VBS/Joint-A

VBS/Joint-A is a malware infection written in Visual Basic. The latest variants of VBS/Joint-A were detected in summer of 2011. VBS/Joint-A is a dangerous malware infection that should be dealt with immediately. This kind of infection is usually severe and can have grave consequences on the infected computer system. VBS/Joint-A was first released in October of 2008 and, while Microsoft has released several updates in order to protect users from this infection, variants continue to appear in order to continue attacking computer systems from all around the world.

Symptoms and Malicious Actions of VBS/Joint-A

The main purpose of VBS/Joint-A is to spread from one computer to another. VBS/Joint-A does this by copying itself to any hard drives that VBS/Joint-A detects, any external memory devices and shared files on the infected computer's network. VBS/Joint-A will usually be associated with another malware infection (usually a backdoor Trojan) which takes advantage of VBS/Joint-A's capacity to spread from one computer to the next in order to deliver its harmful payload. One of the most dangerous aspects of VBS/Joint-A is that a computer system that is infected with this malware threat will often display no signs of a malware infection. Because of this, the first sign of an infection may be a warning from your anti-malware program. This makes maintaining your security software fully updated extremely important.

Elements of a VBS/Joint-A Worm Infection

VBS/Joint-A will usually involve four components with four different extensions: INF, BAT, REG, and VBS. Autorun.inf, which is the autorun configuration data file. This file is responsible for executing VBS/Joint-A automatically. This means that simply plugging in an infected external memory device is enough to infect an entire computer system. The file with the BAT extension is the batch script for this malware threat, and the file with the REG extension is the registry data import file. The worm itself is contained in the VBS extension file. The actual file names vary from one version of VBS/Joint-A to another. VBS/Joint-A makes changes to the Windows Registry so that VBS/Joint-A will run the batch script in the BAT file. This will prevent Windows from loading any security software and blocks certain types of files. VBS/Joint-A will always attempt to copy itself to all drives detected on the infected computer.

Analysis Report

General information

Family Name:	Worm.Brontok.A
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 9d3a34c3c292b93df25a539c010c65d0 SHA1: 8eb19eee7c8e32bcc37d81dc712fd7b32b7f3ebe SHA256: A97A426DF44FEECBFB26CF136ADD640D73351A9B1AFCE25D4308883AD9D4EE80 File Size: 277.47 KB, 277473 bytes

MD5: c2f434c4a983b127f0298d266ceca3b4 SHA1: 0f00e1ea0fdd93f4ff72a581e5399b5507bd17f4 SHA256: 175D4F30FEC550EA310D18866AE2585D5FA50C85D9BD4BCCC338994A9BF23C25 File Size: 8.65 MB, 8652322 bytes

MD5: a8d65e8f9c8f64cd2b24fcb257af2e13 SHA1: 95251b146bc384a1ee4639d083e9464008dbe50d SHA256: CD53C5283A9826010B7D05C1DCAC530CE0CCE5AFC22F971E3B648E80652544B0 File Size: 183.42 KB, 183416 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Microsoft
File Version	1.00
Internal Name	TJprojMain Win
Original Filename	TJprojMain.exe Win.exe
Product Name	Project1 Win
Product Version	1.00

File Traits

• HighEntropy
• No Version Info
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Agent.EDA
• Stealer.BBA
• Surldoe.A
• Trojan.Downloader.Gen.M
• Wapomi.F

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\program files (x86)\total video converter\asf.prx	Synchronize,Write Data
c:\program files (x86)\total video converter\atomicparsley.exe	Synchronize,Write Data
c:\program files (x86)\total video converter\audiorender.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\avisynth.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\avisynth_c.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\devil.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\directshowsource.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\dssource.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\dsvget.dll	Synchronize,Write Data

Show More

c:\program files (x86)\total video converter\dvdapi.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\dvdau.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\dvdplay.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\effectdraw.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\effectpicsource.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\flashplay.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\flashplayercontrol.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\hskin.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\i386op.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\is-01fu5.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-0agq1.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-0urtl.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-1um5e.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-4af9o.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-4rr64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-4rtab.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-4sbqc.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-66blv.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-7gtsf.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-7lfeh.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-7nbcd.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-912ht.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-91f99.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-9mdok.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-a0g9b.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-a28tu.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-a4ruq.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-bff1a.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-cr09h.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-e931u.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-ed00l.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-eq6km.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-eshap.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-flla0.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-hqda8.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-hs2qh.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-is9au.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-k6e34.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-lfbqq.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-lj4c0.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-lm6et.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-nl246.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-onrl2.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-p6q0l.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-pnipb.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-qt2ka.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-r1oj7.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-r6li4.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-spilk.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-ss03a.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-stgu5.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-t3ec4.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-ttdna.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-ugjke.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-un765.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-uq7n8.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-v6p2h.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-v8ku9.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\is-vnc2a.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\kdc.exe	Synchronize,Write Data
c:\program files (x86)\total video converter\lame_enc.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\lang_eng.txt	Synchronize,Write Data
c:\program files (x86)\total video converter\mediaburn.log	Synchronize,Write Data
c:\program files (x86)\total video converter\mediaburner.exe	Synchronize,Write Data
c:\program files (x86)\total video converter\optimizegif.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\pcmout.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\playback.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\pncrt.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\pndx5016.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\pndx5032.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\readme.txt	Synchronize,Write Data
c:\program files (x86)\total video converter\realmediasplitter.ax	Synchronize,Write Data
c:\program files (x86)\total video converter\regsvr32.exe	Synchronize,Write Data
c:\program files (x86)\total video converter\sdl.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\settings.ini	Synchronize,Write Data
c:\program files (x86)\total video converter\slideshowdll.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\starburn.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\starburn_supervideocd.iso	Synchronize,Write Data
c:\program files (x86)\total video converter\starburn_videocd.iso	Synchronize,Write Data
c:\program files (x86)\total video converter\subtitles.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\subtitles.ini	Synchronize,Write Data
c:\program files (x86)\total video converter\total flv sniffer.exe	Synchronize,Write Data
c:\program files (x86)\total video converter\tvc.chm	Synchronize,Write Data
c:\program files (x86)\total video converter\tvc.exe	Synchronize,Write Data
c:\program files (x86)\total video converter\tvc.ini	Synchronize,Write Data
c:\program files (x86)\total video converter\tvp.exe	Synchronize,Write Data
c:\program files (x86)\total video converter\tvpplaylist.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\tvpskin.dll	Synchronize,Write Data
c:\program files (x86)\total video converter\unins000.dat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\program files (x86)\total video converter\unins000.exe	Synchronize,Write Data
c:\users\user\appdata\local\temp\is-4t3si.tmp\is-sindf.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-v2gb5.tmp\_isetup\_regdll.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-v2gb5.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-v2gb5.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\__tmp_rar_sfx_access_check_7740281	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\fix.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\fix.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\registro.reg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\registro.reg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\setup.cmd	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\setup.cmd	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\setup.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\setup.exe	Synchronize,Write Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	㥘苫ⲉǝ	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Other Suspicious	SetWindowsHookEx
Keyboard Access	GetKeyState
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess ShellExecuteEx WriteConsole
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAddAtomEx ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcConnectPortEx ntdll.dll!NtAlpcQueryInformation ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtAssociateWaitCompletionPacket ntdll.dll!NtClearEvent ntdll.dll!NtClose Show More ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFindAtom ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenDirectoryObject ntdll.dll!NtOpenEvent ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenMutant ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadToken ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationKey ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetTimer2 ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForMultipleObjects ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Anti Debug	IsDebuggerPresent
User Data Access	GetComputerName GetUserName GetUserObjectInformation

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

(NULL) C:\Users\Olofbtpy\AppData\Local\Temp\RarSFX0\setup.cmd

WriteConsole:

WriteConsole: C:\Users\Olofbtp

WriteConsole: cmdow.exe

WriteConsole: @ /HID

Show More

WriteConsole: 'cmdow.exe' is n

WriteConsole: setup.exe

WriteConsole: /VERYSILENT

C:\Users\Olofbtpy\AppData\Local\Temp\RarSFX0\setup.exe setup.exe /VERYSILENT

"C:\Users\Olofbtpy\AppData\Local\Temp\is-4T3SI.tmp\is-SINDF.tmp" /SL4 $404E8 "C:\Users\Olofbtpy\AppData\Local\Temp\RarSFX0\setup.exe" 7356476 52224 /VERYSILENT