Trojan.Win32.Zzinfor.bww (v) (VIPRE), DeepScan:Generic.Lineage.BEDD0A3E (B) (Emsisoft), DeepScan:Generic.Lineage.BEDD0A3E (AdAware)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 0cb11626b0d05386286f1967a9ee4e96
SHA1: 166bd8fa176527db7eec6a1fde7201b3d2c1f19f
SHA256: 32d19c930088bf5e744f14afe05cd2ce8028eaa05c25d331b72c019d73d0b4d2
SSDeep: 3072:2QZ/bsQ2KAZ9ETPGzFLrg1IJiFHD7FKsL 9/QYzWd4cQhiIjcirlK6Zbl8Tzds13:FAQ2AyBg1 iFHXnLE5cYiI4ggil8ctgP
Size: 184320 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-01-09 16:08:50
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The DeepScan creates the following process(es):No processes have been created.The DeepScan injects its code into the following process(es):
%original file name%.exe:512
File activity
The process %original file name%.exe:512 makes changes in the file system.
The DeepScan creates and/or writes to the following file(s):
%Program Files%\Common Files\Reexngtu.exe (266425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
Registry activity
The process %original file name%.exe:512 makes changes in the system registry.
The DeepScan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 2B D9 C6 78 F1 76 F1 A8 7E 8C 00 AE 7A B2 66"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65324"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65324"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65324"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65324"
Network activity (URLs)
| URL | IP |
|---|---|
| hxxp://1st.ecoma.glb0.lxdns.com/client/config.ini | |
| tt.woai310.com | 218.92.221.157 |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original DeepScan file.
- Delete or disinfect the following files created/modified by the DeepScan:
%Program Files%\Common Files\Reexngtu.exe (266425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 135168 | 69632 | 5.42529 | d87f2c690b3c29ca1904ee75855544ca |
| .rdata | 139264 | 16384 | 4096 | 5.2764 | 5232a78f46882de562121c2fe22aaddd |
| .data | 155648 | 282624 | 102400 | 5.47105 | 6e43654c46b07c130ded1705ba5e593b |
| .text | 438272 | 4096 | 4096 | 4.1468 | 7e6b3b6ee56f425b394d630d0f582416 |
Network Activity
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker: