Trojan.NSIS.StartPage_7c24a1ae2b – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

APNStub.exe:1360
%original file name%.exe:224

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process APNStub.exe:1360 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F (571 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6 (153 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F (176 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6 (224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5 (164 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5 (933 bytes)

The process %original file name%.exe:224 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\ApnToolbarInstaller.exe (51118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\UAC.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\pantallatoolbar (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\ioSpecial.ini (6921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\ApnIC.dll (3624 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\LangDLL.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\captura.bmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\modern-wizard.bmp (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\ApnStub.exe (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\InstallOptions.dll (14 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsq1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp (0 bytes)

Registry activity

The process APNStub.exe:1360 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Ask.com.tmp\General]
"eichk" = "http://img.apnanalytics.com/images/nocache/apn/tr.gif?ev=eichk&p2=^M3^YYYYYY^YY^UA&encb={incbid}&chk={ic_chk}&ts={random}&guid={guid}&dt={dt}&wft={wft}&inst={inst}&tb={tb}&hos={hos}&harch={harch}&hloc={hloc}&iv={iv}&fv={fv}&dbr={dbr}&vb={vb}&msi={msi}&dot={dot}"
"inst" = "200"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Ask.com.tmp\General]
"slwo" = "0"
"Guid" = "a7a13dfa-094d-4ed7-8f59-312d514e4183"
"cr" = "0"
"iedis" = "0"
"homepageurl" = "http://www.search.ask.com/?l=dis&o=13876"
"cbid" = "^M3"
"hloc" = "en-US"

"dtid" = "^YYYYYY^YY^UA"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Ask.com.tmp\General]
"dbr" = "132"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Ask.com.tmp\Installer]
"homepageurl" = "http://www.search.ask.com/?l=dis&o=13876"
"eichk" = "http://img.apnanalytics.com/images/nocache/apn/tr.gif?ev=eichk&p2=^M3^YYYYYY^YY^UA&encb={incbid}&chk={ic_chk}&ts={random}&guid={guid}&dt={dt}&wft={wft}&inst={inst}&tb={tb}&hos={hos}&harch={harch}&hloc={hloc}&iv={iv}&fv={fv}&dbr={dbr}&vb={vb}&msi={msi}&dot={dot}"

[HKCU\Software\Ask.com.tmp\General]
"qsrc" = "2871"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Ask.com.tmp\Installer]
"Guid" = "a7a13dfa-094d-4ed7-8f59-312d514e4183"
"oi" = "nop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Ask.com.tmp\General]
"dt" = "9500"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Ask.com.tmp\Installer]
"nthp" = "0"

[HKCU\Software\Ask.com.tmp\General]
"o" = "13874"
"l" = "dis"
"crif" = "1"
"apn_dbr" = "ie_6.0.2900.5512"

[HKCU\Software\Ask.com.tmp\Installer]
"crif" = "1"

[HKCU\Software\Ask.com.tmp\General]
"client" = "ic"
"hos" = "5.1.1.sp3.x86"
"Locale" = "en_US"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F CE 87 E8 06 3E 41 23 93 DD B2 B1 81 9B 38 A0"

[HKCU\Software\Ask.com.tmp\Installer]
"repurl" = "http://img.apnanalytics.com/images/nocache/apn/tr.gif?ev=eichk&p2=^M3^YYYYYY^YY^UA&encb={incbid}&chk={ic_chk}&ts={random}&guid="

[HKCU\Software\Ask.com.tmp\General]
"tb-version" = "5.12.2.0"
"nthp" = "0"

[HKCU\Software\Ask.com.tmp\Macro]
"slwo" = "0"

[HKCU\Software\Ask.com.tmp\General]
"dot" = "6"

[HKCU\Software\Ask.com.tmp\Installer]
"ff-max-version" = "13.*"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Ask.com.tmp\General]
"location" = "Kharkiv,Ukraine"
"tb-installer-path" = "http://apnmedia.ask.com/media/toolbar/supertoolbar/profile-ask/EverestWrapper.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Ask.com.tmp\General]
"make-offer" = "1"
"repurl" = "http://img.apnanalytics.com/images/nocache/apn/tr.gif?ev=eichk&p2=^M3^YYYYYY^YY^UA&encb={incbid}&chk={ic_chk}&ts={random}&guid="

[HKCU\Software\Ask.com.tmp\Macro]
"dtid" = "^YYYYYY^YY^UA"

[HKCU\Software\Ask.com.tmp\General]
"ff-max-version" = "13.*"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Ask.com.tmp\General]
"wft" = "remote"
"harch" = "32"

[HKCU\Software\Ask.com.tmp\Macro]
"cbid" = "^M3"

[HKCU\Software\Ask.com.tmp\General]
"to" = ""
"ewrap" = "http://img.apnanalytics.com/images/nocache/apn/tr.gif?ev=ewrap&p2=^M3^YYYYYY^YY^UA&stb={wr_tbr}&ssa={wr_sa}&shpr={wr_hpr}&param={param}&ts={random}&guid={guid}&dt={dt}&inst={inst}&tb={tb}&hos={hos}&harch={harch}&hloc={hloc}&iv={iv}&fv={fv}&dbr={dbr}&vb={vb}&msi={msi}&wft={wft}&dot={dot}&erd={erd}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Ask.com.tmp\Macro]
"location" = "Kharkiv,Ukraine"

[HKCU\Software\Ask.com.tmp\General]
"oi" = "nop"
"tb" = "MP3"
"clientv" = "9.9.9.9"

[HKCU\Software\Ask.com.tmp\Macro]
"crumb" = "2016.08.16 19.21.19-dubprdapntlfe20-UA-S2hhcmtpdixVa3JhaW5l"

[HKCU\Software\Ask.com.tmp\General]
"saguid" = "55705d64-367c-4b8b-a716-4d0ff26d18ff"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Ask.com.tmp\Macro]
"Locale" = "en_US"

"qsrc" = "2871"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Ask.com.tmp\General]
"einst" = "http://img.apnanalytics.com/images/nocache/apn/tr.gif?ev=einst&p2=^M3^YYYYYY^YY^UA&stb={wr_tbr}&ssa={wr_sa}&shpr={wr_hpr}&res={ci_res}&erc={ci_erc}&itime={itime}&hos={hos}&harch={harch}&hloc={hloc}&iv={iv}&fv={fv}&dbr={dbr}&vb={vb}&msi={msi}&ts={random}&guid={guid}&wft={wft}&dot={dot}&inst={inst}&tb={tb}&dt={dt}&erd={erd}"
"iev" = "6.0.2900.5512"

[HKCU\Software\Ask.com.tmp\Installer]
"make-offer" = "1"

[HKCU\Software\Ask.com.tmp\General]
"same-partner" = "0"

[HKCU\Software\Ask.com.tmp\Macro]
"to" = ""

[HKCU\Software\Ask.com.tmp\General]
"fv" = ""
"fflu" = "-2"
"crumb" = "2016.08.16 19.21.19-dubprdapntlfe20-UA-S2hhcmtpdixVa3JhaW5l"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Ask.com.tmp\General]
"ielu" = "-2"

[HKCU\Software\Ask.com.tmp\Macro]
"l" = "dis"
"o" = "13874"

[HKCU\Software\Ask.com.tmp\General]
"iv" = "6.0.2900.5512"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:224 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 25 3B 72 F4 FA 5C 57 B1 48 5B 87 EF 93 AA 17"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

MD5	File path
b28c334c03cee7c5e829c43ae75dae5a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\AskSLib.dll
016b4cb0f363e8563ae9d4c97189ae5d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv2.tmp\ApnIC.dll
23ee55d0c183cc6e85c8fb97fb5973e8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv2.tmp\ApnStub.exe
5f877d4957b9e034fd4b66e048d44ed6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv2.tmp\ApnToolbarInstaller.exe
325b008aec81e5aaa57096f05d4212b5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv2.tmp\InstallOptions.dll
9384f4007c492d4fa040924f31c00166	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv2.tmp\LangDLL.dll
09caf01bc8d88eeb733abc161acff659	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv2.tmp\UAC.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
APNStub.exe:1360
%original file name%.exe:224
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F (571 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6 (153 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F (176 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6 (224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5 (164 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5 (933 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\ApnToolbarInstaller.exe (51118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\UAC.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\pantallatoolbar (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\ioSpecial.ini (6921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\ApnIC.dll (3624 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\LangDLL.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\captura.bmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\modern-wizard.bmp (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\ApnStub.exe (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv2.tmp\InstallOptions.dll (14 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23628	24064	4.46394	856b32eb77dfd6fb67f21d6543272da5
.rdata	28672	4764	5120	3.4982	dc77f8a1e6985a4361c55642680ddb4f
.data	36864	154712	1024	3.3278	7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata	192512	77824	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	270336	16544	16896	4.13355	4ad1dbda51389ca208c78d800fb4d3b6

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 5289
0a1caace976174f8bffc383c4c3c0fa8
10b90b6977362ac27f3b8f9e55fb2112
113b8bfaa4a667866331d6eaab49b3b5
07dcce2efc4528e5d8adabeea1e0cecd
016292c38b3893997566dbd729b66681
ab2e82403ab8cc939f747461235322d2
70ff7f1363de1fc27ba28fad06e8107b
2ab5679f64a24b543e750511f2e24c09
2dbb7a2137cea5ae1a5aaa68e45808ec
57e3ed1dc4ca2e280f022ea90a2b1d63
1c06aab792fbcc46761060c6bc6fb9a0
aa57da7981ab91acc8af54c9f667a857
a415900327031e7142301af0a5372a72
b2da861ad5a75abb7fb1ecf5355850a8
104a944882c9e6102eefe777cdf3c7b1
bf199224a6ea8b808a538eb4e4d393a3
1a10e2a7b4fb3f3fb7d699e65f7242be
37795bcb1dbfef7199de46eeb128694d
3155c272cbddd1bae5435decd2f938dd
20e0d864e4867b55dd8f65932bce0af4
1e51ae01f0bcb83fed67649a82df26d7
1b83c1ca7d04e4654bf6de9679ae0f80
14ad3eaa55b34fef24c47acbf30921d5
537a2e720d6938ab16d3ec8e45f8cbb3
d0e4d19dac089b2c18c19d28d643b6b0

Network Activity

URLs

URL	IP
hxxp://e5728.b.akamaiedge.net/media/toolbar/stub/1.0.0.0/ApnIC.dll?tb=MP3&version=1.0.0.0
hxxp://e6845.dscb1.akamaiedge.net/pca3.crl
hxxp://e6845.dscb1.akamaiedge.net/pca3-g5.crl
hxxp://e6845.dscb1.akamaiedge.net/CSC3-2010.crl
hxxp://websearch.ask.com/installed?client=ic&tb=MP3&dtid=&id=a7a13dfa-094d-4ed7-8f59-312d514e4183&ipid=&iev=6.0.2900.5512&iedis=0&ielu=-2&fflu=-2&iv=&nv=&clientv=9.9.9.9&said=55705d64-367c-4b8b-a716-4d0ff26d18ff&browser-lang=en&apn_dbr=ie_6.0.2900.5512&cr=0	199.36.102.106
hxxp://crl.verisign.com/pca3.crl	23.37.37.163
hxxp://apnmedia.ask.com/media/toolbar/stub/1.0.0.0/ApnIC.dll?tb=MP3&version=1.0.0.0	95.101.250.206
hxxp://crl.verisign.com/pca3-g5.crl	23.37.37.163
hxxp://csc3-2010-crl.verisign.com/CSC3-2010.crl	23.37.37.163

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

HEAD /media/toolbar/stub/1.0.0.0/ApnIC.dll?tb=MP3&version=1.0.0.0 HTTP/1.1

Accept: */*

Accept-Encoding: identity

User-Agent: Microsoft BITS/6.7

Host: apnmedia.ask.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

ETag: "b28c334c03cee7c5e829c43ae75dae5a:1359414902"

Last-Modified: Mon, 28 Jan 2013 22:20:56 GMT

Accept-Ranges: bytes

Content-Length: 248008

Content-Type: application/octet-stream

Date: Tue, 16 Aug 2016 23:21:15 GMT

Connection: keep-alive

GET /media/toolbar/stub/1.0.0.0/ApnIC.dll?tb=MP3&version=1.0.0.0 HTTP/1.1

Accept: */*

Accept-Encoding: identity

User-Agent: Microsoft BITS/6.7

Host: apnmedia.ask.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

ETag: "b28c334c03cee7c5e829c43ae75dae5a:1359414902"

Last-Modified: Mon, 28 Jan 2013 22:20:56 GMT

Accept-Ranges: bytes

Content-Length: 248008

Content-Type: application/octet-stream

Date: Tue, 16 Aug 2016 23:21:15 GMT

Connection: keep-alive

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M...,...,...,...T...,...~...,.......,...T..V,.......,.......,...,..L,...T...,...T...,...~...,...T...,..Rich.,..........................PE..L...s.5P...........!......................................................................@.........................`c.......V...................................!...................................#..@...............@............................text............................... ..`.rdata..K...........................@..@.data...H<...p.......X..............@....rsrc................t..............@..@.reloc...1.......2...z..............@..B.........................................................................................................................................................................................................................................................................................................................|$..v..D$.f..f;L$.t.@@.L$.u.3...|$..v..L$..D$.f..f;.u.@@AA.L$.u.3.....f;......@..D$...P.t$..D$...P.t$..2,.......D$...P.t$..D$...P.t$...,.................V..........-...D$..t.V.} ..Y..^...U...u..u..u..u.......E....].U...u..u..u..u.......E....].U...u..u..u..u... ...E....].U...u..u..u..u... ...E....].U.....V.E.WP........E......Y._^....U..QV...>.u$j..M.......>.u...p....p......M........^..U..QV..j..M.......F....s.@.F..M......^..U..QVW..j..M.......G...v....s.H.G..w........M.#......_..^.........V.... ...

<<< skipped >>>

GET /installed?client=ic&tb=MP3&dtid=&id=a7a13dfa-094d-4ed7-8f59-312d514e4183&ipid=&iev=6.0.2900.5512&iedis=0&ielu=-2&fflu=-2&iv=&nv=&clientv=9.9.9.9&said=55705d64-367c-4b8b-a716-4d0ff26d18ff&browser-lang=en&apn_dbr=ie_6.0.2900.5512&cr=0 HTTP/1.1

User-Agent: ic Windows NT 5.1 MSIE 6.0 Firefox/ Def132 .NET CLR 2.0.50727 .NET CLR 3.0.04506.648 .NET CLR 3.5.21022 .NET4.0C

Host: websearch.ask.com

HTTP/1.1 200 OK

Date: Tue, 16 Aug 2016 23:21:20 GMT

Server: Apache

Content-Length: 2689

Connection: close

Content-Type: text/xml;charset=UTF-8

<?xml version="1.0" encoding="UTF-8"?>.<options id="MP3"><option id="to" value="" client="macro"/>.<option id="dtid" value="^YYYYYY^YY^UA" client="macro"/>.<option id="tb-version" value="5.12.2.0" client="stub"/>.<option id="location" value="Kharkiv,Ukraine" client="macro"/>.<option id="locale" value="en_US" client="macro"/>.<option id="repurl" value="hXXp://img.apnanalytics.com/images/nocache/apn/tr.gif?ev=eichk&p2=^M3^YYYYYY^YY^UA&encb={incbid}&chk={ic_chk}&ts={random}&guid=" client="installer"/>.<option id="same-partner" value="0" client=""/>.<option id="ff-max-version" value="13.*" client="installer"/>.<option id="homepageurl" value="hXXp://VVV.search.ask.com/?l=dis&o=13876" client="installer"/>.<option id="tb-installer-path" value="hXXp://apnmedia.ask.com/media/toolbar/supertoolbar/profile-ask/EverestWrapper.exe" client="stub"/>.<option id="nthp" value="0" client="installer"/>.<option id="cbid" value="^M3" client="macro"/>.<option id="einst" value="hXXp://img.apnanalytics.com/images/nocache/apn/tr.gif?ev=einst&p2=^M3^YYYYYY^YY^UA&stb={wr_tbr}&ssa={wr_sa}&shpr={wr_hpr}&res={ci_res}&erc={ci_erc}&itime={itime}&hos={hos}&harch={harch}&hloc={hloc}&iv={iv}&fv={fv}&dbr={dbr}&vb={vb}&msi={msi}&ts={random}&guid={guid}&wft={wft}&dot={dot}&inst={inst}&tb={tb}&dt={dt}&erd={erd}" client="wrapper"/>.<option id="oi"

<<< skipped >>>

GET /pca3.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.verisign.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "6df834358a0bb5e934947d15c0372dc3:1466795723"

Last-Modified: Fri, 24 Jun 2016 19:15:23 GMT

Date: Tue, 16 Aug 2016 23:21:16 GMT

Content-Length: 933

Connection: keep-alive

Content-Type: application/pkix-crl

0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority..160623000000Z..160930235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!............R.e.53..010207212458Z0!..!......Y...ISi....010706171411Z0!..$-..I{r....u<._...080403172226Z0!..&.."?..y..51}..1..010706172118Z0!..4....2....{W......080605175030Z0!..B....c............070411175910Z0!..H.Py...N....* ....010207212031Z0!..N....-.1Gq.@...C..040401175251Z0!..Y......w`G........070411175657Z0!..Z`..H.@B....Z.*q..080403172017Z0!..l....I...Y..] .c..010706171749Z0"......T=deQ...1u.]...010207212247Z0".....p..1..7<.....e..010207211822Z0...*.H...............DA.............Q>...#........H#......;....._.....v.W..@.:k[.#..,...:...DI. ,g... ..].w.b.d.....1.p.s...];Bs..E.9>...l}....5].....

GET /pca3-g5.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.verisign.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "49ddd5ee9b8941ed8ccf55aec088f07c:1467490816"

Last-Modified: Sat, 02 Jul 2016 20:20:16 GMT

Date: Tue, 16 Aug 2016 23:21:16 GMT

Content-Length: 571

Connection: keep-alive

Content-Type: application/pkix-crl

0..70...0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G5..160630000000Z..160930235959Z0#0!..n.N/.v...J..%R.t..160630163929Z0...*.H..............h...._.......VT..`.\.Y._.=lg.....*.eLto........v.V-.6W.`fa..#.kwE..vH... .....d.A..)n.>...9l..@B.....6....................<.N....PA..G.EH9.R._...._3....7.N..7...'.t.t......N).....I.g......@.#.."..`.../%......;6..h....Q.L8.e..b/.8.t..W..@.t.O.2-.C$f....P..HTTP/1.1 200 OK..Server: Apache..ETag: "49ddd5ee9b8941ed8ccf55aec088f07c:1467490816"..Last-Modified: Sat, 02 Jul 2016 20:20:16 GMT..Date: Tue, 16 Aug 2016 23:21:16 GMT..Content-Length: 571..Connection: keep-alive..Content-Type: application/pkix-crl..0..70...0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G5..160630000000Z..160930235959Z0#0!..n.N/.v...J..%R.t..160630163929Z0...*.H..............h...._.......VT..`.\.Y._.=lg.....*.eLto........v.V-.6W.`fa..#.kwE..vH... .....d.A..)n.>...9l..@B.....6....................<.N....PA..G.EH9.R._...._3....7.N..7...'.t.t......N).....I.g......@.#.."..`.../%......;6..h....Q.L8.e..b/.8.t..W..@.t.O.2-.C$f....P....

<<< skipped >>>

GET /CSC3-2010.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: csc3-2010-crl.verisign.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "c6fd6fbd2d519ad5614d8723c7da2722:1471381821"

Last-Modified: Tue, 16 Aug 2016 21:10:21 GMT

Date: Tue, 16 Aug 2016 23:21:19 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Connection: Transfer-Encoding

Content-Type: application/pkix-crl

00006000..0..V.0..U....0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA..160816210004Z..160830210004Z0..T.0!.....S.@.k....6..c..140730092631Z0!....c..k....D.k.....120708062201Z0!... _...u.t.=.<.&...130218061114Z0!...&..].....P.k.:...120125130117Z0!...7P.x....8.Q...s..130227010252Z0!...9t.*.].....~.....160114221207Z0!...J.....Q..Y.[.....110404153956Z0!...d...=..q!_...g9..130729145216Z0!...d....Y.......o...140711083257Z0!...l.....h2<.H......120329152211Z0!...q.9...`H.*.Y.C...120525202212Z0!...s...TM.......0...121221080842Z0!...t..,.. ...eL.....130314222305Z0!...y..r.HW.v.....w..140423054643Z0!..../u.......A..5...101214165045Z0!.....0.Xc...%...iM..121102230226Z0!.......S.a&.X5t.E]..111206083350Z0!....c.(....B.[M83...140108164517Z0!....A.Sv.....f,.....110609003155Z0!.....z......!.ID{]..101228182208Z0!....b^......{d.J'...130102154110Z0!.......n........'u..140521222808Z0!......0..........I..130912181631Z0!.....1.;C,.. L..0...141111073655Z0!....6e...~..T.......130131012247Z0!.....|.....t.l.o....140827175301Z0!.........bD#*u......130226223939Z0!.......@..'$.).;}\..130121172259Z0!....7.v..........n..120724160733Z0!....n[..P..a.y...p..141121045513Z0!....P;.Y..d...c.(...120209181451Z0!.....].bb[.....!....140328205453Z0!.....a...L`..IV.....130402103508Z0!......fFW.z.....@T..130117000242Z0!...........].{7.....120730000000Z0!...".......Z.V.,.e..121031192224Z0!...'....[.1.

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_224:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|/":

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv2.tmp\InstallOptions.dll

an Ares. Behalve de Ares zal onze werkbalk ook aan u aangeboden worden als deel van de download manager. Deze download manager is niet geassocie?rd met de maker van Ares op geen enkele manier en werkt als een onafhankelijke entiteit die zijn betrouwbaarheid verzekert. Deze download manager vormt deel uit van deze webpagina?s veiligheids maatregelen die de betrouwbaarheid en veiligheid van zijn downloads garanderen. Het belangrijkste doel van deze webpagina is om u in staat te stellen de bestaande virussen en malware in de miljoenen downloads die momenteel op Internet beschikbaar zijn te filteren.

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv2.tmp\InstallOptions.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv2.tmp

en en installatie van Ares. Behalve de Ares zal onze werkbalk ook aan u aangeboden worden als deel van de download manager. Deze download manager is niet geassocie?rd met de maker van Ares op geen enkele manier en werkt als een onafhankelijke entiteit die zijn betrouwbaarheid verzekert. Deze download manager vormt deel uit van deze webpagina?s veiligheids maatregelen die de betrouwbaarheid en veiligheid van zijn downloads garanderen. Het belangrijkste doel van deze webpagina is om u in staat te stellen de bestaande virussen en malware in de miljoenen downloads die momenteel op Internet beschikbaar zijn te filteren.

@.reloc

comdlg32.dll

InstallOptions.dll

PASSWORD

Field %d

All Files|*.*

$ /,,,,// )

,,,,// )

,,,,//

.reloc

SShL0

PeekNamedPipe

CreatePipe

nsExec.dll

9Â9|9

: :0:5:>:

u.Wj@

MSVCRT.dll

HttpSendRequestA

HttpSendRequestExA

HttpQueryInfoA

FtpCreateDirectoryA

FtpOpenFileA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpEndRequestA

InternetCrackUrlA

WININET.dll

inetc.dll

Open URL Error

URL Parts Error

FtpCreateDir failed (550)

Error FTP path (550)

Downloading %s

%dkB (%d%%) of %dkB @ %d.dkB/s

(%d %s%s remaining)

REST %d

SIZE %s

Content-Length: %d

Content-Type: application/x-www-form-urlencoded

Authorization: basic %s

Proxy-authorization: basic %s

%s:%s

FtpCommandA

wininet.dll

%u MB

%u kB

%u bytes

%d:d:d

%s - %s

(Err=%d)

NSIS_Inetc (Mozilla)

/password

Uploading %s

nsv2.tmp

ze wizard zal u door de download leiden en installatie van Ares. Behalve de Ares zal onze werkbalk ook aan u aangeboden worden als deel van de download manager. Deze download manager is niet geassocie?rd met de maker van Ares op geen enkele manier en werkt als een onafhankelijke entiteit die zijn betrouwbaarheid verzekert. Deze download manager vormt deel uit van deze webpagina?s veiligheids maatregelen die de betrouwbaarheid en veiligheid van zijn downloads garanderen. Het belangrijkste doel van deze webpagina is om u in staat te stellen de bestaande virussen en malware in de miljoenen downloads die momenteel op Internet beschikbaar zijn te filteren.

c:\%original file name%.exe

%Program Files%\Ares

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsq1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

zard zal u door de download leiden en installatie van Ares. Behalve de Ares zal onze werkbalk ook aan u aangeboden worden als deel van de download manager. Deze download manager is niet geassocie?rd met de maker van Ares op geen enkele manier en werkt als een onafhankelijke entiteit die zijn betrouwbaarheid verzekert. Deze download manager vormt deel uit van deze webpagina?s veiligheids maatregelen die de betrouwbaarheid en veiligheid van zijn downloads garanderen. Het belangrijkste doel van deze webpagina is om u in staat te stellen de bestaande virussen en malware in de miljoenen downloads die momenteel op Internet beschikbaar zijn te filteren.

755631031

1048896

)-.Yln

Nullsoft Install System v2.46

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps