not-a-virus:AdWare.Win32.BetterSurf.b (Kaspersky), Gen:Variant.Adware.Symmi.43685 (AdAware)Behaviour: Adware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 9ac2819d8d52bdff4656d71389747c6c
SHA1: 90d2772ea748dcf5404dd2f9743b82d7a231c143
SHA256: 12536cfeeace4d00c649715f678ff30bca086eef66f288cddf4099380a644c84
SSDeep: 12288:DRSAnNXG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BTq4ya/QTcJ8ePx/b5uO7ALvHXAU:D4oXG4GQm4OaHYJ8eP4D5uOHBBm4yaed
Size: 673736 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Appsinstall
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit
Summary: Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The PUP creates the following process(es):
%original file name%.exe:1252
The PUP injects its code into the following process(es):No processes have been created.
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1252 makes changes in the file system.
The PUP creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2.tmp\aminsis.dll (12792 bytes)
The PUP deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsn1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2.tmp\aminsis.dll (0 bytes)
Registry activity
The process %original file name%.exe:1252 makes changes in the system registry.
The PUP creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE E7 5F CD 1F B9 38 79 8C 6A AD 98 1F 31 95 B3"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc2.tmp\aminsis.dll,"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
Dropped PE files
| MD5 | File path |
|---|---|
| 450753ad96785a240a39deccab3af0d0 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsc2.tmp\aminsis.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1252
- Delete the original PUP file.
- Delete or disinfect the following files created/modified by the PUP:
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2.tmp\aminsis.dll (12792 bytes)
Static Analysis
VersionInfo
Company Name: Rich Media View
Product Name: Rich Media View release 484
Product Version: 1.1
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.1
File Description:
Comments:
Language: Language Neutral
Company Name: Rich Media ViewProduct Name: Rich Media View release 484Product Version: 1.1Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 1.1File Description: Comments: Language: Language Neutral
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 23628 | 24064 | 4.46394 | 856b32eb77dfd6fb67f21d6543272da5 |
| .rdata | 28672 | 4764 | 5120 | 3.4982 | dc77f8a1e6985a4361c55642680ddb4f |
| .data | 36864 | 154712 | 1024 | 3.3278 | 7922d4ce117d7d5b3ac2cffe4b0b5e4f |
| .ndata | 192512 | 45056 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .rsrc | 237568 | 3144 | 3584 | 2.93155 | 9e32741be4c51069007cf0c37b983f2f |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 131
22896c2530bfc5c51b1ebdf948693ee1
9ce321523274d078ae76b858aa433a62
5fe38bad8e5a32f44298fcda50141777
b1be454f65a009e28acbd68a45d99d81
54cc3f1ec749c18037b2102cf1045937
1541a1013daa7ab5c46743e907d1bd12
dfdeea0d7c0ebddd905374d2fabdca8d
b7859d7d82d62eecf5130eca0acff970
c131d7bd1f738d156a2b7273503ac98c
35c6cf7ff88b36099ab73a83faf74922
b48294711bfdc64d620c27ecda37142d
1d45264f391ceb347662c060142f9dbd
e5a115003cb58031dbd688e8959287bb
382f80be1320326a254130652f9ccf02
f7cb71358efe6a9fe1cd1f86ca0895f1
5b690feae04d3337d04d8e779d84c53e
de8879da602249e4040acc5680942c9f
37b63a19d4ac3557a8b5cd3307ad2d82
a8f318fb99d7f565ab86e77e3f9a14af
4fa744c5a2d0b40bf23768a65b0c4f06
c5fe7b573cc0bb84f59a0243be07fd0e
a746001470b122c02ace2e6fab6ede53
6bf36093a9bfc2ee79a13b2389762e1b
eaa5e1b357a04665441e4564388092e4
e21f498d85ab20375dc75dc677a5bb91
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The PUP connects to the servers at the folowing location(s):