Adware.InstallBrain.E_7be67642cc – Adaware

Adware.InstallBrain.E (B) (Emsisoft), Adware.InstallBrain.E (AdAware), Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan, Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 7be67642cc7852c0d2c4f274a5a1fc52

SHA1: d92fb52878422c6d88cbdaf437001f3dff17cd31

SHA256: 829a391ca54388a463252be6f962a8fc679511740a48304197bb1fcdfe01db65

SSDeep: 24576:Q1Qfopqg hXi6kgaINVD4W7CS7YsXDV6YkHzr9jWp04tDhGOjbvD/ XbdeXcKAgn:Q1wgqXiTcNV7CS7bkY8xWa4tDfDmXbdY

Size: 1229376 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: FreePDFReader

Created at: 2014-08-20 11:24:30

Analyzed on: WindowsXP SP3 32-bit

Summary: Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Adware creates the following process(es):

tmppack.exe:1152
2.tmp:1948

The Adware injects its code into the following process(es):

%original file name%.exe:348

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process tmppack.exe:1152 makes changes in the file system.

The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AWBEOTPUKSUHT\installer.pak (9606 bytes)

The process %original file name%.exe:348 makes changes in the file system.

The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AWBEOTPUKSUHT\tmppack.exe (3806 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\lbg.gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\b3.gif (384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\lbg-bottom.gif (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~17A.tmp (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\js\smart.js (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4182.html (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\corn3.png (138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\3631.html (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\check.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\pb-bg-right.jpg (468 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\FindamoA.html (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\logo.png (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\btn2.png (402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\center2.jpg (305 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\red-pb-act.jpg (380 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\mask.bmp (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ajax-loader2.gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4177.html (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\b-bg.gif (295 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\trust.gif (437 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\portal_more.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\lbg-top.gif (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\pb-bg-left.jpg (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\main.css (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\conditions\conditions.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ajax-loader.gif (3 bytes)
%System%\wbem\Logs\wbemprox.log (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\btn.png (716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (6403 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\js\config.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\arrow.png (911 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4185.html (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\corn4.png (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4183.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\pb-bg.jpg (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\mnbgouxuah (2019 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\events\events.js (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\mid.jpg (403 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\events\cav.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\red-pb-act-left.jpg (681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\template_40.png (110 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\js\jquery-1.7.min.js (94 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4178.html (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\red-pb-act-right.jpg (694 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\arrow.gif (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4187.html (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\js\utils.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4393.html (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\corn2.png (136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\corn1.png (139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4184.html (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\b4.gif (661 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4186.html (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\js\jquery.noselect.min.js (299 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\wizard.xml (7 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AWBEOTPUKSUHT (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (0 bytes)

The process 2.tmp:1948 makes changes in the file system.

The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\broker\broker_check.log (185281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\broker\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\broker\timing.dat (121 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\broker\ping.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\broker\postback.xml (50 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\broker\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\broker (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\broker\postback.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\broker\ping.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\broker\timing.dat (0 bytes)

Registry activity

The process tmppack.exe:1152 makes changes in the system registry.

The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A D7 4B 00 29 97 3B AC 58 06 CF C6 C9 EA 4F 1D"

The process %original file name%.exe:348 makes changes in the system registry.

The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014091620140917]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014091620140917]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014091620140917\"
"CachePrefix" = ":2014091620140917:"

[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014091620140917]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB 82 99 4A 89 77 1A A3 BF 6E 05 F3 A9 27 BD A7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014091620140917]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "C:\%original file name%.exe:*:Enabled:%original file name%.exe (in)"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The process 2.tmp:1948 makes changes in the system registry.

The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\usyndication.com]
"UID" = "{A26615F2-F641-4A57-9AD5-AAC193559B0A}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 15 D3 CC 5C C9 98 68 4C 30 96 A3 5E B6 4C DA"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
d2f31d4bcb2f93e137eed54a8f4c8874	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\AWBEOTPUKSUHT\tmppack.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
tmppack.exe:1152
2.tmp:1948
Delete the original Adware file.
Delete or disinfect the following files created/modified by the Adware:
%Documents and Settings%\%current user%\Local Settings\Temp\AWBEOTPUKSUHT\installer.pak (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AWBEOTPUKSUHT\tmppack.exe (3806 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\lbg.gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\b3.gif (384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\lbg-bottom.gif (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~17A.tmp (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\js\smart.js (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4182.html (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\corn3.png (138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\3631.html (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\check.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\pb-bg-right.jpg (468 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\FindamoA.html (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\logo.png (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\btn2.png (402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\center2.jpg (305 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\red-pb-act.jpg (380 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\mask.bmp (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ajax-loader2.gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4177.html (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\b-bg.gif (295 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\trust.gif (437 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\portal_more.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\lbg-top.gif (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\pb-bg-left.jpg (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\main.css (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\conditions\conditions.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ajax-loader.gif (3 bytes)
%System%\wbem\Logs\wbemprox.log (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\btn.png (716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (6403 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\js\config.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\arrow.png (911 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4185.html (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\corn4.png (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4183.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\pb-bg.jpg (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\mnbgouxuah (2019 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\events\events.js (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\mid.jpg (403 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\events\cav.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\red-pb-act-left.jpg (681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\template_40.png (110 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\js\jquery-1.7.min.js (94 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4178.html (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\red-pb-act-right.jpg (694 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\arrow.gif (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4187.html (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\js\utils.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4393.html (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\corn2.png (136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\corn1.png (139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4184.html (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\ib\b4.gif (661 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\4186.html (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\gui\js\jquery.noselect.min.js (299 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g10lf362a3q\wizard.xml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\broker\broker_check.log (185281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\broker\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\broker\timing.dat (121 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\broker\ping.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\broker\postback.xml (50 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: FreePDFReader
Product Name: FreePDFReader
Product Version: 14.9.4.9
Legal Copyright: Copyright 2014
Legal Trademarks:
Original Filename: FreePDFReaderSetup.exe
Internal Name: FreePDFReader
File Version: 14.9.4.9
File Description: FreePDFReader
Comments:
Language: Language Neutral

Company Name: FreePDFReaderProduct Name: FreePDFReaderProduct Version: 14.9.4.9Legal Copyright: Copyright 2014Legal Trademarks: Original Filename: FreePDFReaderSetup.exeInternal Name: FreePDFReaderFile Version: 14.9.4.9File Description: FreePDFReaderComments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	104629	104960	4.6194	35bfe041447fb17fa9acc812d0e2adc9
.rdata	110592	24590	25088	3.33258	bbf6aef730ab011386cb5902492c433a
.data	139264	15584	7168	2.97177	4b8ca0a5afa58f0e3de48f99bdedf965
.reloc	155648	10904	11264	3.04895	8d8d7d79d76d95252ab764cb82951f48
.rsrc	167936	1073152	1073152	5.38503	4dff6575936e4230e78a72010955bdaa

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://ibbalance.ib.netdna-cdn.com/files/components/Yahoo_w3i.exe
hxxp://usyndication.com/api/productsession	66.77.96.160
hxxp://usyndication.com/api/trackofferinstalldetails	66.77.96.160
hxxp://usyndication.com/api/installerror	66.77.96.160
hxxp://api.ibario.com/events	174.36.241.171
hxxp://cdn.softiappspeed.com/files/components/Yahoo_w3i.exe	108.161.188.128

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /events HTTP/1.1

X-Token: 1ac1acb5747d4b6db021a1ac3947003b

X-Hash: dc09d0f09d266bd233902334b9a2f57e42d5d00b

Content-transfer-encoding: binary

Content-Type: application/octet-stream

Host: api.ibario.com

Content-Length: 285

Connection: Keep-Alive

{"timestamp":"2014-09-16 04:18:27","action":"start","custom":"eyJpbnN0YWxsZXJfaWQiOiI3MzkiLCJpbnN0YWxsZXJfdmVyc2lvbiI6IjE0LjkuMy40IiwidmEiOiItMSIsInN2ZXIiOiIxLjAuMC4zIn0=","uuid":"75ed9567aa584c8ea8ea3cad7c47ab03","session":1435344,"cid":"4451","lang":"en","cert":"ets","Country":"US"}

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 16 Sep 2014 04:18:54 GMT

Content-Type: application/json

Transfer-Encoding: chunked

Connection: keep-alive

Keep-Alive: timeout=2

Vary: Accept-Encoding

X-Powered-By: PHP/5.4.13

Access-Control-Allow-Origin: *

27..{"flash":{},"error":false,"status":200}..0......

POST /events HTTP/1.1

X-Token: 1ac1acb5747d4b6db021a1ac3947003b

X-Hash: 080dbdb3e164f3d818ec2436a2df83330636e4b3

Content-transfer-encoding: binary

Content-Type: application/octet-stream

Host: api.ibario.com

Content-Length: 303

Connection: Keep-Alive

{"timestamp":"2014-09-16 04:18:27","action":"show","component_id":686,"custom":"eyJpbnN0YWxsZXJfaWQiOiI3MzkiLCJpbnN0YWxsZXJfdmVyc2lvbiI6IjE0LjkuMy40IiwidmEiOiItMSIsInN2ZXIiOiIxLjAuMC4zIn0=","uuid":"75ed9567aa584c8ea8ea3cad7c47ab03","session":1435344,"cid":"4451","lang":"en","cert":"ets","Country":"US"}

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 16 Sep 2014 04:18:54 GMT

Content-Type: application/json

Transfer-Encoding: chunked

Connection: keep-alive

Keep-Alive: timeout=2

Vary: Accept-Encoding

X-Powered-By: PHP/5.4.13

Access-Control-Allow-Origin: *

27..{"flash":{},"error":false,"status":200}..0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 16 Sep 2014 04:18:54 GMT..Content-Type: application/json..Transfer-Encoding: chunked..Connection: keep-alive..Keep-Alive: timeout=2..Vary: Accept-Encoding..X-Powered-By: PHP/5.4.13..Access-Control-Allow-Origin: *..27..{"flash":{},"error":false,"status":200}..0..

POST /api/productsession HTTP/1.1

Content-Type: application/json; charset=utf-8

Accept: application/xml

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Host: usyndication.com

Content-Length: 115

Cache-Control: no-cache

{"CampaignName":"4451","AccountId":"14115","Detection":true,"Offers":true,"PartnerCode":"7663","ShortName":"yahoo"}

HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: application/xml; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 16 Sep 2014 04:18:51 GMT

Content-Length: 1246

<response>.. <productsessionid>9712b41f-4a84-4d82-9dd4-f2d1ceefd9f7</productsessionid>.. <config>.. <host>host</host>.. <month>9</month>.. <year>2014</year>.. <week>38</week>.. <campaignid>8888434</campaignid>.. <campaignname>4451</campaignname>.. <vendorid>7663</vendorid>.. <accountid>14115</accountid>.. <country>UA</country>.. <countryid>804</countryid>.. <ipaddress>193.138.244.231</ipaddress>.. <pingurl>hXXp://usyndication.com/api/productsession</pingurl>.. <postbackurl>hXXp://usyndication.com/api/trackofferinstalldetails</postbackurl>.. <errorurl>hXXp://usyndication.com/api/installerror</errorurl>.. <detectiontype>internal</detectiontype>.. <processtype>dynamic</processtype>.. </config>.. <offers />.. <restrictedoffers>.. <restrictedoffer>.. <offerid>19668</offerid>.. <offername>yahoo.brokerage.toolbar</offername>.. <restriction>CountryRestriction</restriction>.. </restrictedoffer>.. <restrictedoffer>.. <offerid>19669</offerid>.. <offername>yahoo.brokerage.defaultsearch</offername>.. <restriction>CountryRestriction</restriction>.. </restrictedoffer>.. </restrictedoffers>.. <detec

<<< skipped >>>

POST /api/trackofferinstalldetails HTTP/1.1

Content-Type: application/json; charset=utf-8

Accept: application/xml

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Host: usyndication.com

Content-Length: 778

Cache-Control: no-cache

{"ProductSession":{"Session":{"AccountId":14115,"IPAddress":"193.138.244.231","CampaignId":8888434,"CampaignName":"4451","Country":"UA","CountryId":804},"ProductSessionId":"9712b41f-4a84-4d82-9dd4-f2d1ceefd9f7"},"Offers":[],"InstallTechProfile":{"OSId":5,"DefaultBrowserId":4,"LangId":1033},"InstallDetail":{"ParentProcess":"%original file name%.exe","ReturnCodeId":460,"InstallUnique":true,"InstallerVersion":"2.0.8.0","WindowsErrorCode":13},"ParentsDetected":[],"instfields":[{"Key":"pproc4","Value":"rc=460,os=5,ver=2.0.8.0,v=7663,a=14115,pp=%original file name%.exe"},{"Key":"BrokerResult2","Value":"460,13,WINXP,ie,default,ie,2.0.8.0,7663,14115"},{"Key":"BrokerTiming1","Value":"460,13,WINXP,ie,2.0.8.0,7663,0.16,0.15,0.844,0.0,-1,-1,-1,-1,-1,-1"}]}

HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: application/xml; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 16 Sep 2014 04:18:52 GMT

Content-Length: 50

<response>.. <success>true</success>..</response>....

POST /api/installerror HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Host: usyndication.com

Content-Length: 5434

Cache-Control: no-cache

Hostname=OB 2.0.8.0&Type=460&Message=7663, No detection rules were loaded!, l=0x0409&StatusCode=13&Source=browser.ie&Detail=L1:2014.09.16_07:18:25.0904[0798] ------------------------------------------------------------------------------------------------------------

L1:2014.09.16_07:18:25.0904[0798] Offer Broker 2.0.8.0 started...

L1:2014.09.16_07:18:25.0904[0798] commandLine=/check /campaign=4451

L1:2014.09.16_07:18:25.0904[0798] check=1

L1:2014.09.16_07:18:25.0904[0798] offers=

L1:2014.09.16_07:18:25.0904[0798] Checking system settings...

L1:2014.09.16_07:18:25.0904[0798] default browser registry value="C(file path)iexplore.exe" -nohome

L1:2014.09.16_07:18:25.0904[0798] target os=Microsoft Windows XP Service Pack 3 (Build 2600)

L1:2014.09.16_07:18:25.0904[0798] target language=0x0409

L1:2014.09.16_07:18:25.0904[0798] target browser=ie

L1:2014.09.16_07:18:25.0904[0798] default browser=ie

L1:2014.09.16_07:18:25.0904[0798] System check finished.

L1:2014.09.16_07:18:25.0904[0798] Loading configuration...

L1:2014.09.16_07:18:25.0904[0798] detectiontype=internal

L1:2014.09.16_07:18:25.0904[0798] processtype=dynamic

L1:2014.09.16_07:18:25.0904[0798] pingurl=hXXp://usyndication.com/api/productsession

L1:2014.09.16_07:18:25.0904[0798] post

HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: application/json; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 16 Sep 2014 04:18:52 GMT

Content-Length: 29

{"Response":{"success":true}}HTTP/1.1 200 OK..Cache-Control: no-cache..Pragma: no-cache..Content-Type: application/json; charset=utf-8..Expires: -1..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 16 Sep 2014 04:18:52 GMT..Content-Length: 29..{"Response":{"success":true}}..

GET /files/components/Yahoo_w3i.exe HTTP/1.1

Host: cdn.softiappspeed.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 16 Sep 2014 04:18:50 GMT

Content-Type: application/octet-stream

Content-Length: 962216

Connection: keep-alive

Last-Modified: Mon, 25 Mar 2013 10:24:34 GMT

Server: NetDNA-cache/2.2

Expires: Wed, 17 Sep 2014 04:18:50 GMT

Cache-Control: max-age=86400

X-Cache: HIT

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Mi...............p#.(....p2.J.....(..............p5......p%..............p<.p....Z"......p'.....Rich....................PE..L...E.HQ.............................P.......P....@.......................................@..................................H.......0.......................... p...T...............................................P...............................text............................... ..`.text-co.P.......R.................. ..`.text-co>.... ...................... ..`.text-ti.....0...................... ..`.text-co............................ ..`.text-co.(.......*.................. ..`.text-co.0.......2.................. ..`.text-cowU...@...V.................. ..`.text-coH............>.............. ..`.rdata.......P......................@..@.data....N...`...*..................@....data-co............. ..............@....data-co4............"..............@....data-co(............$..............@....data-co(............&..............@....data-co(............(..............@....data-cot............*..............@....data-ti.............6..............@....data-co..... .......<..............@....rsrc........0.......>..............@..@.reloc..............................@..B.........................................................................................................................................................................................

<<< skipped >>>

Map

The Adware connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_348:

.text

`.rdata

@.data

.reloc

B.rsrc

xSSSh

C.PjRV

FTPjKS

FtPj;S

operator

portuguese-brazilian

GetProcessWindowStation

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

GetProcessHeap

KERNEL32.dll

USER32.dll

GDI32.dll

SHLWAPI.dll

GetCPInfo

zcÃ

4 5-575

2#2'2 2/23272

?4?@?\?{?

8"8)888{8

0%0X0h0y0

>!>'>>>_>

4/585?5]5

4%4 40464

#&-4 1@9

.sxdata

.rsrc

OLEAUT32.dll

MSVCRT.dll

-p{Password}: set Password

Data Error in encrypted file. Wrong password?

CRC Failed in encrypted file. Wrong password?

Unsupported Method

Can not open encrypted archive. Wrong password?

Enter password (will not be echoed):

;jMI6.KA

.voZ"vU

]4;%u/

.EWM3

|.rgl

Y5.zY

C*.*j/

.Zw\X

I.yuTX

J%sE0

Rp.ka8

rw.dp{HV

z.muPN

/X.eG

O.DN;&M

H&%fM[

4.hs>

*\G@%d@V

].Lm\n

2.ONd

2x.eQq

iUrl

Tcu.KtwK

0.Jtb

v%DN

r'h%x

i.Xg&

t.sfL

.ytvg

.fUI5

|QM%c

]=1y*%5X

.RQe@

6>.iz

"e%Sk

-;Ãhy

keyc]

I%UD/ J1

.vd%H

fm.cP

'J%Cv

G}%CQ

t.wYnT

.uEv

???( @

???(`$??

!"#$%&'()* ,-./0123456789:;?

?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????%u

@?)~@?)}

?;2 >;2 >;2!?;2!>;2!>;2!?;2!>;2 >;2 ?;1 >:1 ?:0

?=;8?:2'>;3)?;4*?=7.?=7.>;5,?><:>

?7, ?8/&?8/&?6

k* -s}}|xkik%('.s,'kik*,;=s,=:kik

s!==9sff*-'g:&/= (99:9,,-g*&$kik ('-&&s}y}}|xkik ( 0%&'sx{}|qzkik/ '-($&sykik9; *,.&'.sykik*&'-

GoDaddy.com, Inc.1301

*hXXp://certificates.godaddy.com/repository100.

'Go Daddy Secure Certification Authority1

079692870

ler.pak

\tmppack.exe

Ael32.dll

akernel32.dll

KERNEL32.DLL

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

c:\%original file name%.exe

7z.sfx

7z.sfx.exe

installer.pak

14.9.4.9

FreePDFReaderSetup.exe

%original file name%.exe_348_rwx_00F10000_00001000:

.text

`.rdata

@.data

.rsrc

@.reloc

%original file name%.exe_348_rwx_0108F000_00004000:

4Ac:\%original file name%.exe