Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Modifies file system
Creates the following files
- %TEMP%\nsw2.tmp\cabsetup.dll
- %TEMP%\dlg\ui\common\progress\img\icon.png
- %TEMP%\dlg\ui\common\progress\img\img1.png
- %TEMP%\dlg\ui\common\progress\img\progress-bar.png
- %TEMP%\dlg\ui\common\progress\img\progress.png
- %TEMP%\dlg\ui\common\progress\js\jquery-1.10.2.min.js
- %TEMP%\dlg\ui\offers\99f0e44f2bd76ac0515a2606a8fb84ab\uifile.zip.part
- %TEMP%\dlg\ui\common\last\last.zip.part
- %TEMP%\dlg\ui\common\progress\img\br-lb.png
- %TEMP%\dlg\ui\common\progress\img\br-rb.png
- %TEMP%\dlg\ui\offers\99f0e44f2bd76ac0515a2606a8fb84ab\index.html
- %TEMP%\dlg\ui\offers\99f0e44f2bd76ac0515a2606a8fb84ab\js\jquery-1.10.2.min.js
- %TEMP%\dlg\ui\common\last\index.html
- %TEMP%\dlg\ui\common\last\css\style.css
- %TEMP%\dlg\ui\common\last\img\img1.png
- %TEMP%\dlg\ui\common\last\js\jquery-1.10.2.min.js
- %TEMP%\dlg\ui\common\base\base.zip.part
- %TEMP%\dlg\ui\common\base\index.html
- %TEMP%\dlg\ui\offers\99f0e44f2bd76ac0515a2606a8fb84ab\css\style.css
- %TEMP%\dlg\ui\offers\99f0e44f2bd76ac0515a2606a8fb84ab\img\img1.png
- %TEMP%\dlg\ui\common\progress\img\br-bg.png
- %TEMP%\dlg\ui\common\progress\img\br-b.png
- %TEMP%\dlg\ui\common\progress\img\bar-rb.png
- %TEMP%\dlg3.tmp
- %TEMP%\dlg\initwindow\css\style.css
- %TEMP%\dlg\initwindow\noconnection.html
- %TEMP%\dlg\initwindow\progress.html
- %TEMP%\dlg\loadingimage\loadingimage.bmp
- %TEMP%\dlg\ui\common\progress\progress.zip.part
- %TEMP%\dlg\ui\offers\4bee1563f288b8178b768f312db4c273\uifile.zip.part
- %TEMP%\dlg\ui\offers\4bee1563f288b8178b768f312db4c273\index.html
- %TEMP%\nsw2.tmp\nsissetup.exe
- %TEMP%\dlg\ui\offers\4bee1563f288b8178b768f312db4c273\css\style.css
- %TEMP%\dlg\ui\offers\4bee1563f288b8178b768f312db4c273\img\progress-bar.png
- %TEMP%\dlg\ui\offers\4bee1563f288b8178b768f312db4c273\img\progress.png
- %TEMP%\dlg\ui\offers\4bee1563f288b8178b768f312db4c273\js\jquery-1.10.2.min.js
- %TEMP%\dlg\ui\common\progress\index.html
- %TEMP%\dlg\ui\common\progress\css\style.css
- %TEMP%\dlg\ui\common\progress\img\151.gif
- %TEMP%\dlg\ui\common\progress\img\bar-bg.png
- %TEMP%\dlg\ui\common\progress\img\bar-lb.png
- %TEMP%\dlg\ui\offers\4bee1563f288b8178b768f312db4c273\img\img1.png
- %TEMP%\dlg\ui\common\base\css\style.css
- %TEMP%\dlg\ui\common\base\js\jquery-1.10.2.min.js
Moves the following files
- from %TEMP%\dlg\ui\offers\4bee1563f288b8178b768f312db4c273\uifile.zip.part to %TEMP%\dlg\ui\offers\4bee1563f288b8178b768f312db4c273\uifile.zip
- from %TEMP%\dlg\ui\common\progress\progress.zip.part to %TEMP%\dlg\ui\common\progress\progress.zip
- from %TEMP%\dlg\ui\offers\99f0e44f2bd76ac0515a2606a8fb84ab\uifile.zip.part to %TEMP%\dlg\ui\offers\99f0e44f2bd76ac0515a2606a8fb84ab\uifile.zip
- from %TEMP%\dlg\ui\common\last\last.zip.part to %TEMP%\dlg\ui\common\last\last.zip
- from %TEMP%\dlg\ui\common\base\base.zip.part to %TEMP%\dlg\ui\common\base\base.zip
Modifies the following files
Network activity
Connects to
- 'az#####2.vo.msecnd.net':80
- 'dl#####figs.buzzrin.de':80
- 'dl#####sages.buzzrin.de':80
- 'sh###ware.de':80
- 'sh###ware.de':443
TCP
HTTP GET requests
- http://az#####2.vo.msecnd.net/public-source/downloadguide/downloads15-de/1.0/default/campaigns/paid+content/ui/downloads15-de-flow-5-text-en-us.zip
UDP
- DNS ASK az#####2.vo.msecnd.net
- DNS ASK dl#####figs.buzzrin.de
- DNS ASK dl#####sages.buzzrin.de
- DNS ASK sh###ware.de
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\nsw2.tmp\nsissetup.exe' -- "<File name>.exe" fd8 000002B8 00000214 {F27E8055-6B05-4977-9C5E-29BF78548A60} -Embedding
