not-a-virus:AdWare.Win32.AdLoad.cmzq (Kaspersky), mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Adware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: cd8fa2b9267480f91c4535548e452dd1
SHA1: a5504cd1a714de5dc2f578ae16f296b7df9ed501
SHA256: 763b19f24011844445e74a8e3012fd08b5f26ad14bd8f7583e90e85a59a5b436
SSDeep: 24576:b9ZglK8bi6kAVe15IMxNT/2C4HIPJXd y/pQEzDOtEHJp:xOlK8biYVevIMxNT/jEIPJsRE9H
Size: 1156396 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: ArcadeYum
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit
Summary: Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The not-a-virus creates the following process(es):
%original file name%.exe:224
The not-a-virus injects its code into the following process(es):No processes have been created.
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:224 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\setup.dll (17312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\b_setup.exe (7304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\conf (113 bytes)
The not-a-virus deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\NSISdl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\conf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp (0 bytes)
Registry activity
The process %original file name%.exe:224 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 34 39 CB 7F 32 B8 7D 34 54 76 E6 58 20 A5 E9"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsq2.tmp\,"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KN Launcher v1.404" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\b_setup.exe"
Dropped PE files
MD5 | File path |
---|---|
093cdbfc8738ec61f7f44be2c4f4bf26 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\b_setup.exe |
21a1832d5342ad9f1fd8f384bdd326b5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\local.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:224
- Delete the original not-a-virus file.
- Delete or disinfect the following files created/modified by the not-a-virus:
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\setup.dll (17312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\b_setup.exe (7304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\conf (113 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KN Launcher v1.404" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\b_setup.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23628 | 24064 | 4.46394 | 856b32eb77dfd6fb67f21d6543272da5 |
.rdata | 28672 | 4764 | 5120 | 3.4982 | dc77f8a1e6985a4361c55642680ddb4f |
.data | 36864 | 154712 | 1024 | 3.3278 | 7922d4ce117d7d5b3ac2cffe4b0b5e4f |
.ndata | 192512 | 45056 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 237568 | 2536 | 2560 | 3.13983 | 2f680908cecb63b3d2f77e5b6d01b658 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 374
87af60575e95350381303447cd2e0d96
297ea80c532f1e653b6bfad9b0f5bdcb
c64333ff5aa15b72d05f9604fd5b650c
8bc5e8828e0f2dc2bc636874594512d0
15399070593f311505d112b9c4738605
6cad8969964bda9bf93648e4f8d842c4
bf9d2df7b005ab40b413f9eba9589b95
9462c92f54151d6f6faee759d0be457f
dd4634c10a37abc7eee65626c3f19cc7
2470a83a4efffe5d4f7832796432ea53
94f281f53ee0859ab9149c10edc88c92
a7b0dca6353427d531a8ce0b66b26a97
30aed6ed499070bc8e5e51d344c1a95a
8889fd1e4a22e8889acd6cb5f84a09ef
c685088f98412256f79b5543271e05ac
963c31e06f4225bd2429170fd3aff7a9
64c6973d72291eab7854539f30f9f6a1
45b35960177593434ca2b2ca6369937b
4a0d0f8af2e5d8c0e06cbfb912999f6c
4234d117dbf9631d6aedad5885379529
9aaf75732b4fc9ed9eedf9a2be53a5f3
2374b95b6959a23b52ac0cedb91f00ec
34576348082ca0f7ecf90f9c6c915bb2
d7d364e641aee1a451b06864d56071f6
927e35e041ef04c831591c2facfab7ec
Network Activity
URLs
URL | IP |
---|---|
hxxp://pe-wine.club/launch_reb.php?p=sevenzip&pid=1248&tid=3829454&b_typ=pe | 46.21.100.248 |
hxxp://launch.keicraft.net/version.php | 198.252.98.64 |
hxxp://launch.keicraft.net/disallowed.php | 198.252.98.64 |
hxxp://d1gahxamcuu9d3.cloudfront.net/stub_maker.php?program=sevenzip&tid=3829454&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot | |
hxxp://tadly.fc-greed.website/stub_maker.php?program=sevenzip&tid=3829454&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot | 54.230.200.248 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /launch_reb.php?p=sevenzip&pid=1248&tid=3829454&b_typ=pe HTTP/1.0
Host: pe-wine.club
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Date: Thu, 19 Feb 2015 03:45:36 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 113
Connection: close
Content-Type: text/html; charset=UTF-8
s=boot..u=hXXp://tadly.fc-greed.website/stub_maker.php?program=sevenzip&tid=3829454&pid=1248&b_typ=pe&reb=1&name=..
GET /stub_maker.php?program=sevenzip&tid=3829454&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot HTTP/1.0
Host: tadly.fc-greed.website
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Content-Type: application/force-download
Content-Length: 80156
Connection: close
Server: Microsoft-IIS/7.5
X-Powered-By: PHP/5.3.28
Content-Disposition: attachment; filename="54e55c381d2f0.exe"
X-Powered-By: ASP.NET
Date: Thu, 19 Feb 2015 03:44:56 GMT
X-Cache: Miss from cloudfront
Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: xRTnUgkS9D2z8ACa2VjeJfLEhBzeDYk5t83q-Jr-o3OTO38f50D4Wg==
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................Z...........0.......p....@..........................................................................s...........@...........................................................................p...............................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data...x............p..............@....ndata...@...@...........................rsrc....@.......B...t..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[...U.
<<< skipped >>>
GET /disallowed.php HTTP/1.1
User-Agent: Mozilla/4.76
Host: launch.keicraft.net
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
HTTP/1.1 200 OK
Date: Thu, 19 Feb 2015 03:45:37 GMT
Server: LiteSpeed
Connection: close
X-Powered-By: PHP/5.3.29
Content-Type: text/html
Content-Length: 70
keiaxx.rushnett.thefluffywalrus.mrsfluffywalrus.viera_zhai.hellwind9o9..
GET /version.php HTTP/1.1
User-Agent: Mozilla/4.76
Host: launch.keicraft.net
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
HTTP/1.1 200 OK
Date: Thu, 19 Feb 2015 03:45:36 GMT
Server: LiteSpeed
Connection: close
X-Powered-By: PHP/5.3.29
Content-Type: text/html
Content-Length: 369
1.602..An update is available for the KeiNett Launcher (Now Shiginima)!..hXXp://adfoc.us/24689750985770Launcher Website..hXXp://adfoc.us/2468971..#NOTES..Line 1: The current latest version of the launcher...Line 2: Text on the first line of the update notice...Line 3: The update location/url..Line 4: The button underneath logout..Line 5: The link the button goes to..
Map
The not-a-virus connects to the servers at the folowing location(s):
Strings from Dumps
javaw.exe_336:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
/Xusage.txt
/Xusage.txt
-Djava.class.path=%s
-Djava.class.path=%s
Unable to locate JRE meeting specification "%s"
Unable to locate JRE meeting specification "%s"
1.6.0_18-b07
1.6.0_18-b07
JRE-Version = %s, JRE-Restrict-Search = %s Selected = %s
JRE-Version = %s, JRE-Restrict-Search = %s Selected = %s
Syntax error in version specification "%s"
Syntax error in version specification "%s"
Invalid or corrupt jarfile %s
Invalid or corrupt jarfile %s
Unable to access jarfile %s
Unable to access jarfile %s
-Djava.awt.headless=
-Djava.awt.headless=
-Djava.awt.headless=true
-Djava.awt.headless=true
option[-] = '%s'
option[-] = '%s'
ignoreUnrecognized is %s,
ignoreUnrecognized is %s,
sun.jnu.encoding
sun.jnu.encoding
isSupported
isSupported
-Dsun.java.command=
-Dsun.java.command=
-Dsun.java.launcher=SUN_STANDARD
-Dsun.java.launcher=SUN_STANDARD
A %c separated list of directories, JAR archives,
A %c separated list of directories, JAR archives,
load Java programming language agent, see java.lang.instrument
load Java programming language agent, see java.lang.instrument
The default VM is %s%s
The default VM is %s%s
is a synonym for the "%s" VM [deprecated]
is a synonym for the "%s" VM [deprecated]
to select the "%s" VM
to select the "%s" VM
Usage: %s [-options] class [args...]
Usage: %s [-options] class [args...]
(to execute a class)
(to execute a class)
or %s [-options] -jar jarfile [args...]
or %s [-options] -jar jarfile [args...]
(to execute a jar file)
(to execute a jar file)
Can't open %s
Can't open %s
Could not find the main class: %s. Program will exit.
Could not find the main class: %s. Program will exit.
Failed to load Main Class: %s
Failed to load Main Class: %s
Could not find the main class: %s. Program will exit.
Could not find the main class: %s. Program will exit.
argv[-] = '%s'
argv[-] = '%s'
Apps' argc is %d
Apps' argc is %d
Main-Class is '%s'
Main-Class is '%s'
Warning: %s VM not supported; %s VM will be used
Warning: %s VM not supported; %s VM will be used
Error: %s VM not supported
Error: %s VM not supported
Error: Unable to resolve VM alias %s
Error: Unable to resolve VM alias %s
Error: Corrupt jvm.cfg file; cycle in alias list.
Error: Corrupt jvm.cfg file; cycle in alias list.
Default VM: %s
Default VM: %s
%s requires class path specification
%s requires class path specification
%s full version "%s"
%s full version "%s"
Warning: %s option is no longer supported.
Warning: %s option is no longer supported.
-Xrunhprof:cpu=old,file=java.prof
-Xrunhprof:cpu=old,file=java.prof
-Xrunhprof:cpu=old,file=%s
-Xrunhprof:cpu=old,file=%s
%ld micro seconds to parse jvm.cfg
%ld micro seconds to parse jvm.cfg
name: %s vmType: %s alias: %s
name: %s vmType: %s alias: %s
name: %s vmType: %s server_class: %s
name: %s vmType: %s server_class: %s
jvm.cfg[%d] = ->%s
jvm.cfg[%d] = ->%s
Warning: unknown VM type on line %d of `%s'
Warning: unknown VM type on line %d of `%s'
Warning: missing server class VM on line %d of `%s'
Warning: missing server class VM on line %d of `%s'
Warning: missing VM alias on line %d of `%s'
Warning: missing VM alias on line %d of `%s'
Warning: missing VM type on line %d of `%s'
Warning: missing VM type on line %d of `%s'
Warning: no leading - on line %d of `%s'
Warning: no leading - on line %d of `%s'
Error: could not open `%s'
Error: could not open `%s'
\jvm.cfg
\jvm.cfg
\bin\splashscreen.dll
\bin\splashscreen.dll
%s\jvm.dll
%s\jvm.dll
%s\bin\%s\jvm.dll
%s\bin\%s\jvm.dll
Version major.minor.micro = %s.%s
Version major.minor.micro = %s.%s
Failed reading value of registry key:
Failed reading value of registry key:
Software\JavaSoft\Java Runtime Environment\%s\JavaHome
Software\JavaSoft\Java Runtime Environment\%s\JavaHome
Error opening registry key 'Software\JavaSoft\Java Runtime Environment\%s'
Error opening registry key 'Software\JavaSoft\Java Runtime Environment\%s'
Registry key 'Software\JavaSoft\Java Runtime Environment\CurrentVersion'
Registry key 'Software\JavaSoft\Java Runtime Environment\CurrentVersion'
has value '%s', but '1.6' is required.
has value '%s', but '1.6' is required.
Error opening registry key 'Software\JavaSoft\Java Runtime Environment'
Error opening registry key 'Software\JavaSoft\Java Runtime Environment'
-Dsun.java2d.opengl
-Dsun.java2d.opengl
-Dsun.java2d.d3d
-Dsun.java2d.d3d
-Dsun.java2d.noddraw
-Dsun.java2d.noddraw
-Dsun.awt.warmup
-Dsun.awt.warmup
Unable to resolve path to current %s executable: %s
Unable to resolve path to current %s executable: %s
CreateProcess(%s, ...) failed: %s
CreateProcess(%s, ...) failed: %s
ReExec Args: %s
ReExec Args: %s
ReExec Command: %s (%s)
ReExec Command: %s (%s)
ExecJRE: new: %s
ExecJRE: new: %s
ExecJRE: old: %s
ExecJRE: old: %s
Error: could not find java.dll
Error: could not find java.dll
JRE path is %s
JRE path is %s
%s\jre\bin\java.dll
%s\jre\bin\java.dll
%s\bin\java.dll
%s\bin\java.dll
Error loading: %s
Error loading: %s
CRT path is %s
CRT path is %s
\bin\msvcr71.dll
\bin\msvcr71.dll
EnsureJreInstallation:%s:load failed
EnsureJreInstallation:%s:load failed
\bin\jkernel.dll
\bin\jkernel.dll
EnsureJreInstallation::not found
EnsureJreInstallation::not found
EnsureJreInstallation:unsupported platform
EnsureJreInstallation:unsupported platform
Error: can't find JNI interfaces in: %s
Error: can't find JNI interfaces in: %s
JVM path is %s
JVM path is %s
\bin\awt.dll
\bin\awt.dll
\bin\java.dll
\bin\java.dll
\bin\verify.dll
\bin\verify.dll
Error: no `%s' JVM at `%s'.
Error: no `%s' JVM at `%s'.
Error: no known VMs. (check for corrupt jvm.cfg file)
Error: no known VMs. (check for corrupt jvm.cfg file)
before: "%s"
before: "%s"
after : "%s"
after : "%s"
META-INF/MANIFEST.MF
META-INF/MANIFEST.MF
1.1.3
1.1.3
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
mscoree.dll
mscoree.dll
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
kernel32.dll
kernel32.dll
- This application cannot run using the active version of the Microsoft .NET Runtime
- This application cannot run using the active version of the Microsoft .NET Runtime
Please contact the application's support team for more information.
Please contact the application's support team for more information.
GetProcessWindowStation
GetProcessWindowStation
user32.dll
user32.dll
internal state. The program cannot safely continue execution and must
internal state. The program cannot safely continue execution and must
continue execution and must now be terminated.
continue execution and must now be terminated.
C:\BUILD_~1\jdk6_18\control\build\WINDOW~1\tmp\java\javaw\obj\javaw.pdb
C:\BUILD_~1\jdk6_18\control\build\WINDOW~1\tmp\java\javaw\obj\javaw.pdb
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegEnumKeyA
RegEnumKeyA
ADVAPI32.dll
ADVAPI32.dll
USER32.dll
USER32.dll
GetCPInfo
GetCPInfo
KERNEL32.dll
KERNEL32.dll
%Program Files%\Java\jre6\bin\javaw.exe
%Program Files%\Java\jre6\bin\javaw.exe
name="javaw.exe"
name="javaw.exe"
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
3333333333330
3333333333330
333333333307
333333333307
PP%d(jjjjj
PP%d(jjjjj
6.0.180.7
6.0.180.7
javaw.exe
javaw.exe