Trojan.Win32.IEDummy_5de487e376 – Adaware

not-a-virus:HEUR:AdWare.Win32.InstallMonster.gen (Kaspersky), Trojan.Win32.IEDummy.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan, Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 5de487e3763fbf1ca87ee0ee75cdd2b3

SHA1: 4791cd144230e721fbeaab02aa87f6783ae53227

SHA256: 458ae6e84698101dbaadfd5acb0138a270cfa2736c27bd8c1323dff1456f6a84

SSDeep: 98304:a0EG1ZcI6qwCFDzixwWbFjrmNuBeZ4rzNJMPNwKBLFJ855iUZa4o:b3Z qwCFDOOWbFjrmN0H1JMPI55iUZaz

Size: 5318224 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: ACProtect141, BorlandDelphi30, UPolyXv05_v6, MicrosoftWindowsShortcutfile

Company: no certificate found

Created at: 1992-06-20 01:22:17

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:464

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:464 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)

Registry activity

The process %original file name%.exe:464 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCR\5de487e3763fbf1ca87ee0ee75cdd2b3.DynamicNS]
"(Default)" = "DynamicNS"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCR\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}\ProgID]
"(Default)" = "5de487e3763fbf1ca87ee0ee75cdd2b3.DynamicNS"

[HKCR\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}]
"(Default)" = "DynamicNS"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"
"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKCR\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}\LocalServer32]
"(Default)" = "c:\%original file name%.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7D 56 16 0D E5 7C 61 1B 16 80 81 E8 FB AC 0C 7B"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\5de487e3763fbf1ca87ee0ee75cdd2b3\DEBUG]
"Trace Level" = ""

[HKCR\5de487e3763fbf1ca87ee0ee75cdd2b3.DynamicNS\Clsid]
"(Default)" = "{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\5de487e3763fbf1ca87ee0ee75cdd2b3\DEBUG]
"Trace Level"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:464
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version: 1.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description:
Comments:
Language: Language Neutral

Company Name: Product Name: Product Version: 1.0.0.0Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: Comments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
CODE	4096	2091404	2091520	4.56912	f0c5c862939d028c4b18bf0a0cb5b094
DATA	2097152	41164	41472	3.54862	7b56368c45e24402f9cf8174df5875fb
BSS	2142208	32041	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	2174976	13000	13312	3.4117	5b841ddd635112148bb8c712d78ef997
.tls	2191360	104	0	0	d41d8cd98f00b204e9800998ecf8427e
.rdata	2195456	24	512	0.132037	5b2b8e0f284e91bc7b879692c925d390
.reloc	2199552	151756	152064	4.62809	a49a25c88650b838ef9b8830a435a88d
.rsrc	2355200	1738025	1738240	5.20311	4b88afd1636aed4ccdc80a0c4ed1a4a0

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 5
571bb36aa4d7f67c0396986bfeeb37f1
6f49136cf1e580d8bda37dedb74a05b6
e02314d8749e7ffa01dfa5dc179a4837
d72b3a58591eb779cedc63ab3c5c7df0
6bbf3ed4d3f7da0e5de174561e5a0a71

Network Activity

URLs

URL	IP
hxxp://cds.n6i9g8v7.hwcdn.net/s7zip/7z1514.exe
hxxp://tundra.site/pages/inmon/im-typ.html	148.62.4.84
hxxp://tundra.site/pages/inmon/css/style.css	148.62.4.84
hxxp://tundra.site/pages/inmon/images/icon1-green.png	148.62.4.84
hxxp://tundra.site/pages/inmon/images/icon2-green.png	148.62.4.84
hxxp://tundra.site/pages/inmon/images/icon3-green.png	148.62.4.84
hxxp://cast-prod-dlv-pull.ironsrc.netdna-cdn.com/scripts/1/adnl.min.js
hxxp://neu-dl-api.cloudapp.net/api/vv/1?callback=cb_1463563421722&ts=1463563421722&sessionId=eYrOG&rfr=&siteId=9306&aus=5584,1,0
hxxp://cast-prod-dlv-pull.ironsrc.netdna-cdn.com/images/1eaeba30-fae9-4091-b89c-7f1ccf25c528.jpg
hxxp://neu-dl-api.cloudapp.net/api/vp/1?clk=1q5U6WGl8JT6Z_Rre01Gi_VuYauagV_9vsVBy4ksZtdmBnNzWJXNqYJQRKVmxSBbUUjRTL8lg_SfljOyjpDa5EKXL5sWT2FvVTQ3dwDZl_BpODs_wglwaoQ525V4ZN3viQb13N5DNzkiMkNwjB6e5gVMTTRAftmOuQC6HEhlh-fyOpdq8-YH5gy8Ts1vrb-UK5-B76xbE6vvHsjtYcQUdWNRJCxlN8OWhlXqWruZw-mVXiqNJlRPmYPI60UNRaogsBO7GSgJZr7Yux_xgPx_rHRrbwjVfY9g-xhQT10CIpLY13AcjAMJKdIiwHqFLBX2VcmJq3Y3-Qhb84EyLRRnNL5HD8DFy_hkBB8IFRpZ1epTPRvzklmJYbp5P1nv-FaOm5X0RWxyIhOVp_1eBmFhSIsJ5ix92mInAWHSOBW4eyAoQFT71MoiZt-tQT2KyfvgRpu6SpHpFShwU9qoGipYxGTGezk_YuCGGC4DHXnhvCo&rfr=
hxxp://d.castplatform.com/api/vp/1?clk=1q5U6WGl8JT6Z_Rre01Gi_VuYauagV_9vsVBy4ksZtdmBnNzWJXNqYJQRKVmxSBbUUjRTL8lg_SfljOyjpDa5EKXL5sWT2FvVTQ3dwDZl_BpODs_wglwaoQ525V4ZN3viQb13N5DNzkiMkNwjB6e5gVMTTRAftmOuQC6HEhlh-fyOpdq8-YH5gy8Ts1vrb-UK5-B76xbE6vvHsjtYcQUdWNRJCxlN8OWhlXqWruZw-mVXiqNJlRPmYPI60UNRaogsBO7GSgJZr7Yux_xgPx_rHRrbwjVfY9g-xhQT10CIpLY13AcjAMJKdIiwHqFLBX2VcmJq3Y3-Qhb84EyLRRnNL5HD8DFy_hkBB8IFRpZ1epTPRvzklmJYbp5P1nv-FaOm5X0RWxyIhOVp_1eBmFhSIsJ5ix92mInAWHSOBW4eyAoQFT71MoiZt-tQT2KyfvgRpu6SpHpFShwU9qoGipYxGTGezk_YuCGGC4DHXnhvCo&rfr=	40.127.174.50
hxxp://d.castplatform.com/api/vv/1?callback=cb_1463563421722&ts=1463563421722&sessionId=eYrOG&rfr=&siteId=9306&aus=5584,1,0	40.127.174.50
hxxp://cdn.castplatform.com/images/1eaeba30-fae9-4091-b89c-7f1ccf25c528.jpg	198.232.124.20
hxxp://www.cortisols2dilaudid2.online/s7zip/7z1514.exe	205.185.216.42
hxxp://cdn.castplatform.com/scripts/1/adnl.min.js	198.232.124.20

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /scripts/1/adnl.min.js HTTP/1.1

Accept: */*

Referer: hXXp://tundra.site/pages/inmon/im-typ.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.castplatform.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 18 May 2016 09:23:37 GMT

Content-Type: text/javascript; charset=utf-8

Content-Length: 60114

Connection: keep-alive

Vary: Accept-Encoding

Content-MD5: Y2JFw1mhlW2JqbXKv8rOdw==

Last-Modified: Tue, 26 Apr 2016 08:45:42 GMT

ETag: 0x8D36DAF266AAE18

x-ms-write-protection: false

X-Node: cdn1

Server: NetDNA-cache/2.2

X-Cache: HIT

// CAST Delivery Agent v4.4.29 #8:45.!function(global,undefined){Array.prototype.indexOf||(Array.prototype.indexOf=function(e,t){if(this===undefined||null===this)throw new TypeError('"this" is null or not defined');var n=this.length>>>0;for(t= t||0,1/0===Math.abs(t)&&(t=0),0>t&&(t =n,0>t&&(t=0));n>t;t )if(this[t]===e)return t;return-1}),"object"!=typeof window.JSON&&(window.JSON={},window.JSON.stringify=function(e){if("[object Array]"===Object.prototype.toString.call(e)){if(e.length>0){for(var t=e.length,n=[],a=0;t>a; a)n.push(this.stringify(e[a]));return"[" n.join(", ") "]"}return"[]"}if("object"==typeof e&&null!==e){var n=[];for(a in e)n.push('"' a '": ' this.stringify(e[a]));return"{" n.join(", ") "}"}return"string"==typeof e?'"' e.replace(/"/g,'\\"') '"':e},window.JSON.parse=function(text,reviver){function walk(e,t){var n,a,i=e[t];if(i&&"object"==typeof i)for(n in i)Object.prototype.hasOwnProperty.call(i,n)&&(a=walk(i,n),a!==undefined?i[n]=a:delete i[n]);return reviver.call(e,t,i)}var cx=/[\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,j;if(text=String(text),cx.lastIndex=0,cx.test(text)&&(text=text.replace(cx,function(e){return"\\u" ("0000" e.charCodeAt(0).toString(16)).slice(-4)})),/^[\],:{}\s]*$/.test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g,"@").replace(/"[^"\\\n\r]*"|true|false|null|-?\d (?:\.\d*)?(?:[eE][ \-]?\d )?/g,"]").replace(/(?:^|:|,)(?:\s*\[) /g,"")))return j=eval("(" text ")"),"function"==typeof revive

<<< skipped >>>

GET /images/1eaeba30-fae9-4091-b89c-7f1ccf25c528.jpg HTTP/1.1

Accept: */*

Referer: hXXp://tundra.site/pages/inmon/im-typ.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.castplatform.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 18 May 2016 09:23:38 GMT

Content-Type: image/jpeg; charset=utf-8

Content-Length: 99940

Connection: keep-alive

Vary: Accept-Encoding

Content-MD5: 84yOv9Fknx6WvATYJ8//sw==

Last-Modified: Sun, 13 Mar 2016 09:05:27 GMT

ETag: 0x8D34B1E9EAC9EFB

x-ms-write-protection: false

X-Node: cdn1

Server: NetDNA-cache/2.2

X-Cache: HIT

......Exif..II*.................Ducky.......8......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9d3aa1bc-879e-f341-bb50-ccda3be4d297" xmpMM:DocumentID="xmp.did:C9F120E4E8F211E5B83DE635D0776361" xmpMM:InstanceID="xmp.iid:C9F120E3E8F211E5B83DE635D0776361" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:963c8fb8-b4bf-3f44-ba12-95c7f2efc8d3" stRef:documentID="xmp.did:9d3aa1bc-879e-f341-bb50-ccda3be4d297"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d................................................................""""""""""................"""""""""""""""""""""""""""""""""""""""""""""""""........ ........................................................................................!.1...AQ.aq"...2B.....R#...b.r...3S..U...Cs$u6...c.4DTt%7....d..EeVv'8...5&.....................!1..AQ..aq......."2....BRb.r.#..3.....CS............?..V.&.....u.{f..,6.T.....)*4..#....:.S..g....v.b.u.......u.&. eR....T .1}-....r.....Upe7,ztr....1.H....]..D..A..G....W...........Nd.DN\.L=...M

<<< skipped >>>

GET /api/vv/1?callback=cb_1463563421722&ts=1463563421722&sessionId=eYrOG&rfr=&siteId=9306&aus=5584,1,0 HTTP/1.1

Accept: */*

Referer: hXXp://tundra.site/pages/inmon/im-typ.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.castplatform.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Length: 1076

Content-Type: text/javascript; charset=utf-8

Server: Microsoft-HTTPAPI/2.0

X-Country: UA

P3P: CP='NON UNI COM NAV STA OUR IND'

Set-Cookie: cuuid=20984b5c-b3e8-4df8-a2e7-097fb36cdb0d; expires=Mon, 18 May 2026 09:23:37 GMT; domain=d.castplatform.com; path=/

X-Elapsed: 208

X-Node: NEU3961D5

Date: Wed, 18 May 2016 09:23:36 GMT

cb_1463563421722 && cb_1463563421722({"zones":[{"id":5584,"status":200,"enabled":true,"template":"Free_Creative_800x440","data":[{"clickTag":null,"clk":"1q5U6WGl8JT6Z_Rre01Gi_VuYauagV_9vsVBy4ksZtdmBnNzWJXNqYJQRKVmxSBbUUjRTL8lg_SfljOyjpDa5EKXL5sWT2FvVTQ3dwDZl_BpODs_wglwaoQ525V4ZN3viQb13N5DNzkiMkNwjB6e5gVMTTRAftmOuQC6HEhlh-fyOpdq8-YH5gy8Ts1vrb-UK5-B76xbE6vvHsjtYcQUdWNRJCxlN8OWhlXqWruZw-mVXiqNJlRPmYPI60UNRaogsBO7GSgJZr7Yux_xgPx_rHRrbwjVfY9g-xhQT10CIpLY13AcjAMJKdIiwHqFLBX2VcmJq3Y3-Qhb84EyLRRnNL5HD8DFy_hkBB8IFRpZ1epTPRvzklmJYbp5P1nv-FaOm5X0RWxyIhOVp_1eBmFhSIsJ5ix92mInAWHSOBW4eyAoQFT71MoiZt-tQT2KyfvgRpu6SpHpFShwU9qoGipYxGTGezk_YuCGGC4DHXnhvCo","width":800,"height":440,"cUrl":"hXXp://d.castplatform.com/api/c/1?clk=%clk%","trackers":[{"type":"Url","content":"hXXp://d.castplatform.com/api/vp/1?clk=%clk%"}],"category":null,"assets":[{"assetDisplayType":1,"width":800,"height":440,"url":"//cdn.castplatform.com/images/1eaeba30-fae9-4091-b89c-7f1ccf25c528.jpg","javascript":"","clickTagVar":""}]}],"styles":null,"settings":{"adUnitTitle":""},"displayType":"Size"}],"ts":208});....

GET /api/vp/1?clk=1q5U6WGl8JT6Z_Rre01Gi_VuYauagV_9vsVBy4ksZtdmBnNzWJXNqYJQRKVmxSBbUUjRTL8lg_SfljOyjpDa5EKXL5sWT2FvVTQ3dwDZl_BpODs_wglwaoQ525V4ZN3viQb13N5DNzkiMkNwjB6e5gVMTTRAftmOuQC6HEhlh-fyOpdq8-YH5gy8Ts1vrb-UK5-B76xbE6vvHsjtYcQUdWNRJCxlN8OWhlXqWruZw-mVXiqNJlRPmYPI60UNRaogsBO7GSgJZr7Yux_xgPx_rHRrbwjVfY9g-xhQT10CIpLY13AcjAMJKdIiwHqFLBX2VcmJq3Y3-Qhb84EyLRRnNL5HD8DFy_hkBB8IFRpZ1epTPRvzklmJYbp5P1nv-FaOm5X0RWxyIhOVp_1eBmFhSIsJ5ix92mInAWHSOBW4eyAoQFT71MoiZt-tQT2KyfvgRpu6SpHpFShwU9qoGipYxGTGezk_YuCGGC4DHXnhvCo&rfr= HTTP/1.1

Accept: */*

Referer: hXXp://tundra.site/pages/inmon/im-typ.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.castplatform.com

Connection: Keep-Alive

Cookie: cuuid=20984b5c-b3e8-4df8-a2e7-097fb36cdb0d

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Length: 43

Content-Type: image/gif

Server: Microsoft-HTTPAPI/2.0

Set-Cookie: cuuid=5b31f2a0-6bb9-4eba-bcab-35d5ac25e545; expires=Mon, 18 May 2026 09:23:37 GMT; domain=d.castplatform.com; path=/

P3P: CP='NON UNI COM NAV STA OUR IND'

X-Elapsed: 0

Date: Wed, 18 May 2016 09:23:36 GMT

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Control: no-cache..Content-Length: 43..Content-Type: image/gif..Server: Microsoft-HTTPAPI/2.0..Set-Cookie: cuuid=5b31f2a0-6bb9-4eba-bcab-35d5ac25e545; expires=Mon, 18 May 2026 09:23:37 GMT; domain=d.castplatform.com; path=/..P3P: CP='NON UNI COM NAV STA OUR IND'..X-Elapsed: 0..Date: Wed, 18 May 2016 09:23:36 GMT..GIF89a.............!.......,...........L..;..

GET /pages/inmon/im-typ.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tundra.site

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Vary: Accept-Encoding

Content-Type: text/html

Content-Encoding: gzip

Date: Wed, 18 May 2016 09:14:07 GMT

Transfer-Encoding: chunked

ETag: W/"5628d116-7b9"

Connection: keep-alive

Set-Cookie: X-Mapping-fjhppofk=3E8E1A8CCA3BD46AD95C5D4A4E8F490A; path=/

Last-Modified: Thu, 22 Oct 2015 12:05:42 GMT

364.............U.n.0......f..& .4 .4.]L..........18N.;....]..^.!....._y...8N.... ..:.s..../.....5l.`....?; .#... .1......a......nL#ICn 7..p....O..(....>...x.O]R...D9....p1#Nmz3I%#....{.v....Gl .....pL.c.9`D..@M?&].p..2...bk. ..S.Z..#.a!.#..X,.....U.F......mAx>. .2.t.`z....M.r....F.P...:Vo...Oj.....#..SC....l..MW,3.hVv..)Q/.....FN....q.y.r.....k...7kv.P..WX.4..E..LyYc..>......C._.......Y...d...WPz...z....R?..q.,}..|.R}..G5.e....K5.6.)$.D.......`...D.:... ..B .jF..x.@..oC.%".'e.......T..i[..P........z..C..8..:..Y.f.p.;........'.f%#:.{.1t3.{1...`^.W........[.T...0?0c..~...7.:>s.t.H...k...6.v.wd...T.#...$..u..q..6.8F...m......ziF.. {...f...\. .h7.[.;7Z....z..]'..._....huvom..e..7],d....q`.a.7.t..........*...........`]...gqf.......... ....EB.oy...z...3..`I6.....,...A........j.Ha.,...Pn......I'.~..P.FkQK\...^.^.....K.{..&."...O.W....r...D'@.vQ.......g.f.~.....i.......0......

GET /pages/inmon/css/style.css HTTP/1.1

Accept: */*

Referer: hXXp://tundra.site/pages/inmon/im-typ.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tundra.site

Connection: Keep-Alive

Cookie: X-Mapping-fjhppofk=3E8E1A8CCA3BD46AD95C5D4A4E8F490A

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Wed, 18 May 2016 09:14:07 GMT

Content-Type: text/css

Last-Modified: Thu, 22 Oct 2015 12:08:45 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"5628d1cd-70e"

Content-Encoding: gzip

28e.............U.n.@.}N.b...KA\.lB.....7.00...ah.F.....pYR-U.b..c...Ez.,.%.9."..-.5MSV..%..r2Z2~......XB_.O.(.%.........uY..(.../.H..O7..X^..TB...U.I9.......H4&.....0.5..`(e..a.B[%...RUDd..L....C.y..Q...z]...h......5.s...........:..L>..E.=HS...R...b c....C.j...^..%.J.R'..SL`..8U...e..k..y..@7...HL.C.E[... x_....1oa...6.~7...4.y..7..3.l.9.....#..b!....O..... .v ...e........k..........fB(3S............wX.......y...,p......I.n..^..tJ.......B..2!aT...B.t=v!.nv[..4L...t ..w..z.q;#...o}N;U}...|.....C3X....v.../c=.............cl...#..5..^..0.}an.h. .S7.7.~KZ.6......Y.d.......Y.`.L8...............y...O.l FY. ..#5..A.k.Wm........h2.'.....$...Qg...P....9........0......

GET /pages/inmon/images/icon2-green.png HTTP/1.1

Accept: */*

Referer: hXXp://tundra.site/pages/inmon/im-typ.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tundra.site

Connection: Keep-Alive

Cookie: X-Mapping-fjhppofk=3E8E1A8CCA3BD46AD95C5D4A4E8F490A

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Wed, 18 May 2016 09:14:07 GMT

Content-Type: image/png

Content-Length: 3782

Last-Modified: Wed, 12 Aug 2015 13:59:00 GMT

Connection: keep-alive

ETag: "55cb5124-ec6"

Accept-Ranges: bytes

.PNG........IHDR...>...E......$UF....tEXtSoftware.Adobe ImageReadyq.e<...hIDATx..[kl#W....yO......?..u..H..P..J...$@..K...l. .}..}P@@..J........q..H@3.E.u@.".Zg7.$..$q..f..\...c;....(W;.].x.~......;....?......c.|X........B...;D...rv&.M..eE...eZ..1Ts5....E?..{O.x....B.. ..=B...D...~.,,..p.493...XB.R...2&......1...., .5.....b[.B`ae...oF...p.FZ.,."..zh......p...yH.l>!4:. .[aXi.3.... |.. ..t.....J...../4...(T.meL..'9ceC.]R//...FkW.Z...vpb6d..?......=.x..M.RO....P..p[c-..K.p.,v........K.|.=......:!..2............<`....j....Mq...C<{*L2j.^05g.q=}qy`..sy ]3.UK.j.....o.Z.......2&u5{.fw.}6.Oe8cuCO._..<.Jd.9.;.......[4.2.i....y.K.Z.......q..J.A^..g......1..|.lN.)8............f.q]...4............I..c...=.2..[..2LZ.1rIf....3.....M...2.M.f..R siU..i..0.....9_.?.'...S.R#.sN.{.s.........@7...%..{........w>....A.V...{?..V9.*G.....,.......lA.:7.........E.q.C..._W.Dd.k;&D..4..E}3.}..X.c.)`.!.$...R.........X.<....^.PH..NO.)...^KM-.......:.8...Q..S7.`. ...V...D.@.'.<..x!..1.PU.ktr<R.@.W.......t....l..'d..n.'|v*...R..=.uau0..uC...S.......G....F............f...h.XN.h..-(..../....l.f..fI..`G.|.....\...bf..Q*...p....Y..R......w........\aj.TR..IUA.d.6...@.DqNi..8.#.l!)l(,V....6m.<...E..../.y....P.......y.........O.f....-.....Y....B.(.s..r....z<jf....m...[Hc...%5.....$..x.Z...u2.....h.........94{.....9...\.wE.?....!E.\l..S...).....A...2FV.y..Z..d.HEPsy....!.*X.......?s|.qM..y..U.s.......m....Zi.T......C....m.nB.......4.....Q.........) ...Ph..'.~|..nZ'.Fpk..:....3...)_|.~....H..gnM.J?k....$y......-.....

<<< skipped >>>

GET /pages/inmon/images/icon1-green.png HTTP/1.1

Accept: */*

Referer: hXXp://tundra.site/pages/inmon/im-typ.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tundra.site

Connection: Keep-Alive

Cookie: X-Mapping-fjhppofk=3E8E1A8CCA3BD46AD95C5D4A4E8F490A

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Wed, 18 May 2016 09:14:07 GMT

Content-Type: image/png

Content-Length: 3392

Last-Modified: Wed, 12 Aug 2015 13:59:00 GMT

Connection: keep-alive

ETag: "55cb5124-d40"

Accept-Ranges: bytes

.PNG........IHDR...>...E......$UF....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[{l[W.?..g..fvR.]..2.4.z.N..?jOC......C....IS[....%Y............i].@..c.@.?Hs%.:&.....&..c.............#YIS...;.w.....cB.O......GE.l.3.n7.2Rv..FQ..JF. ...Lt.....?..m.cN...'yK...k..Y..l..........j...qO:.?.......n...8K........K7<9X.db.$.....b.............=-........<uhB..2......-/VI.Hzy.$."..?y...<.....-.iF..x.. ...N..ke....)......!._.mJc..p,a.Z.Gd.x.(...p.......j....~3.. .I..a....~4...S...NN0f.W..2.I.....t....i`..1d.6....E...^.oKGb$qm.}..;.f...g...h%x..t.K ..'.......(X...W.:...]#.p......>.._;.>j..{..V.(k.W...O\....oj..^.....K.lq>.<.......eJ........?..Yp.`.Ic........F............OV.../...n.....u.3...F..`... .....oj..b.......7"..;]i.B.. ...K.A{..W.^.g....9..?}..p....R.M....i..N.D....;......QK..,".....9.....ub>...P.....g:9/...:?.y?..a8...L....L.b.s............W...O|.S...w*...3=..J.,...:...3ok..mz....W....E.S.F.N...99K.v.S.P.......].!ey:]#C..!.8 .W...D;dq.......>;...|Y.,3D.Gq.Mg.D..i.|..X.......[.@.s8.8sVD.*cYmj.=.3..2........W...vw...fy9^.....z......pEQ. ...Q....T....#.[/..t.0z.h!..>t.....%".Bl.{.<.{.JW.....?.3h.{w...(...DF..p...dV.}X....PJ...n.A.....o. p.(..........H..3....H...N....F)p8....$.......Y....z:Tn.....W.q....6..D..G.Ud.f.....C.X....D......N..{..T.j......../."..=...g..)..<(hwX.rf...0...Z=J..=....1B..n.$U\.P.re.ku.u&8.nC.........W........so..../.O5...G.....OB#%...x...~..`.;.....^.m."...........q..S]..T.....Fj)>...|.jZ...['.....:.s.x..O.m.....[....\$0..{..&.r...^.U...?.o..Y.......ZW].

<<< skipped >>>

GET /pages/inmon/images/icon3-green.png HTTP/1.1

Accept: */*

Referer: hXXp://tundra.site/pages/inmon/im-typ.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tundra.site

Connection: Keep-Alive

Cookie: X-Mapping-fjhppofk=3E8E1A8CCA3BD46AD95C5D4A4E8F490A

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Wed, 18 May 2016 09:14:07 GMT

Content-Type: image/png

Content-Length: 1519

Last-Modified: Wed, 12 Aug 2015 13:59:00 GMT

Connection: keep-alive

ETag: "55cb5124-5ef"

Accept-Ranges: bytes

.PNG........IHDR...>...E......$UF....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[.O[u.........(.E....o..............U0...Q`.%...}0..$..d....%&=<.H.|q.sNZ..R..=7.._/P...Z.....rN.....;..0`.......0`.....S<q..x.6...8. .....4=A].....Y...L<y~&\".I.G..X.Y,......L\{......./..s.Id.1L....si6o@.c.4.h...5:8.....!...............j..W.h..UvZ...bC.B....1..j\YZ..9...9....r0..8......V...\..[.HO.y..`.{w..SQ.[.m..L.V.nli.....L..`..n&...\.bZ.U.@.q...u.......wJ.~.f......:.......x.i.g.......s...>4...J...z .^r.z..3....RO<y.wI.).Z..v......^p.u.y"H....W*6Q..tX."?..w...'...%. .......f.|o....3.s......:.Zz].2.............|.v..U....c..z.b....i........>....q.S .....'k3...6.......>D.qY.E............................1e1=.Ff)..o..|_..O...z...P6. ... ....?O.S...=.DtU..c.-C....SG.%.Y....*.......#.=y.K.quyM.......g.(....\9y.Y..s\v....!.......>@..d............I..d{.m...!..zFR..........._#rr9.g....ut~....!..;....-....*w...Hx.E.C]........}.....c.n"..>.".._.ZQ.C.."....q.j"...... ......._I....S.g.....f...o3..Q...jpf......s.)...1B].SO..3..$N..].g(.z......D.......T...C/......u.a}....`. ":m.-m..W.....4..JJ.}...%.U.T....-.N.....m."..?YE...q=....|P.....X.H,.......|..J.F.#M.......w.t...Xrr&..e=;.a......R.e.RN...2....n-....g..8d../;....b......p..).&.0Xm.._.Gs.T..V.y.mo..3....h...F.-.^HH......k....2i...v..&.......j..s,...~ok......=......n.`.x..1.-.I...G..V...F...,U.K...Hb".;p...A/...s.V/.._....7q.S.|....&.~81v-..../...!.G.Q.m............\./*.$h...>..*.u.@b.ZM~h1yH..W.E...Wp].a.'{....8r.A,...r.....).hY...?.KE.u.........._...d

<<< skipped >>>

GET /s7zip/7z1514.exe HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.cortisols2dilaudid2.online

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 18 May 2016 09:23:33 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1455546258"

Cache-Control: max-age=79155

Content-Length: 1098961

Content-Type: application/octet-stream

X-HW: 1463563413.dop004.fr7.t,1463563413.cds055.fr7.c

Last-Modified: Mon, 15 Feb 2016 14:24:18 GMT

Content-Disposition: attachment; filename="7z1514.exe"

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..z...)...)...)i..)...)...)...)i..)...)...)...)...)K..)...)...)0..)...)...)...)Rich...)........................PE..L....;.V........../......b...J.......o............@.....................................................................................................................................................................8............................text...<a.......b.................. ..`.rdata..*............f..............@..@.data....%...........z..............@....rsrc................|..............@..@........................................................................................................................................................................................................................................................................................................................................................................................U.........E.Ht.Hu>......P.u.....@...u.f!...........Pj.hh......u.j.hg....u...$.@.3....... SUV3.WU..0.@...7....l.@...........\.@.f..f;.tyf= .u.FF.j.......f.>/..uYf.N.f..Su.f.F.f;.t.f= .u.....@......4f..Du.f.~.=u'..... ........;.v...PVW..x.@.............f....f9-\.@.ur.D$..l$.Ph....U.5..@.h........@...u ..$.@..L$.W........t$.....@.;.u.Wh..@....@.............u.h..@.W..t.@.YY...3..........9-..@.t.......T...j.^Uh>.@.Ujd.t$D.t$$....@.;....@.u....*...V.t$8....@...$.@.PVh.....5..@...UU.D$.UP....@.;.......

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

iexplore.exe_1636:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512