Adware.Generic.356429_182cca2697 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Adware's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Adware creates the following process(es):

taskkill.exe:616
taskkill.exe:828
taskkill.exe:1196
sc.exe:1016
rundll32.exe:1672
%original file name%.exe:1156
cacls.exe:1632
cacls.exe:260

The Adware injects its code into the following process(es):

6.exe:1524
QvodSetupPlus3.0.exe:580

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process 6.exe:1524 makes changes in the file system.

The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QvodSetupPlus.exe.!qd (1691 bytes)
C:\ (4 bytes)
%System%\func.dll (18563831 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (8 bytes)
C:\autorun.inf (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (1186 bytes)
%System%\drivers\etc\hosts (5 bytes)
%WinDir% (1364 bytes)
C:\$Directory (212 bytes)
%System%\dllcache (4 bytes)
%WinDir%\inf (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\config\systemprofile (4 bytes)
%System%\drivers\pcidump.sys (5404535 bytes)
%System%\config (100 bytes)
%System%\drivers (296 bytes)
%WinDir%\phpq.dll (22141559 bytes)
%Documents and Settings%\%current user% (4 bytes)
%System%\CatRoot2 (96 bytes)
C:\1.exe (31 bytes)
%System% (5960 bytes)

The process rundll32.exe:1672 makes changes in the file system.

The Adware creates and/or writes to the following file(s):

%System%\drivers\acpiec.sys (14 bytes)

The process %original file name%.exe:1156 makes changes in the file system.

The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\6.exe (438 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QvodSetupPlus3.0.exe (3497 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse1.tmp (0 bytes)

The process QvodSetupPlus3.0.exe:580 makes changes in the file system.

The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qd.ini (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QvodSetupPlus.exe.!qd (627712 bytes)

Registry activity

The process taskkill.exe:616 makes changes in the system registry.

The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 0B 07 5E EF 13 77 70 5A 86 EC C5 0B 00 99 6E"

The process taskkill.exe:828 makes changes in the system registry.

The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 70 03 FF 2C B8 30 3F 67 35 D5 67 1C BF 19 01"

The process taskkill.exe:1196 makes changes in the system registry.

The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 4D D1 98 F9 BF C9 CF 21 C3 A4 32 2F 2A 8B 8C"

The process sc.exe:1016 makes changes in the system registry.

The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 F8 77 B3 8E 62 1B D1 3D C5 7C A8 69 38 98 7B"

The process rundll32.exe:1672 makes changes in the system registry.

The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AB 82 72 17 54 6A 39 8C 29 31 9A C2 6A 6F E6 EA"

The process %original file name%.exe:1156 makes changes in the system registry.

The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F 77 3C A5 C7 07 F2 D0 03 4C 0D B0 3B B1 8B FA"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"6.exe" = "Windows Calculator"
"QvodSetupPlus3.0.exe" = "QvodInstall Module"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process QvodSetupPlus3.0.exe:580 makes changes in the system registry.

The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 03 A9 9E A0 A8 BE 74 DC D8 F5 80 C5 62 6B 45"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp]
"QvodSetupPlus3.0.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\QvodSetupPlus3.0.exe:*:Enabled:QVOD"

The process cacls.exe:1632 makes changes in the system registry.

The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E7 9F 58 4F F0 6B 38 23 8A 21 81 9B B4 F5 89 72"

The process cacls.exe:260 makes changes in the system registry.

The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D FA 98 9A 97 FC 32 C4 FD BE 4B CF F1 B2 F0 3B"

Dropped PE files

MD5	File path
23ba6d3c5d60d0cead4a6d7862e390cd	c:\1.exe
23ba6d3c5d60d0cead4a6d7862e390cd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\6.exe
813a50e98c2713fe162850040e6d4288	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\QvodSetupPlus3.0.exe
8d455599edebbc0ff48815b217eee92f	c:\WINDOWS\LastGood\system32\drivers\acpiec.sys
5d531fbfc935b26c156150b39a4867e6	c:\WINDOWS\phpq.dll
9859c0f6936e723e4892d7141b1327d5	c:\WINDOWS\system32\dllcache\acpiec.sys
8d455599edebbc0ff48815b217eee92f	c:\WINDOWS\system32\drivers\OLD4.tmp
601b3f2466bfa6989b9c7586b5ba54aa	c:\WINDOWS\system32\drivers\pcidump.sys
ccbc41cc2644f7d52b7034fd5c35b0cb	c:\WINDOWS\system32\func.dll

HOSTS file anomalies

The Adware modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 5743 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	v.onondown.com.cn
127.0.0.2	ymsdasdw1.cn
127.0.0.3	h96b.info
127.0.0.0	fuck.zttwp.cn
127.0.0.0	www.hackerbf.cn
127.0.0.0	geekbyfeng.cn
127.0.0.0	121.14.101.68
127.0.0.0	ppp.etimes888.com
127.0.0.0	www.bypk.com
127.0.0.0	CSC3-2004-crl.verisign.com
127.0.0.1	va9sdhun23.cn
127.0.0.0	udp.hjob123.com
127.0.0.2	bnasnd83nd.cn
127.0.0.0	www.gamehacker.com.cn
127.0.0.0	gamehacker.com.cn
127.0.0.3	adlaji.cn
127.0.0.1	858656.com
127.1.1.1	bnasnd83nd.cn
127.0.0.1	my123.com
127.0.0.0	user1.12-27.net
127.0.0.1	8749.com
127.0.0.0	fengent.cn
127.0.0.1	4199.com
127.0.0.1	user1.16-22.net
127.0.0.1	7379.com
127.0.0.1	2be37c5f.3f6e2cc5f0b.com
127.0.0.1	7255.com
127.0.0.1	user1.23-12.net
127.0.0.1	3448.com
127.0.0.1	www.guccia.net
127.0.0.1	7939.com
127.0.0.1	a.o1o1o1.nEt
127.0.0.1	8009.com
127.0.0.1	user1.12-73.cn
127.0.0.1	piaoxue.com
127.0.0.1	3n8nlasd.cn
127.0.0.1	kzdh.com
127.0.0.0	www.sony888.cn
127.0.0.1	about.blank.la
127.0.0.0	user1.asp-33.cn
127.0.0.1	6781.com
127.0.0.0	www.netkwek.cn
127.0.0.1	7322.com
127.0.0.0	ymsdkad6.cn
127.0.0.0	www.lkwueir.cn
127.0.0.1	06.jacai.com
127.0.1.1	user1.23-17.net
127.0.0.1	1.jopenkk.com
127.0.0.0	upa.luzhiai.net
127.0.0.1	1.jopenqc.com
127.0.0.0	www.guccia.net
127.0.0.1	1.joppnqq.com
127.0.0.0	4m9mnlmi.cn
127.0.0.1	1.xqhgm.com
127.0.0.0	mm119mkssd.cn
127.0.0.1	100.332233.com
127.0.0.0	61.128.171.115:8080
127.0.0.1	121.11.90.79
127.0.0.0	www.1119111.com
127.0.0.1	121565.net
127.0.0.0	win.nihao69.cn
127.0.0.1	125.90.88.38
127.0.0.1	16888.6to23.com
127.0.0.1	2.joppnqq.com
127.0.0.0	puc.lianxiac.net
127.0.0.1	204.177.92.68
127.0.0.0	pud.lianxiac.net
127.0.0.1	210.74.145.236
127.0.0.0	210.76.0.133
127.0.0.1	219.129.239.220
127.0.0.0	61.166.32.2
127.0.0.1	219.153.40.221
127.0.0.0	218.92.186.27
127.0.0.1	219.153.46.27
127.0.0.0	www.fsfsfag.cn
127.0.0.1	219.153.52.123
127.0.0.0	ovo.ovovov.cn
127.0.0.1	221.195.42.71
127.0.0.0	dw.com.com
127.0.0.1	222.73.218.115
127.0.0.1	203.110.168.233:80
127.0.0.1	3.joppnqq.com
127.0.0.1	203.110.168.221:80
127.0.0.1	363xx.com
127.0.0.1	www1.ip10086.com.cm
127.0.0.1	4199.com
127.0.0.1	blog.ip10086.com.cn
127.0.0.1	43242.com
127.0.0.1	www.ccji68.cn
127.0.0.1	5.xqhgm.com
127.0.0.0	t.myblank.cn
127.0.0.1	520.mm5208.com
127.0.0.0	x.myblank.cn
127.0.0.1	59.34.131.54
127.0.0.1	210.51.45.5
127.0.0.1	59.34.198.228
127.0.0.1	www.ew1q.cn
127.0.0.1	59.34.198.88
127.0.0.1	59.34.198.97
127.0.0.1	60.190.114.101
127.0.0.1	60.190.218.34
127.0.0.0	qq-xing.com.cn
127.0.0.1	60.191.124.252
127.0.0.1	61.145.117.212
127.0.0.1	61.157.109.222
127.0.0.1	75.126.3.216
127.0.0.1	75.126.3.217
127.0.0.1	75.126.3.218
127.0.0.0	59.125.231.177:17777
127.0.0.1	75.126.3.220
127.0.0.1	75.126.3.221
127.0.0.1	75.126.3.222
127.0.0.1	772630.com
127.0.0.1	832823.cn
127.0.0.1	8749.com
127.0.0.1	888.jopenqc.com
127.0.0.1	89382.cn
127.0.0.1	8v8.biz
127.0.0.1	97725.com
127.0.0.1	9gg.biz
127.0.0.1	www.9000music.com
127.0.0.1	test.591jx.com
127.0.0.1	a.topxxxx.cn
127.0.0.1	picon.chinaren.com
127.0.0.1	www.5566.net
127.0.0.1	p.qqkx.com
127.0.0.1	news.netandtv.com
127.0.0.1	z.neter888.cn
127.0.0.1	b.myblank.cn
127.0.0.1	wvw.wokutu.com
127.0.0.1	unionch.qyule.com
127.0.0.1	www.qyule.com
127.0.0.1	it.itjc.cn
127.0.0.1	www.linkwww.com
127.0.0.1	vod.kaicn.com
127.0.0.1	www.tx8688.com
127.0.0.1	b.neter888.cn
127.0.0.1	promote.huanqiu.com
127.0.0.1	www.huanqiu.com
127.0.0.1	www.haokanla.com
127.0.0.1	play.unionsky.cn
127.0.0.1	www.52v.com
127.0.0.1	www.gghka.cn
127.0.0.1	icon.ajiang.net
127.0.0.1	new.ete.cn
127.0.0.1	www.stiae.cn
127.0.0.1	o.neter888.cn
127.0.0.1	comm.jinti.com
127.0.0.1	www.google-analytics.com
127.0.0.1	hz.mmstat.com
127.0.0.1	www.game175.cn
127.0.0.1	x.neter888.cn
127.0.0.1	z.neter888.cn
127.0.0.1	p.etimes888.com
127.0.0.1	hx.etimes888.com
127.0.0.1	abc.qqkx.com
127.0.0.1	dm.popdm.cn
127.0.0.1	www.yl9999.com
127.0.0.1	www.dajiadoushe.cn
127.0.0.1	v.onondown.com.cn
127.0.0.1	www.interoo.net
127.0.0.1	bally1.bally-bally.net
127.0.0.1	www.bao5605509.cn
127.0.0.1	www.rty456.cn
127.0.0.1	www.werqwer.cn
127.0.0.1	1.360-1.cn
127.0.0.1	user1.23-16.net
127.0.0.1	www.guccia.net
127.0.0.1	www.interoo.net
127.0.0.1	upa.netsool.net
127.0.0.1	js.users.51.la
127.0.0.1	vip2.51.la
127.0.0.1	web.51.la
127.0.0.1	qq.gong2008.com
127.0.0.1	2008tl.copyip.com
127.0.0.1	tla.laozihuolaile.cn
127.0.0.1	www.tx6868.cn
127.0.0.1	p001.tiloaiai.com
127.0.0.1	s1.tl8tl.com
127.0.0.1	s1.gong2008.com
127.0.0.1	4b3ce56f9g.3f6e2cc5f0b.com

Rootkit activity

The Adware installs the following kernel-mode hooks:

ZwQuerySystemInformation

Using the driver "%System%\drivers\pcidump.sys" the Adware substitutes IRP handlers in a file system driver (NTFS) to control operations with files:

MJ_CREATE

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Adware's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
taskkill.exe:616
taskkill.exe:828
taskkill.exe:1196
sc.exe:1016
rundll32.exe:1672
%original file name%.exe:1156
cacls.exe:1632
cacls.exe:260
Delete the original Adware file.
Delete or disinfect the following files created/modified by the Adware:
%Documents and Settings%\%current user%\Local Settings\Temp\QvodSetupPlus.exe.!qd (1691 bytes)
%System%\func.dll (18563831 bytes)
C:\autorun.inf (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (1186 bytes)
%System%\drivers\etc\hosts (5 bytes)
C:\$Directory (212 bytes)
%System%\dllcache (4 bytes)
%WinDir%\inf (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\config\systemprofile (4 bytes)
%System%\drivers\pcidump.sys (5404535 bytes)
%WinDir%\phpq.dll (22141559 bytes)
%System%\CatRoot2 (96 bytes)
C:\1.exe (31 bytes)
%System%\drivers\acpiec.sys (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6.exe (438 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QvodSetupPlus3.0.exe (3497 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qd.ini (144 bytes)
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	25270	25600	4.44206	d9f48557c009a2eb7979fc10b0b362ef
.rdata	32768	4554	4608	3.66815	0562a781a8cdf5785a117a97cc7e5f02
.data	40960	269044	3072	3.33266	769f3be831c912dddacbe34424aca6cb
.ndata	311296	270336	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	581632	36864	35840	3.6078	b8650ad8ecdce55db94ff645ebd133de

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 27
655ebda89a8c316de7ce5873ff1deb61
f979ad42b1f8cf01c151d3d09a437fb6
b716149de896974bf5d514592e8c7209
268211e652c08efd0d26a3e0d668f571
b97504c04a2f6969dce449c432106672
011819f0d135f70db8601b8a6ff2677b
f045fd21b3c9462938fe27e5ee4f06a3
66e69190d8ef735a301516e348c35190
790ada328637bd837b55fbf63280816d
bfc04c03ea863ac32e915d9255c7d9b8
917a7bea1c81ec3b61eeef59c454ed84
3b962c5e68dc495b9dac718c305f1cce
5ac95b4cbac570ac3674c873669ca552
1fbd74b51c3a6f9f3cea8425d96177fc
963c483fda50e85a28f852983123eb15
e391435dfa53cd9dbfdb42fba8d059f1
5551794e263875a795c680479c97527f
4bf082ed0c0a5e6821c59f6873c506c8
6cfc96e51ddd7beb1294cb8d0836a751
4980695fdfef0015de369e969c0df056
ee881ac1ac662ffa662dd5b30fda6ab3
95759d0e94837f34197e14a949bc6525
dffa87da1c5f035a69fe01d7593329ef
61ce4dd0f1b7482b6cdbed621f45c762
e3425dd32acaa9f1830c97a82f44bc35

Network Activity

URLs

URL	IP
hxxp://b2.st.dns.kuaibo.com/qd.jpg
hxxp://b2.st.dns.kuaibo.com/QvodSetupPlus5_5.0.72_for_35.exe
hxxp://qd.qvod.com/QvodSetupPlus5_5.0.72_for_35.exe	175.6.0.104
hxxp://update.qvod.com/qd.jpg	175.6.0.106
agent.qvod.com	222.186.3.142
stun.qvod.com	60.55.32.90
track.qvod.com	222.186.3.147

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /QvodSetupPlus5_5.0.72_for_35.exe HTTP/1.1

Accept: */*

Accept-Language: zh-cn

UA-CPU: x86

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)

Host: qd.qvod.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 18 Nov 2014 21:05:42 GMT

Content-Type: application/octet-stream

Content-Length: 28536664

Connection: keep-alive

Server: nginx

Last-Modified: Tue, 06 Sep 2011 10:48:50 GMT

ETag: "4e65fa92-1b36f58"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1H..u)..u)..u)...&..w)..u)...)...&..d)...6...).../..t)..Richu)..........PE..L.....:J.................\...........2.......p....@.................................@........................................s...........b...........W...............................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data...x............r..............@....ndata...@...@...........................rsrc....b.......d...v..............@..@........................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..X...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e..9}...Dp@........FP.VT........ M............U....M....3...3..FQ......3..NU.....M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...e....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F..

<<< skipped >>>

GET /qd.jpg HTTP/1.1

Accept: application/vnd.ms-powerpoint, application/msword, */*

Accept-Language: zh-cn

Accept-Encoding: gzip, deflate

User-Agent: QvodDown

Host: update.qvod.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 18 Nov 2014 21:05:39 GMT

Content-Type: image/jpeg

Content-Length: 144

Connection: keep-alive

Server: nginx

Last-Modified: Tue, 06 Sep 2011 11:14:58 GMT

ETag: "4e6600b2-90"

Accept-Ranges: bytes

[QVODDOWN]..Name=QvodSetupPlus.exe..Hash=14109F1A7EDB0375DB868071287D19C0D1EDFA45..Httpurl=hXXp://qd.qvod.com/QvodSetupPlus5_5.0.72_for_35.exe....

Map

The Adware connects to the servers at the folowing location(s):

Strings from Dumps

QvodSetupPlus3.0.exe_580:

`.rsrc

.tTPV

u.hH.C

FTPjK

FtPj;

F.PjRWj

u.WWj

u.VVj

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

user32.dll

portuguese-brazilian

GET /%s HTTP/1.1

Accept: application/vnd.ms-powerpoint, application/msword, */*

Host: %s

%s (%s)

Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.

%s %.2f GB

%s %.2f MB

%s %I64d KB

%s %I64d Byte

Httpurl

hXXp://update.qvod.com/qd.jpg

%s\qd.ini

%s\%s

%s_1.%s

QvodSetupPlus.exe

hXXp://

QVODd2I64X

tcp connecting limit is %d

\drivers\tcpip.sys

stun01.sipphone.com

stun.qvod.com

61.139.219.200

track.qvod.com

TCP Port

61.139.219.203

221.194.134.216

agent.qvod.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)

Range: bytes=%u-

Port Restricted Nat

, random port

, preserves ports

PWindowsFirewallAppIsEnabled failed: 0xlx

M-SEARCH * HTTP/1.1

HOST: 239.255.255.250:1900

controlURL

URLBase

HTTP/1.1

s:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/">

xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/"

AddPortMapping

NewPortMappingDescription

NewInternalPort

NewExternalPort

DeletePortMapping

External NAT port in use

External NAT port in use: Too many retries

Port mapping not owned by this class

Error getting StaticPortMappingCollection

problem parsing Password

Password =

ipv6 not supported

HMAC with password:

Encoding Password:

About to send msg of len

Some problem opening port/interface to send on

POST /service HTTP/1.1

Content-Length: %d

Host: %s:%d

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;)

127.0.0.1

recv %d

Opened port

Port

for receiving UDP is in use

Could not bind UDP receive port

Could not create a UDP socket:

err EAFNOSUPPORT in send

zcÃ

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\QvodSetupPlus3.0.exe

GetCPInfo

.text

`.rdata

@.data

.rsrc

@.MNe|

version="5.1.0.0"

name="test.exe"/>

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

ole32.dll

OLEAUT32.dll

SHELL32.dll

USER32.dll

VERSION.dll

WS2_32.dll

.torrent

: %d K/S

%s ...

%s...

3, 0, 0, 0

QvodInstall.exe

QvodSetupPlus3.0.exe_580_rwx_00401000_0004A000:

.tTPV

u.hH.C

FTPjK

FtPj;

F.PjRWj

u.WWj

u.VVj

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

user32.dll

portuguese-brazilian

GET /%s HTTP/1.1

Accept: application/vnd.ms-powerpoint, application/msword, */*

Host: %s

%s (%s)

Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.

%s %.2f GB

%s %.2f MB

%s %I64d KB

%s %I64d Byte

Httpurl

hXXp://update.qvod.com/qd.jpg

%s\qd.ini

%s\%s

%s_1.%s

QvodSetupPlus.exe

hXXp://

QVODd2I64X

tcp connecting limit is %d

\drivers\tcpip.sys

stun01.sipphone.com

stun.qvod.com

61.139.219.200

track.qvod.com

TCP Port

61.139.219.203

221.194.134.216

agent.qvod.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)

Range: bytes=%u-

Port Restricted Nat

, random port

, preserves ports

PWindowsFirewallAppIsEnabled failed: 0xlx

M-SEARCH * HTTP/1.1

HOST: 239.255.255.250:1900

controlURL

URLBase

HTTP/1.1

s:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/">

xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/"

AddPortMapping

NewPortMappingDescription

NewInternalPort

NewExternalPort

DeletePortMapping

External NAT port in use

External NAT port in use: Too many retries

Port mapping not owned by this class

Error getting StaticPortMappingCollection

problem parsing Password

Password =

ipv6 not supported

HMAC with password:

Encoding Password:

About to send msg of len

Some problem opening port/interface to send on

POST /service HTTP/1.1

Content-Length: %d

Host: %s:%d

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;)

127.0.0.1

recv %d

Opened port

Port

for receiving UDP is in use

Could not bind UDP receive port

Could not create a UDP socket:

err EAFNOSUPPORT in send

zcÃ

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\QvodSetupPlus3.0.exe

GetCPInfo

.text

`.rdata

@.data

.rsrc

.torrent

: %d K/S

%s ...

%s...

6.exe_1524:

.nsp0

.nsp1

.nsp2

GetWindowsDirectoryA

WinExec

\phpq.dll

rundll32.exe func.dll, droqp

\system32\func.dll

cmd /c taskkill /im ScanFrm.exe /f

cmd /c taskkill /im egui.exe /f

cmd /c taskkill /im ekrn.exe /f

cmd /c sc config ekrn start= disabled

cmd /c cacls "%s" /e /p everyone:f

cmd /c cacls %s /e /p everyone:f

\temp\explorer.exe

\drivers\gm.dls

Explorer.EXE

explorer.EXE

EXPLORER.EXE

EXPLORER.exe

Explorer.exe

explorer.exe

GetProcAddressLoadLibraryACloseHandleGetSystemTimeGetModuleHandleASleepGetTempPathACopyFileAGetWindowsDirectoryAGetSystemDirectoryAGetModuleFileNameACreateMutexAGlobalAddAtomAOpenMutexAGlobalFindAtomAstrcpymemsetsprintfstrcatstrstrstrlen

Ci=l_[n_Msg\ifc]Fche

,-2) ) ),

,-2) ) )-

,-2) ) ).

,-2) ) )

,-,),/), ,)13

,-2),),),

,-2) ),),

1,),-3),2,),,053 3

,-,),,)4 )24

,-0)4 )33).3

- /),22)4-)13

-, )2/),/0)-.1

-, )21) ),..

-,4),-4)-.4)--

1,),11).-)-

-,4),0.)/ )--,

-,3)4-),31)-2

-,4),0.)/1)-2

-,4),0.)0-),-.

--,),40)/-)2,

---)2.)-,3),,0

- .),, ),13)-..53

- .),, ),13)--,53

.1.ss)^jh

04)./),.,)0/

-, )0,)/0)0

04)./),43)--3

04)./),43)33

04)./),43)42

1 ),4 ),,/), ,

1 ),4 )-,3)./

1 ),4,),-/)-0-

1,),/0),,2)-,-

1,),02), 4)---

20),-1).)-,1

20),-1).)-,2

20),-1).)-,3

04),-0)-.,),225,2222

20),-1).)--

20),-1).)--,

20),-1).)---

kjk.om\k)`s`

KERNEL32.DLL

MSVCRT.DLL

/-*$^%?3

Windows Calculator application file

5.1.2600.0 (xpclient.010817-1148)

CALC.EXE

Microsoft(R) Windows(R) Operating System

5.1.2600.0

6.exe_1524_rwx_00404000_00017000:

GetWindowsDirectoryA

WinExec

\phpq.dll

rundll32.exe func.dll, droqp

\system32\func.dll

cmd /c taskkill /im ScanFrm.exe /f

cmd /c taskkill /im egui.exe /f

cmd /c taskkill /im ekrn.exe /f

cmd /c sc config ekrn start= disabled

cmd /c cacls "%s" /e /p everyone:f

cmd /c cacls %s /e /p everyone:f

\temp\explorer.exe

\drivers\gm.dls

Explorer.EXE

explorer.EXE

EXPLORER.EXE

EXPLORER.exe

Explorer.exe

explorer.exe

GetProcAddressLoadLibraryACloseHandleGetSystemTimeGetModuleHandleASleepGetTempPathACopyFileAGetWindowsDirectoryAGetSystemDirectoryAGetModuleFileNameACreateMutexAGlobalAddAtomAOpenMutexAGlobalFindAtomAstrcpymemsetsprintfstrcatstrstrstrlen

Ci=l_[n_Msg\ifc]Fche

,-2) ) ),

,-2) ) )-

,-2) ) ).

,-2) ) )

,-,),/), ,)13

,-2),),),

,-2) ),),

1,),-3),2,),,053 3

,-,),,)4 )24

,-0)4 )33).3

- /),22)4-)13

-, )2/),/0)-.1

-, )21) ),..

-,4),-4)-.4)--

1,),11).-)-

-,4),0.)/ )--,

-,3)4-),31)-2

-,4),0.)/1)-2

-,4),0.)0-),-.

--,),40)/-)2,

---)2.)-,3),,0

- .),, ),13)-..53

- .),, ),13)--,53

.1.ss)^jh

04)./),.,)0/

-, )0,)/0)0

04)./),43)--3

04)./),43)33

04)./),43)42

1 ),4 ),,/), ,

1 ),4 )-,3)./

1 ),4,),-/)-0-

1,),/0),,2)-,-

1,),02), 4)---

20),-1).)-,1

20),-1).)-,2

20),-1).)-,3

04),-0)-.,),225,2222

20),-1).)--

20),-1).)--,

20),-1).)---

kjk.om\k)`s`

KERNEL32.DLL

MSVCRT.DLL

Windows Calculator application file

5.1.2600.0 (xpclient.010817-1148)

CALC.EXE

Microsoft(R) Windows(R) Operating System

5.1.2600.0

rundll32.exe_1672:

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

IMAGEHLP.dll

rundll32.pdb

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

Windows

Operating System

5.1.2600.5512

YThere is not enough memory to run the file %s.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Missing entry:%s

Error loading %s

6.exe_1524_rwx_10000000_00001000:

.data

.rsrc

@.reloc

psapi.dll

\patch.exe

\dstdisk.exe

\defence.exe

192yuioealdjfiefjsdfas.txt

%SystemRoot%\System32\DRIVERS\puid.sys

\drivers\pcidump.sys

System32\DRIVERS\pcidump.sys

%SystemRoot%\system32\drivers\puid.sys

\\.\pcidump

\drivers\gm.dls

Windows

1.exe

autorun.inf

Open=1.exe

urlmon

\setup.exe

?mac=%s&ver=%s&key=%d&os=windows

.html

.hhqg

qq.exe

360safe.exe

\explorer.exe

\temp\explorer.exe

nfect_exe

6.exe_1524_rwx_10005000_00001000:

\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\6.exe

\??\%WinDir%\explorer.exe

ers\gm.dls

WinExec

CreatePipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

ADVAPI32.dll

InternetOpenUrlA

WININET.dll

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps