Gen.Variant.Adware.Multiplug.1_e36762725e

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The PUP creates the following process(es):

%original file name%.exe:348

The PUP injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:348 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\hr@L.edu\bootstrap.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\hr@L.edu\install.rdf (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\XH23GUgVow24nz.x64.dll (1793 bytes)
%Program Files%\YoutUbEADBlocke\XH23GUgVow24nz.dat (260 bytes)
%Program Files%\YoutUbEADBlocke\XH23GUgVow24nz.tlb (259 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\XH23GUgVow24nz.tlb (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\XH23GUgVow24nz.dll (1733 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\hr@L.edu\content\bg.js (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\hr@L.edu\chrome.manifest (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\6jKLVFBZJhNWYXf.dat (4 bytes)
%Program Files%\YoutUbEADBlocke\XH23GUgVow24nz.dll (15792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\hr@L.edu\content\Xq1Cdd.js (48 bytes)

Registry activity

The process %original file name%.exe:348 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2C EB 55 4A 4E 95 9F D9 CA 75 52 FF 58 D1 44 BE"

[HKCU\Software\RegisteredApplicationsEx]
"be075a9a67245af7441d7cd5a303c86c" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

Dropped PE files

MD5	File path
374367ba293ed2c64cb7bfc4d1fe1417	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\3ca84668\XH23GUgVow24nz.dll
54e21b7dae36a033b7e663765a15b095	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\3ca84668\XH23GUgVow24nz.x64.dll
374367ba293ed2c64cb7bfc4d1fe1417	c:\Program Files\YoutUbEADBlocke\XH23GUgVow24nz.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:348

2. Delete the original PUP file.
   
3. Delete or disinfect the following files created/modified by the PUP:

   %Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\hr@L.edu\bootstrap.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\hr@L.edu\install.rdf (600 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\XH23GUgVow24nz.x64.dll (1793 bytes)
   %Program Files%\YoutUbEADBlocke\XH23GUgVow24nz.dat (260 bytes)
   %Program Files%\YoutUbEADBlocke\XH23GUgVow24nz.tlb (259 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\XH23GUgVow24nz.tlb (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\XH23GUgVow24nz.dll (1733 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\hr@L.edu\content\bg.js (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\hr@L.edu\chrome.manifest (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\6jKLVFBZJhNWYXf.dat (4 bytes)
   %Program Files%\YoutUbEADBlocke\XH23GUgVow24nz.dll (15792 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\3ca84668\hr@L.edu\content\Xq1Cdd.js (48 bytes)

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	924985	925184	4.32261	a00ec84db2ed3212c206cd1f660fa265
.rdata	929792	32780	33280	3.80373	f3b003a7c9e54738a430e7b7a550a934
.data	966656	1753660	1743360	5.51375	87b093acff447d3ff639395a796bffed
.rsrc	2723840	760	1024	3.13167	6479e75d0cc909e43eefbc6b907f4940
.reloc	2727936	30606	30720	4.37435	a6a23aaacad84fe20f6df84571da9170

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The PUP connects to the servers at the folowing location(s):

Strings from Dumps