username "]

Message.error("item_username", body);

RegisterV2.setMessage("username", body)

var securityCode1 = form["securityCode1"].value;

Message.error("item_securityCode", "

var url = "/ajax.do?action=checkSecurityCode&ajax=true&securityCode1=" Constant.encode(securityCode1) "&time=" (new Date().getTime());

RegisterV2.formSubmit();

RegisterV2.changeSecurityCode();

RegisterV2.setMessage("securityCode1", "

Message.error("item_securityCode", body);

RegisterV2.setMessage("securityCode1", body)

var form = RegisterV2.getForm();

var rdmCode = form["rcall"].value;

var p = RegisterV2.check.computechildpath(deRdmCode);

form.action = "hXXps://" window.location.hostname "/regin/" p ".do";

$.post("/regposont.do", {

"act": "webregbegin",

"r": Math.random()

form.submit()

var flag = this.doSubmitMobile2();

flag = RegisterV2.check.mobile();

this.submitCheckMobile()

var mobile = form["mobile"].value;

Message.error("item_mobile", "

RegisterV2.setMessage("mobile", "

var url = "/ajax.do?action=existMobile&mobile=" Constant.encode(mobile);

Message.error("item_mobile", msg);

RegisterV2.setMessage("mobile", msg);

[

Message.error("item_mobile", body);

RegisterV2.setMessage("mobile", body)

form[id].msg = message

return form[id].msg

var form = document.forms["frmpost"];

form[name].focus()

var url = "/ajax.do?action=recommend&username=" Constant.encode(username);

if (body == null || body.length == 0) return;

var ir = document.getElementById("item_recommend");

ir.style.display = "block";

var mr = document.getElementById("msg_recommend");

var users = body.split(";");

len = users.length; i

html = '' (i 1) '.' users[i] '';

mr.innerHTML = html

var ir = document.getElementById("item_recommend");

if (ir) ir.style.display = "none";

var mr = document.getElementById("msg_recommend");

if (mr) mr.innerHTML = ""

form["username"].value = span.innerHTML;

RegisterV2.existUsername()

c.style.cursor = "pointer";

c.style.color = "#ff6600"

c.style.cursor = "auto";

c.style.color = "#1797B3"

Message.success("item_username", "

RegisterV2.setMessage("username", "");

RegisterV2.hideRecommend();

RegisterV2.recommendUsername(username)

RegisterV2.setMessage("username", body);

Message.success("item_mobile", "

RegisterV2.setMessage("mobile", "");

RegisterV2.setMessage("mobile", body);

Message.success("item_securityCode", "");

RegisterV2.setMessage("securityCode1", "");

RegisterV2.setMessage("securityCode1", body);

var imgSecurityCode = document.getElementById("imgSecurityCode");

imgSecurityCode.src = "/verify/register.do?t=r&r=" today.getTime()

"sendStatistics": function(url) {

img.width = 0;

img.height = 0;

img.src = url

RegisterV2.keyup = {

var username = RegisterV2.getForm()["username"];

if (username.value == "") {

Message.empty("item_username", "");

if (username.isInited != "true") {

if (username.value.length

username.isInited = "true"

return RegisterV2.check.username()

var mobile = RegisterV2.getForm()["mobile"];

if (mobile.value == "") {

Message.empty("item_mobile", "");

if (mobile.isInited != "true") {

if (mobile.value.length

mobile.isInited = "true"

return RegisterV2.check.mobile()

"password": function() {

var password = form["password"];

if (password.value == "") {

Message.empty("item_password", "");

if (password.isInited != "true") {

if (password.value.length

password.isInited = "true"

return RegisterV2.check.password()

"password2": function() {

Message.empty("item_password2", "");

var password2 = document.getElementById("password2");

if (password2.isInited != "true") {

if (password2.value.length

password2.isInited = "true"

return RegisterV2.check.password2()

return RegisterV2.check.securityCode()

RegisterV2.check = {

var message = Constant.isLetterUsername(username.value);

Message.error("item_username", message);

var message = Constant.isValidMobile(mobile.value);

Message.error("item_mobile", message);

Message.success("item_mobile", "")

"isValidPassword": function(password, username) {

var message = Constant.isValidNewPassword(password, username);

if (password.length

if (password.length > 20) {

Message.error("item_password", "

var message = this.isValidPassword(password.value, username.value);

Message.error("item_password", message);

message = Constant.isSafetyPassword(password.value);

Message.notice("item_password", message "

Message.error("item_password2", "

if (password.value != password2.value) {

Message.success("item_password2", "")

if (securityCode1.length

Message.success("item_securityCode", "");

RegisterV2.checkSecurityCode();

"alertMsg": function() {

if (password.value.length == 0) {

password.nofocus = true;

password.focus();

if (password.value.length

if (password.value.length > 20) {

var base = code.charAt(0).charCodeAt();

return code.substring(start, start len)

RegisterV2.blur = {

var flag = RegisterV2.check.username();

RegisterV2.existUsername()

var flag = RegisterV2.check.mobile();

RegisterV2.existMobile()

RegisterV2.check.password();

var isError = Message.isError("item_password");

Message.empty("item_password", "")

RegisterV2.check.password2();

var isError = Message.isError("item_password2");

Message.empty("item_password2", "")

RegisterV2.focus = {

Message.notice("item_username", "4-16

Message.notice("item_password", "

RegisterV2.check.password()

if (password2.value == "") {

Message.notice("item_password2", "

RegisterV2.check.password2()

a[d] = Str4ToLong(c.slice(d * 4, (d 1) * 4))

for (d = 0; d

b[0] = Str4ToLong(f.slice(d, d 4));

b[1] = Str4ToLong(f.slice(d 4, d 8));

e = e.replace(/\0 $/, "");

a |= c.charCodeAt(b)

var b = String.fromCharCode(a & 255, a >> 8 & 255, a >> 16 & 255, a >> 24 & 255);

return a.replace(/!\d\d?\d?!/g,

return String.fromCharCode(b.slice(1, -1))

for (var i = 0; i

if (base64Count >= base64Str.length) {

var a = base64Str.charAt(base64Count);

a = a.toString(16);

if (a.length == 1) {

openLogin: function(redirect) {

if (Login.hasSecurityCode()) {

var obj = document.getElementById("item_securityCode");

obj.style.display = "block";

Login.showSecurityCode()

if (UdbCookie.isLogined()) {

window.location.href = redirect

$("#loginError").text("");

$("#password").val("");

$("#loginbox").fadeIn();

$("#shroud").show();

$("#loginRedirect").val(redirect);

Constant.center("loginbox");

$("#loginbox").bind('keyup',

if (event.keyCode == 13) {

ValidateAccount.login()

closeLogin: function() {

$("#loginbox").fadeOut(300);

$("#shroud").hide()

login: function() {

var username = $("#username").val();

var password = $("#password").val();

var securityCode = $("#securityCode").val();

var redirect = $("#loginRedirect").val();

var loginError = document.getElementById("loginError");

loginError.style.display = "none";

if (username.trim() == "") {

loginError.style.display = "";

loginError.innerHTML = "

if (password.trim() == "") {

if (obj != null && obj.style.display != "none") {

var securityCode = $("#securityCode").val();

if (securityCode.trim() == "") {

loginError.style.display = "";

loginError.innerHTML = "

p.add('username', username);

p.add('password', password);

p.add('securityCode', securityCode);

p.add('redirect', redirect);

var param = p.toString();

Ajax.post("/account_login.do?ajax=true&json=true", param,

if (obj && obj.responseText) {

var msg = obj.responseText;

loginError.style.display = "";

document.getElementById("loginError").innerHTML = msg;

ValidateAccount.loginResponse(msg)

window.location.href = redirect

"loginResponse": function(msg) {

var p = RegisterV2.check.computechildpath(deRdmCode);

==

hXXp://udb.yy.com/regposont.do?act=regfrm&r=

hXXp://iframe.ip138.com/ic.asp

hXXp://udb.duowan.com/verify/register.do?t=r

158189458

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies

\ADSL.ini

scripting.FileSystemObject

\*.txt

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

hXXp://VVV.2345.com/?k158189458

BF95.NET

[VVV.bf95.net] |

[140885636] |

158189458 |

Software\Microsoft\Internet Explorer\Main\Default_Page_URL bak

Software\Microsoft\Internet Explorer\Main\Default_Page_URL

hXXp://ip.qq.com/

WinHttp.WinHttpRequest.5.1

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 2Pac; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

hXXp://VVV.jsdati.com/index.php/do/register

VBScript.RegExp

return(Math.random());

return(date.getTime());

$@wininet.dll

hXXp://158189458.7958.com/down_10671972.html

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

user32.dll

iphlpapi.dll

SHLWAPI.dll

MPR.dll

VERSION.dll

WSOCK32.dll

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

VVV.dywt.com.cn

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

zcÃ

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

GetCPInfo

WinExec

GetProcessHeap

RegCreateKeyExA

RegCloseKey

RegOpenKeyExA

RegCreateKeyA

GetViewportExtEx

ScaleViewportExtEx

SetViewportExtEx

OffsetViewportOrgEx

SetViewportOrgEx

GetViewportOrgEx

ShellExecuteA

GetKeyState

SetWindowsHookExA

CreateDialogIndirectParamA

UnhookWindowsHookEx

.text

.rdata

@.data

1, 0, 6, 6

- Skin.dll

(*.*)

%original file name%.exe_340_rwx_10000000_0003E000:

`.rsrc

L$(h%f

SSh0j

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ã

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1, 0, 6, 6

- Skin.dll

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps