TrojanDownloader.Win32.Moure_ab7973eb5f – Adaware

Trojan-Downloader.Win32.Moure.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: ab7973eb5f9af4e9e65e63b9a82c42c4

SHA1: e6317815e6c8b0bad87a0600d8c8262131f254cd

SHA256: e4913037e0bce3301be39039f541dec2d034ba829f12b49b906289cc4d9d01cb

SSDeep: 49152:ZuuE7AnqIxGrGYyZa/tgrYJUGfZC3wA6EylfwEaFWd:7E7AqrlyutLxC3sEwwMd

Size: 2383432 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: Sogou.com Inc.

Created at: 2016-04-18 16:10:46

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan-Downloader creates the following process(es):

ThunderFW.exe:1064
UpdateService.exe:832
UpdateService.exe:1364
ExternalApp.exe:404
minidownload.exe:224
regsvr32.exe:1688
%original file name%.exe:1432
MiniTPFw.exe:976

The Trojan-Downloader injects its code into the following process(es):

SogouSoftware.exe:1416
MiniThunderPlatform.exe:968

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process SogouSoftware.exe:1416 makes changes in the file system.

The Trojan-Downloader creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\link[4].png (392 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\cache\LocalInfo.xml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\SogouSoftwareExternalApp[1].exe (1090658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\recommend[1].css (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ie-css3[1].htc (5022 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\link[2].png (2435 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\link[5].png (3175 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ie-css3[1].htc (1012 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SuiteDownloader20160222153349.exe (119919 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\381427456234840[1].jpg (17344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\link[3].png (6116 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\link[1].jpg (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\link[4].png (13048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\link[1].png (8672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\link[2].png (2535 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\cache\PCID.xml (685 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\sogousoftware.db (149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\loading[1].gif (568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\scroll[1].js (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\link[2].png (2730 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[1].txt (494 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\link[1].png (1789 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-1.7.2.min[1].js (37173 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\link[1].png (9045 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\link[3].png (3359 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\cache\SilentParaReponse.xml (97 bytes)
%Documents and Settings%\%current user%\Application Data\-5561624350552157631_4848.png (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\741430117543639[1].png (22604 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\sogousoftware.db-journal (86 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-1.11.1.min[1].js (41557 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\link[1].png (5635 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ranking-ico[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ranking[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SG.jpeg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\link[2].png (2009 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\link[4].png (776 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\cache\NewVersionReponse.xml (1 bytes)
%Program Files%\SogouSoftware\tmp\ExternalApp.exe (684687 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\cache\OnlineIconReponse.xml (359 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CC1430117533187[1].png (15244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\10344[1].jpg (628 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\link[3].png (1420 bytes)
%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\cache\SoftInfo.xml (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\SuiteDownloader20160222153349[1].exe (249517 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ranking-ico[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan-Downloader deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\SogouSoftware\data\sogousoftware.db-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\link[2].png (0 bytes)
%Program Files%\SogouSoftware\tmp\ExternalApp.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ie-css3[1].htc (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ranking-ico[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\link[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\link[1].png (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sogou[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ranking-ico[1].png (0 bytes)

The process ExternalApp.exe:404 makes changes in the file system.

The Trojan-Downloader creates and/or writes to the following file(s):

%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\.svn\prop-base\menu_item.png.svn-base (53 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\search_bar_act.png (17 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\.svn\text-base\beginbtn.png.svn-base (1 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\install_driver.gif (1568 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\ins_progress_bk.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\.svn\text-base\ins_app2phone.png.svn-base (16 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\.svn\text-base\item_icon.png.svn-base (1 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\DrvInst32\.svn\text-base\DrvInst_x86.exe.svn-base (10321 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\.svn\prop-base\7.png.svn-base (53 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\3.0.0.0\.svn\entries (582 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\.svn\text-base\1.png.svn-base (18 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\.svn\prop-base\1.png.svn-base (53 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\.svn\prop-base\logo.png.svn-base (53 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\.svn\prop-base\loading.gif.svn-base (53 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\.svn\prop-base\combo_simple.png.svn-base (53 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\.svn\prop-base\combo_simple_up.png.svn-base (53 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\menu_item.png (3 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\.svn\prop-base\finishbtn.png.svn-base (53 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\.svn\prop-base\icon_success.png.svn-base (53 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\ScrollBar\.svn\text-base\scrollH.png.svn-base (909 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\uninstall_hov.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\.svn\prop-base\ins_title.png.svn-base (53 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\update_confirm_dlg.xml (2 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\.svn\text-base\info_icon.png.svn-base (1 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\continuebtn.png (819 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\.svn\prop-base\combo_sel.png.svn-base (53 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\feedback_act.png (17 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\.svn\text-base\update_hand.png.svn-base (1 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\phone_connected.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\combo_sel.png (347 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\item_icon_4.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\down_smt.png (3 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\.svn\text-base\menu_item.png.svn-base (3 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\button.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\ins_ready.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\.svn\text-base\follow_tip.png.svn-base (1 bytes)
%Program Files%\SogouSoftware\update\SogouPDAInfo.sqlite3 (3624 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\.svn\text-base\phone_unconnected.png.svn-base (1 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\apk.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\.svn\text-base\scroll_trs.png.svn-base (938 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\logo.png (1 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\.svn\text-base\progress_pause.png.svn-base (17448 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\.svn\prop-base\setting_nor.png.svn-base (53 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\ScrollBar\.svn\prop-base\scrollH.png.svn-base (53 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\.svn\all-wcprops (140 bytes)
%Program Files%\SogouSoftware\3.1.13.88\skin\PNG\.svn\text-base\feedback_dwn.png.svn-base (17 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\3.0.0.0\apktool.ini (44 bytes)
%Program Files%\SogouSoftware\3.1.13.88\ApkTool\extheme\ApkTool\bigbtn_shadow.png (3 bytes)



&gid&unc&t&rand

&downloadtype&unc&pcid&mode

&gid&unc&t&rand
&unc&mode
&downloadtype&unc&pcid&mode
&v
&appname&state


&u&pcid&filename

&gid&unc&t&rand

&gid&unc&t&bindtype&bindname&weight&scheme&rand


&gid&unc&t&bindtype&bindname&weight&scheme&rand

&gid&unc&t&activatetype&rand


&gid&unc&t&servicestate&rand
&gid&unc&t&sogousoftware&updateservice&rand


&gid&unc&t&sogousoftware&updateservice&rand



&gid&unc&t&tasktype&pcid&downloadtype&softname&extension&rand
&gid&unc&t&bindtype&bindname&weight&scheme&rand

&v


&appname&state




&url&r
&url&r


&gid&unc&t&num&rand








&pageNo
&url&r
&url&r

&url&r
&url&r
&url&r
&url&r
&url&r
&url&r
&url&r
&url&r
&url&r
&url&r
&url&r
&url&r
&gid&unc&t&rand
&gid&unc&t&bindtype&bindname&weight&scheme&rand
&url&r
&url&r




&url&r

&gid&unc&t&num&rand
&url&r
&v

&pageNo

&url&r

&appname&state



&url&r

&url&r
&gid&unc&t&rand
&url&r


&url&r
&gid&unc&t&bindtype&bindname&weight&scheme&rand
&url&r
&url&r
&url&r

&gid&unc&t&sogousoftware&updateservice&rand
&gid&unc&t&tasktype&pcid&downloadtype&softname&extension&rand


&downloadtype&unc&pcid&mode

&u&pcid&filename

&gid&unc&t&servicestate&rand
&unc&mode



&gid&unc&t&sogousoftware&updateservice&rand
&downloadtype&unc&pcid&mode

&v
&gid&unc&t&activatetype&rand
&gid&unc&t&bindtype&bindname&weight&scheme&rand
&url&r
&appname&state





&url&r




&gid&unc&t&rand


&url&r

&url&r

&gid&unc&t&rand

&gid&unc&t&bindtype&bindname&weight&scheme&rand

&gid&unc&t&activatetype&rand

&gid&unc&t&servicestate&rand

&gid&unc&t&sogousoftware&updateservice&rand

&gid&unc&t&tasktype&pcid&downloadtype&softname&extension&rand

&gid&unc&t&bindtype&bindname&weight&scheme&rand

&gid&unc&t&num&rand

<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>

<<<>>>

&url&r

>&<>&<<><>&<&m&h.&<&

<<<>>>

&url&r

>&<<&<<>>>>>><<<<<<>

<<<>>>

&url&r

>&<&><<>>><&<>&j..x.d..wK.J<>>>>>

<<<>>>

&url&r

&<>>&&<<>>>&&Q..a........9E.c....o...>>>

<<<>>>

&url&r

>&<&q..>&k....s...G...<<<&>>>

<<<>>>

&url&r

>&<&><>&<&<&A&><&<>&>>>

<<<>>>

&url&r

>&<<>>>&>&>&kpY.>&><>&

<<<>>>

&url&r

>&<&vM...F.&&><&>><<><&R.9..RJ.....Q

<<<>>>

&gid&unc&t&rand

<>&l.x4...g....m....&<&<><&&<><>&q.&T......8.W.&<<><

<<<>>>

&>>

&url&r

>&<>><&<<<<>>&

<<<>>>

&url&r

>&<&><>&<&<&A&><&<>&>>>

<<<>>>

&url&r

>&<&q..>&k....s...G...<<<&>>>

<<<>>>

&url&r

>&<>>&><&>><>><&>&&

<<<>>>

&url&r

>&<<><><>&S.G.......h.><>&<><&<<

<<<>>>

&url&r

>&<<&<<>>>>>><<<<<<>

<<<>>>

&url&r

>&<>&><<&>>&&><&<

<<<>>>

&url&r

>&<&&&&&&<>>

<<<>>>

&url&r

>&<><<<><><&>&>>

<<<>>>

&downloadtype&unc&pcid&mode

<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><&v><><><&appname&state><><><><><><><>

<<<>>>

&unc&mode

<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><

<<<>>>

&downloadtype&unc&pcid&mode

<><><><><><><><><><><><><><><><><><><><><><><><><><><><&v><><><&appname&state><><><><><><><><><><><><><><><><><><><><><><

<<<>>>

<><><><><><><><><><><><>>>

<<<>>>

&&>>>&&b>&&

<<<>>>

<><><><>

<><>

<<<>>>

<><><><><

<<<>>>

&pageNo

&&&u&pcid&filename&&

<<<>>>

<&iTXtXML:com.adobe.xmp.....<><><><><><><><><>

<&iTXtXML:com.adobe.xmp.....<><><><><><><><><><

<<<>>>

><&l<&<>&<&<>><>>>>

<<<>>>

&gid&unc&t&rand

<><><><><><><><><><><><><>

<<<>>>

<><><><>&&<&&&&l&&&&&&f.error&&

<<<>>>

<><><><>

<<<>>>

&url&r

&<<<>>>&<<&>&T&_.y....Z.<&l.........

<<<>>>

>>>>>

<<<>>>

<><><><>

&&&u&pcid&filename&&&u

<<<>>>

<&iTXtXML:com.adobe.xmp.....<><><><><><><><><><

<<<>>>

&&D.TdE..t6..U.e.....u..F&>>>&>&>>>>

<<<>>>

&url&r

<><><><><><><><><>>><

<<<>>>

&>&<&W.>><><&&>&>&><>

<<<>>>

<><<&&RM.F>

<<<>>>

&>&<&W.>><><&&>&>&><>

<<<>>>

&appname&state

<><>

&appname&state

<><>

&u&pcid&filename

<&gt

<&g

<><><><><><><><><><><><><><><><><><><>

<&gt

<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><

<<<>>>

<&gt

<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><

<<<>>>

<&gt

<><><><><><><><><><><><><><><><><&partner&dl><><><><><><><><><><><><><><><><><><><><

<<<>>>

<&gt

<><><>

<&gt

<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>

<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><

<<<>>>

<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>

<<<>>>

&softurl&u&pcid&filename&iconurl&softname&softsize&softurl&u&pcid&filename&iconurl&softname

<<<>>>

<><><><><><><><><><><><><><&v><><><&appname&state><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><&

<<<>>>

&t&gid&unc&&rand

&t&gid&unc&rand

&appname&state

&unc&guid&useridbit1&useridbit2&v&t