Skip to main content

Trojan.Win32.FlyStudio_07ddf208c8


Gen:Variant.Graftor.98820 (B) (Emsisoft), Gen:Variant.Graftor.98820 (AdAware), GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 07ddf208c880aceb3cea9c240e021f29

SHA1: d1d3fb9cf752f7470dc19c265b934573f347c147

SHA256: 201f3dca763d5a28e823ebae33e3d46477ba340ad6d90e6362c594aefc332248

SSDeep: 12288:Q6tmipTMyZnOanKLU20H9tNmHgnsxsbA935t2cthV116M9UNY3jh2:Q6MHDUr9tNmAs68tXX59N3j

Size: 687616 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6

Company: MyApps

Created at: 2014-04-12 15:30:35

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:3532

File activity

The process %original file name%.exe:3532 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\DLL.dll (320 bytes)

Registry activity

The process %original file name%.exe:3532 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 13 F7 BB 77 D1 77 BD CA 37 F9 89 C6 F4 D2 71"

[HKCU\Software\Super-EC\½ûÖ¹Öظ´ÔËÐÐ]
"(Default)" = "0"

Dropped PE files

MD5 File path
3f456fad5e06ca2c35ae7bcf3fb825adc:\DLL.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\DLL.dll (320 bytes)

  4. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.1
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.1
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: English (United States)

Company Name: Product Name: ?????Product Version: 1.0.0.1Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.1File Description: ?????Comments: ??????????(http://www.eyuyan.com)Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX0409657753600d41d8cd98f00b204e9800998ecf8427e
UPX15816326307846307845.45159b03687dad0c3247692a8b3f336b2dce3
.rsrc121241657344558084.89946c7aaaf3cedb7c9aff0f3d5e3e8a92ed5

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

Strings from Dumps