Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\nsu9849.tmp\BI.exe' { "user_ie_security_level" : "" , "json_send_time" : "15/4/2013 19:26:26:787" , "internal_error_description" : "HttpPost result: try1- Cannot load xml file %TEMP%\nsu9849.tmp\offer.xml; try2- Cannot load xml file %TEMP%\nsu9849.tmp\offer.xml; try3- Cannot load xml file %TEMP%\nsu9849.tmp\offer.xml" , "internal_error_number" : "3" , "is_parallel" : "0" , "vector_id" : "" , "rule_id" : "" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "612030" , "general_status_code" : "3" , "duration_details" : " InitPluginsDir:15 initializeParams:203 load_BITool:16 send_BI_Init:93 load_DownloadACC:47 retrieveUISource:16 unpack_webappfolder:1248 unpack_icon:15 RetrieveMainOfferKey:0 unpack_OpenCandyDll:156 load_webapphost:16 unpack_ProxyInstaller:31 navigate_loadingUI:156 navigateAsync_constMainOffer:609 BuildUserProfile:31 retrieve cid:15 callService1:13588 callService1:2527 callService1:1888 " , "phase_duration" : "" , "error_details" : "Error Parsing the offer xml response file" , "result" : "Error" , "user_operating_system_bits" : "" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "" , "user_acount_type" : "" , "user_ie_version" : "" , "user_default_browser_version" : "" , "user_default_browser" : "" , "user_service_pack" : "" , "user_operating_system" : "" , "revision_number" : "3" , "build_id" : "00000000" , "dm_version" : "1.3.7.8_HF8" , "bundle_id" : "f0261ff0-9adf-45be-9484-1e9e88e2e46d" , "machine_user_id" : "{596B7712-A934-4AB9-AEA1-5B522CBC74EC}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "7E13F512-AC32-4C50-9042-B265CEC9A6E7" , "publisher_internal_id" : "27" , "publisher_id" : "Avi Goldfinger" , "publisher_account_id" : "Avi_Goldfinger" , "order" : "2.0" , "phase" : "InitComplete" , "Is_Test" : "0" }
- '%TEMP%\nsu9849.tmp\BI.exe' { "json_send_time" : "15/4/2013 19:26:6:335" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "612030" , "user_type" : "NULL" , "result" : "Success" , "user_operating_system_bits" : "" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "" , "user_acount_type" : "" , "user_ie_version" : "" , "user_default_browser_version" : "" , "user_default_browser" : "" , "user_service_pack" : "" , "user_operating_system" : "" , "revision_number" : "3" , "build_id" : "00000000" , "dm_version" : "1.3.7.8_HF8" , "bundle_id" : "f0261ff0-9adf-45be-9484-1e9e88e2e46d" , "machine_user_id" : "{596B7712-A934-4AB9-AEA1-5B522CBC74EC}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "7E13F512-AC32-4C50-9042-B265CEC9A6E7" , "publisher_internal_id" : "27" , "publisher_id" : "Avi Goldfinger" , "publisher_account_id" : "Avi_Goldfinger" , "order" : "1.0" , "phase" : "Init" , "Is_Test" : "0" }
Запускает на исполнение:
- '<SYSTEM32>\conhost.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsu9849.tmp\WebApp\Js\json2debug.js
- %TEMP%\nsu9849.tmp\WebApp\Js\json2minified.js
- %TEMP%\nsu9849.tmp\WebApp\Js\json2.js
- %TEMP%\nsu9849.tmp\WebApp\Js\jquery-ui-1.8.16.custom.min.js
- %TEMP%\nsu9849.tmp\WebApp\Js\jquery.min.js
- %TEMP%\nsu9849.tmp\OCSetupHlp.dll
- %TEMP%\nsu9849.tmp\ProxyInstaller.exe
- %TEMP%\nsu9849.tmp\icon.png
- %TEMP%\nsu9849.tmp\WebApp\Js\script.js
- %TEMP%\nsu9849.tmp\WebApp\Js\xml2json.js
- %TEMP%\nsu9849.tmp\WebApp\Images\truste.png
- %TEMP%\nsu9849.tmp\WebApp\Js\API.js
- %TEMP%\nsu9849.tmp\WebApp\Images\myiweb-logo.png
- %TEMP%\nsu9849.tmp\WebApp\Images\loaderb64-transparent.gif
- %TEMP%\nsu9849.tmp\WebApp\Images\myiweb-logo.jpg
- %TEMP%\nsu9849.tmp\WebApp\Js\ProgressBar.js
- %TEMP%\nsu9849.tmp\WebApp\Js\Store.js
- %TEMP%\nsu9849.tmp\WebApp\Js\PIE.htc
- %TEMP%\nsu9849.tmp\WebApp\Js\DD_belatedPNG_0.0.8a-min.js
- %TEMP%\nsu9849.tmp\WebApp\Js\ExternalParams.js
- %TEMP%\nsu9849.tmp\inetc.dll
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\error[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\warning[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\error[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\bullet[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\jquery.min[1].js
- %WINDIR%\Temp\MPTelemetrySubmit\watson_manifest.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_80070422_76a4385aa7fdcd3dc476f7ea51e8ea5565f02fd_0a6c4375\Report.wer
- %WINDIR%\Temp\MPTelemetrySubmit\client_manifest.txt
- %TEMP%\nsfEE36.tmp\inetc.dll
- %TEMP%\nsfEE36.tmp\a.txt
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\611579[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\navcancl[1]
- %TEMP%\nsu9849.tmp\xml.dll
- %TEMP%\nsp9DA6.tmp\a.txt
- %TEMP%\nsu9849.tmp\offer.xml
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\info_48[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\background_gradient[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\httpErrorPagesScripts[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\ErrorPageTemplate[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\errorPageStrings[1]
- %TEMP%\nsu9849.tmp\WebApp\Images\conduit-logo.png
- %TEMP%\nsu9849.tmp\WebApp\Css\Buttons.rtl.css
- %TEMP%\nsu9849.tmp\WebApp\Css\Copy of Buttons.css
- %TEMP%\nsu9849.tmp\WebApp\Css\Buttons.ltr.css
- %TEMP%\nsu9849.tmp\WebApp\SilentSuccess.htm
- %TEMP%\nsu9849.tmp\WebApp\Css\Buttons.css
- %TEMP%\nsu9849.tmp\WebApp\Css\css.ltr.css
- %TEMP%\nsu9849.tmp\WebApp\Css\css.rtl.css
- %TEMP%\nsu9849.tmp\WebApp\Css\css.css
- %TEMP%\nsu9849.tmp\WebApp\Css\PIE.htc
- %TEMP%\nsu9849.tmp\WebApp\Css\Reset.css
- %TEMP%\nsu9849.tmp\DownloadACC.exe
- %TEMP%\nsu9849.tmp\WebApp\Failed.htm
- %TEMP%\nsu9849.tmp\BI.exe
- %TEMP%\nsu9849.tmp\System.dll
- %TEMP%\nsu9849.tmp\webapphost.dll
- %TEMP%\nsu9849.tmp\WebApp\ProgressBar.htm
- %TEMP%\nsu9849.tmp\WebApp\Reset.css
- %TEMP%\nsu9849.tmp\WebApp\PIE.htc
- %TEMP%\nsu9849.tmp\WebApp\Loading.htm
- %TEMP%\nsu9849.tmp\WebApp\NoneSilentSuccess.htm
- %TEMP%\nsu9849.tmp\WebApp\Images\-.png
- %TEMP%\nsu9849.tmp\WebApp\Images\NextButton_Sprite wide.png
- %TEMP%\nsu9849.tmp\WebApp\Images\X.png
- %TEMP%\nsu9849.tmp\WebApp\Images\Nana10.png
- %TEMP%\nsu9849.tmp\WebApp\Images\InstallationSuccessful.png
- %TEMP%\nsu9849.tmp\WebApp\Images\InternetTurbo.png
- %TEMP%\nsu9849.tmp\WebApp\Images\button_grey_close.png
- %TEMP%\nsu9849.tmp\WebApp\Images\check-V.png
- %TEMP%\nsu9849.tmp\WebApp\Images\button.png
- %TEMP%\nsp9DA6.tmp\inetc.dll
- %TEMP%\nsu9849.tmp\WebApp\Images\bla.png
- %TEMP%\nsu9849.tmp\WebApp\Images\BG.png
- %TEMP%\nsu9849.tmp\WebApp\Images\BoxBg.png
- %TEMP%\nsu9849.tmp\WebApp\Images\7b8e0568-0fe5-4a3a-8e70-8815c89b56ef.png
- %TEMP%\nsu9849.tmp\WebApp\Images\01Net-Logo.jpg
- %TEMP%\nsu9849.tmp\WebApp\Images\1JPJ.jpg
- %TEMP%\nsu9849.tmp\WebApp\Images\CancelBGGoogleDialog.png
- %TEMP%\nsu9849.tmp\WebApp\Images\InstallationFailed.png
- %TEMP%\nsu9849.tmp\WebApp\Images\CancelBG.png
- %TEMP%\nsu9849.tmp\WebApp\Images\BoxBgNew.png
- %TEMP%\nsu9849.tmp\WebApp\Images\BrotherSoft.png
Удаляет следующие файлы:
- %TEMP%\nsfEE36.tmp\inetc.dll
- %WINDIR%\Temp\MPTelemetrySubmit\watson_manifest.txt
- %WINDIR%\Temp\MPTelemetrySubmit\client_manifest.txt
- %TEMP%\nsp9DA6.tmp\a.txt
- %TEMP%\nsp9DA6.tmp\inetc.dll
- %TEMP%\nsfEE36.tmp\a.txt
Сетевая активность:
Подключается к:
- 'cm#.########tionengine.conduit-services.com':80
- 'aj##.#oogleapis.com':80
- '20#.#6.232.182':80
- 'localhost':58119
- 'ud#.###duit-data.com':80
- 'of######.#######.distributionengine.conduit-services.com':80
TCP:
Запросы HTTP GET:
- aj##.#oogleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js
- cm#.########tionengine.conduit-services.com//MainOffer/611579/?Cu##############################################
Запросы HTTP POST:
- ud#.###duit-data.com/
UDP:
- DNS ASK cm#.########tionengine.conduit-services.com
- DNS ASK aj##.#oogleapis.com
- DNS ASK wa####.microsoft.com
- DNS ASK of######.#######.distributionengine.conduit-services.com
- DNS ASK ud#.###duit-data.com
- '22#.0.0.252':5355
