Gen.Packed.FakeAV.2_584388a669 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1004

The Trojan injects its code into the following process(es):

vmacthlp.exe:936
wmiprvse.exe:468
lsass.exe:776
spoolsv.exe:1448
Explorer.EXE:1684
jqs.exe:1972

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1004 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\JibyEvxo\TordUlcac.exe (123 bytes)

The Trojan deletes the following file(s):

C:\%original file name%.exe (0 bytes)

Registry activity

The process vmacthlp.exe:936 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process %original file name%.exe:1004 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 51 1E 68 D6 33 9F 6B BB 0E 32 FC 49 66 4E 51"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GupuQjep" = "%Documents and Settings%\All Users\Application Data\JibyEvxo\TordUlcac.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in kernel32.dll:

CreateProcessInternalW

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1004
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\All Users\Application Data\JibyEvxo\TordUlcac.exe (123 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GupuQjep" = "%Documents and Settings%\All Users\Application Data\JibyEvxo\TordUlcac.exe"
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1952	2048	4.34383	e2a077eabc08414eefabdf27052378b3
bss	8192	48	0	0	d41d8cd98f00b204e9800998ecf8427e
.rdata	12288	664	1024	2.43563	46287cb0c778ae192c2757af9b19fd89
.rsrc	16384	100020	100352	5.54355	170d9f71a6a2e400040cefc07cfdf9cb

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

wmiprvse.exe_468_rwx_00DD0000_00027000:

c:\%original file name%.exe

.text

.rdata

@.data

.reloc

u.Sh8

KERNEL32.DLL

%u(%u)

user32.dll

kernelbase.dll

\notepad.exe

iertutil.dll

Content-Type: application/x-www-form-urlencoded

aSHELL32.DLL

hXXp://

hXXps://

PID: %u [%0.2u:%0.2u:%0.2u]

ntdll.dll

dbghelp.dll

\%u.dmp

GetWindowsDirectoryA

GetWindowsDirectoryW

WinExec

KERNEL32.dll

USER32.dll

RegCloseKey

RegNotifyChangeKeyValue

RegCreateKeyExA

RegEnumKeyW

RegOpenKeyExA

RegOpenKeyExW

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

CertOpenStore

CertFreeCertificateContext

CertAddCertificateContextToStore

CertCloseStore

PFXImportCertStore

CertEnumCertificatesInStore

CRYPT32.dll

NETAPI32.dll

SHLWAPI.dll

IPHLPAPI.DLL

MSVCRT.dll

GetProcessHeap

RegCreateKeyA

CryptImportKey

CryptDestroyKey

HttpSendRequestExA

HttpQueryInfoA

HttpOpenRequestA

HttpEndRequestA

HttpAddRequestHeadersA

HttpSendRequestA

WININET.dll

7&7,747:7

.pdata

@.reloc

SHELL32.DLL

msvcrt.dll

DelegateExecute

%s\%s.txt

iexplore.exe

firefox.exe

explorer.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

lsass.exe_776_rwx_00AC0000_00027000:

c:\%original file name%.exe

.text

.rdata

@.data

.reloc

u.Sh8

KERNEL32.DLL

%u(%u)

user32.dll

kernelbase.dll

\notepad.exe

iertutil.dll

Content-Type: application/x-www-form-urlencoded

aSHELL32.DLL

hXXp://

hXXps://

PID: %u [%0.2u:%0.2u:%0.2u]

ntdll.dll

dbghelp.dll

\%u.dmp

GetWindowsDirectoryA

GetWindowsDirectoryW

WinExec

KERNEL32.dll

USER32.dll

RegCloseKey

RegNotifyChangeKeyValue

RegCreateKeyExA

RegEnumKeyW

RegOpenKeyExA

RegOpenKeyExW

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

CertOpenStore

CertFreeCertificateContext

CertAddCertificateContextToStore

CertCloseStore

PFXImportCertStore

CertEnumCertificatesInStore

CRYPT32.dll

NETAPI32.dll

SHLWAPI.dll

IPHLPAPI.DLL

MSVCRT.dll

GetProcessHeap

RegCreateKeyA

CryptImportKey

CryptDestroyKey

HttpSendRequestExA

HttpQueryInfoA

HttpOpenRequestA

HttpEndRequestA

HttpAddRequestHeadersA

HttpSendRequestA

WININET.dll

7&7,747:7

.pdata

@.reloc

SHELL32.DLL

msvcrt.dll

DelegateExecute

%s\%s.txt

iexplore.exe

firefox.exe

explorer.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

wmiprvse.exe_468_rwx_00F00000_00014000:

.text

.rdata

@.data

.reloc

u.Sh8

KERNEL32.DLL

%u(%u)

user32.dll

kernelbase.dll

\notepad.exe

iertutil.dll

Content-Type: application/x-www-form-urlencoded

aSHELL32.DLL

hXXp://

hXXps://

PID: %u [%0.2u:%0.2u:%0.2u]

ntdll.dll

dbghelp.dll

\%u.dmp

GetWindowsDirectoryA

GetWindowsDirectoryW

WinExec

KERNEL32.dll

USER32.dll

RegCloseKey

RegNotifyChangeKeyValue

RegCreateKeyExA

RegEnumKeyW

RegOpenKeyExA

RegOpenKeyExW

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

CertOpenStore

CertFreeCertificateContext

CertAddCertificateContextToStore

CertCloseStore

PFXImportCertStore

CertEnumCertificatesInStore

CRYPT32.dll

NETAPI32.dll

SHLWAPI.dll

IPHLPAPI.DLL

MSVCRT.dll

GetProcessHeap

RegCreateKeyA

CryptImportKey

CryptDestroyKey

HttpSendRequestExA

HttpQueryInfoA

HttpOpenRequestA

HttpEndRequestA

HttpAddRequestHeadersA

HttpSendRequestA

WININET.dll

7&7,747:7

DelegateExecute

%s\%s.txt

iexplore.exe

firefox.exe

explorer.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

lsass.exe_776_rwx_00BC0000_00014000:

.text

.rdata

@.data

.reloc

u.Sh8

KERNEL32.DLL

%u(%u)

user32.dll

kernelbase.dll

\notepad.exe

iertutil.dll

Content-Type: application/x-www-form-urlencoded

aSHELL32.DLL

hXXp://

hXXps://

PID: %u [%0.2u:%0.2u:%0.2u]

ntdll.dll

dbghelp.dll

\%u.dmp

GetWindowsDirectoryA

GetWindowsDirectoryW

WinExec

KERNEL32.dll

USER32.dll

RegCloseKey

RegNotifyChangeKeyValue

RegCreateKeyExA

RegEnumKeyW

RegOpenKeyExA

RegOpenKeyExW

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

CertOpenStore

CertFreeCertificateContext

CertAddCertificateContextToStore

CertCloseStore

PFXImportCertStore

CertEnumCertificatesInStore

CRYPT32.dll

NETAPI32.dll

SHLWAPI.dll

IPHLPAPI.DLL

MSVCRT.dll

GetProcessHeap

RegCreateKeyA

CryptImportKey

CryptDestroyKey

HttpSendRequestExA

HttpQueryInfoA

HttpOpenRequestA

HttpEndRequestA

HttpAddRequestHeadersA

HttpSendRequestA

WININET.dll

7&7,747:7

DelegateExecute

%s\%s.txt

iexplore.exe

firefox.exe

explorer.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

spoolsv.exe_1448_rwx_00B60000_00027000:

c:\%original file name%.exe

.text

.rdata

@.data

.reloc

u.Sh8

KERNEL32.DLL

%u(%u)

user32.dll

kernelbase.dll

\notepad.exe

iertutil.dll

Content-Type: application/x-www-form-urlencoded

aSHELL32.DLL

hXXp://

hXXps://

PID: %u [%0.2u:%0.2u:%0.2u]

ntdll.dll

dbghelp.dll

\%u.dmp

GetWindowsDirectoryA

GetWindowsDirectoryW

WinExec

KERNEL32.dll

USER32.dll

RegCloseKey

RegNotifyChangeKeyValue

RegCreateKeyExA

RegEnumKeyW

RegOpenKeyExA

RegOpenKeyExW

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

CertOpenStore

CertFreeCertificateContext

CertAddCertificateContextToStore

CertCloseStore

PFXImportCertStore

CertEnumCertificatesInStore

CRYPT32.dll

NETAPI32.dll

SHLWAPI.dll

IPHLPAPI.DLL

MSVCRT.dll

GetProcessHeap

RegCreateKeyA

CryptImportKey

CryptDestroyKey

HttpSendRequestExA

HttpQueryInfoA

HttpOpenRequestA

HttpEndRequestA

HttpAddRequestHeadersA

HttpSendRequestA

WININET.dll

7&7,747:7

.pdata

@.reloc

SHELL32.DLL

msvcrt.dll

DelegateExecute

%s\%s.txt

iexplore.exe

firefox.exe

explorer.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

spoolsv.exe_1448_rwx_00F40000_00014000:

.text

.rdata

@.data

.reloc

u.Sh8

KERNEL32.DLL

%u(%u)

user32.dll

kernelbase.dll

\notepad.exe

iertutil.dll

Content-Type: application/x-www-form-urlencoded

aSHELL32.DLL

hXXp://

hXXps://

PID: %u [%0.2u:%0.2u:%0.2u]

ntdll.dll

dbghelp.dll

\%u.dmp

GetWindowsDirectoryA

GetWindowsDirectoryW

WinExec

KERNEL32.dll

USER32.dll

RegCloseKey

RegNotifyChangeKeyValue

RegCreateKeyExA

RegEnumKeyW

RegOpenKeyExA

RegOpenKeyExW

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

CertOpenStore

CertFreeCertificateContext

CertAddCertificateContextToStore

CertCloseStore

PFXImportCertStore

CertEnumCertificatesInStore

CRYPT32.dll

NETAPI32.dll

SHLWAPI.dll

IPHLPAPI.DLL

MSVCRT.dll

GetProcessHeap

RegCreateKeyA

CryptImportKey

CryptDestroyKey

HttpSendRequestExA

HttpQueryInfoA

HttpOpenRequestA

HttpEndRequestA

HttpAddRequestHeadersA

HttpSendRequestA

WININET.dll

7&7,747:7

DelegateExecute

%s\%s.txt

iexplore.exe

firefox.exe

explorer.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

Explorer.EXE_1684_rwx_00ED0000_00027000:

c:\%original file name%.exe

.text

.rdata

@.data

.reloc

u.Sh8

KERNEL32.DLL

%u(%u)

user32.dll

kernelbase.dll

\notepad.exe

iertutil.dll

Content-Type: application/x-www-form-urlencoded

aSHELL32.DLL

hXXp://

hXXps://

PID: %u [%0.2u:%0.2u:%0.2u]

ntdll.dll

dbghelp.dll

\%u.dmp

GetWindowsDirectoryA

GetWindowsDirectoryW

WinExec

KERNEL32.dll

USER32.dll

RegCloseKey

RegNotifyChangeKeyValue

RegCreateKeyExA

RegEnumKeyW

RegOpenKeyExA

RegOpenKeyExW

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

CertOpenStore

CertFreeCertificateContext

CertAddCertificateContextToStore

CertCloseStore

PFXImportCertStore

CertEnumCertificatesInStore

CRYPT32.dll

NETAPI32.dll

SHLWAPI.dll

IPHLPAPI.DLL

MSVCRT.dll

GetProcessHeap

RegCreateKeyA

CryptImportKey

CryptDestroyKey

HttpSendRequestExA

HttpQueryInfoA

HttpOpenRequestA

HttpEndRequestA

HttpAddRequestHeadersA

HttpSendRequestA

WININET.dll

7&7,747:7

.pdata

@.reloc

SHELL32.DLL

msvcrt.dll

DelegateExecute

%s\%s.txt

iexplore.exe

firefox.exe

explorer.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

jqs.exe_1972_rwx_010B0000_00027000:

c:\%original file name%.exe

.text

.rdata

@.data

.reloc

u.Sh8

KERNEL32.DLL

%u(%u)

user32.dll

kernelbase.dll

\notepad.exe

iertutil.dll

Content-Type: application/x-www-form-urlencoded

aSHELL32.DLL

hXXp://

hXXps://

PID: %u [%0.2u:%0.2u:%0.2u]

ntdll.dll

dbghelp.dll

\%u.dmp

GetWindowsDirectoryA

GetWindowsDirectoryW

WinExec

KERNEL32.dll

USER32.dll

RegCloseKey

RegNotifyChangeKeyValue

RegCreateKeyExA

RegEnumKeyW

RegOpenKeyExA

RegOpenKeyExW

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

CertOpenStore

CertFreeCertificateContext

CertAddCertificateContextToStore

CertCloseStore

PFXImportCertStore

CertEnumCertificatesInStore

CRYPT32.dll

NETAPI32.dll

SHLWAPI.dll

IPHLPAPI.DLL

MSVCRT.dll

GetProcessHeap

RegCreateKeyA

CryptImportKey

CryptDestroyKey

HttpSendRequestExA

HttpQueryInfoA

HttpOpenRequestA

HttpEndRequestA

HttpAddRequestHeadersA

HttpSendRequestA

WININET.dll

7&7,747:7

.pdata

@.reloc

SHELL32.DLL

msvcrt.dll

DelegateExecute

%s\%s.txt

iexplore.exe

firefox.exe

explorer.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

Explorer.EXE_1684_rwx_01FF0000_00014000:

.text

.rdata

@.data

.reloc

u.Sh8

KERNEL32.DLL

%u(%u)

user32.dll

kernelbase.dll

\notepad.exe

iertutil.dll

Content-Type: application/x-www-form-urlencoded

aSHELL32.DLL

hXXp://

hXXps://

PID: %u [%0.2u:%0.2u:%0.2u]

ntdll.dll

dbghelp.dll

\%u.dmp

GetWindowsDirectoryA

GetWindowsDirectoryW

WinExec

KERNEL32.dll

USER32.dll

RegCloseKey

RegNotifyChangeKeyValue

RegCreateKeyExA

RegEnumKeyW

RegOpenKeyExA

RegOpenKeyExW

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

CertOpenStore

CertFreeCertificateContext

CertAddCertificateContextToStore

CertCloseStore

PFXImportCertStore

CertEnumCertificatesInStore

CRYPT32.dll

NETAPI32.dll

SHLWAPI.dll

IPHLPAPI.DLL

MSVCRT.dll

GetProcessHeap

RegCreateKeyA

CryptImportKey

CryptDestroyKey

HttpSendRequestExA

HttpQueryInfoA

HttpOpenRequestA

HttpEndRequestA

HttpAddRequestHeadersA

HttpSendRequestA

WININET.dll

7&7,747:7

DelegateExecute

%s\%s.txt

iexplore.exe

firefox.exe

explorer.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

jqs.exe_1972_rwx_011E0000_00014000:

.text

.rdata

@.data

.reloc

u.Sh8

KERNEL32.DLL

%u(%u)

user32.dll

kernelbase.dll

\notepad.exe

iertutil.dll

Content-Type: application/x-www-form-urlencoded

aSHELL32.DLL

hXXp://

hXXps://

PID: %u [%0.2u:%0.2u:%0.2u]

ntdll.dll

dbghelp.dll

\%u.dmp

GetWindowsDirectoryA

GetWindowsDirectoryW

WinExec

KERNEL32.dll

USER32.dll

RegCloseKey

RegNotifyChangeKeyValue

RegCreateKeyExA

RegEnumKeyW

RegOpenKeyExA

RegOpenKeyExW

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

CertOpenStore

CertFreeCertificateContext

CertAddCertificateContextToStore

CertCloseStore

PFXImportCertStore

CertEnumCertificatesInStore

CRYPT32.dll

NETAPI32.dll

SHLWAPI.dll

IPHLPAPI.DLL

MSVCRT.dll

GetProcessHeap

RegCreateKeyA

CryptImportKey

CryptDestroyKey

HttpSendRequestExA

HttpQueryInfoA

HttpOpenRequestA

HttpEndRequestA

HttpAddRequestHeadersA

HttpSendRequestA

WININET.dll

7&7,747:7

DelegateExecute

%s\%s.txt

iexplore.exe

firefox.exe

explorer.exe

chrome.exe

\System32\KERNEL32.DLL

\System32\kernelbase.dll

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps