MD5: 2fbaa6e8a4055b1a714c8bdd5b83aa97
SHA1: cf7d08c31d042b253e1113f1071dfb13e2dc2b08
SHA256: 8302113efb0077f46aad87d5448f72fe0115e86cc27cfe6a2b89c609460352d7
SSDeep: 49152:YN1HdAtQRFZaZcSZVF1/qafdBGVlWIUsRl0XxwsldR2hVwOB684T4F4fBt:YN1VR5SZB/HfdBm6DR0yT4F2
Size: 3001092 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: Windows7 SP1 32-bit

Summary:

Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Payload

No specific payload has been found.

Process activity

The Adware creates the following process(es):
No processes have been created.
The Adware injects its code into the following process(es):

setup.exe:3516
%original file name%.exe:2748

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process setup.exe:3516 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm2175.tmp (191716 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw21B4.tmp\System.dll (22 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm2174.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw21B4.tmp (0 bytes)

The process %original file name%.exe:2748 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\Y4qzFSXsu6 (211 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\launch_reb[1].htm (211 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\B (45628 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr19F5.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp (0 bytes)

Registry activity

The process %original file name%.exe:2748 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\2fbaa6e8a4055b1a714c8bdd5b83aa97_RASMANCS]
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\2fbaa6e8a4055b1a714c8bdd5b83aa97_RASAPI32]
"EnableFileTracing" = "0"
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\2fbaa6e8a4055b1a714c8bdd5b83aa97_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\2fbaa6e8a4055b1a714c8bdd5b83aa97_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\2fbaa6e8a4055b1a714c8bdd5b83aa97_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\2fbaa6e8a4055b1a714c8bdd5b83aa97_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\2fbaa6e8a4055b1a714c8bdd5b83aa97_RASMANCS]
"ConsoleTracingMask" = "4294901760"
"FileTracingMask" = "4294901760"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://dna4mm5c1mahl.cloudfront.net/launch_reb.php?p=sevenzip&tid=11598112&pid=2831&n=UG93ZXJJU08rNi42K011bHRpbGluZ3VhbCsoeDg2eDY0KStJbmNsK0tleSsrK1BvcnRhYmxlK1tTYWRlZW1QQ10=&b_typ=pe
hxxp://get.ercationiv.club/launch_reb.php?p=sevenzip&tid=11598112&pid=2831&n=UG93ZXJJU08rNi42K011bHRpbGluZ3VhbCsoeDg2eDY0KStJbmNsK0tleSsrK1BvcnRhYmxlK1tTYWRlZW1QQ10=&b_typ=pe	52.85.173.181

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers

Traffic

GET /launch_reb.php?p=sevenzip&tid=11598112&pid=2831&n=UG93ZXJJU08rNi42K011bHRpbGluZ3VhbCsoeDg2eDY0KStJbmNsK0tleSsrK1BvcnRhYmxlK1tTYWRlZW1QQ10=&b_typ=pe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: get.ercationiv.club

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 211

Connection: keep-alive

Date: Tue, 28 Feb 2017 11:13:48 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

X-Cache: Miss from cloudfront

Via: 1.1 940b367f846b05ee5d0f25268ff80731.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0tj_c5wt3rLsFYiuQ_-GolLpzUrfD0edJRZmfscKPxTcQxWdt0gptg==
s=cheat..u=hXXp://flabba.ablemicrosporoph.bid/stub_maker.php?program=s
evenzip&tid=11598112&pid=2831&b_typ=pe&reb=1&name=PowerISO+6.6+Mul
tilingual+(x86x64)+Incl+Key+++Portable+[SadeemPC%5
DHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Content-Leng
th: 211..Connection: k..

The Adware connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

hu2.iu

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\setup.exe

am=sevenzip&tid=11598112&pid=2831&b_typ=pe&reb=1&name=PowerISO+6.6+Multilingual+(x86x64)+Incl+Key+++Portable+[SadeemPC]

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\B->C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\setup.exe

ram=sevenzip&tid=11598112&pid=2831&b_typ=pe&reb=1&name=PowerISO+6.6+Multilingual+(x86x64)+Incl+Key+++Portable+[SadeemPC]

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\B

etc.dll

QfWQ*.kq?8

Thawte Certification1

hXXp://ocsp.thawte.com0

.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

hXXp://ts-ocsp.ws.symantec.com07

 hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0<

 hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,

/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D

hXXps://VVV.verisign.com/rpa0

hXXp://ocsp.verisign.com0;

/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0

<VeriSign Class 3 Public Primary Certification Authority - G50

hXXps://VVV.verisign.com/cps0*

#hXXp://logo.verisign.com/vslogo.gif04

#hXXp://crl.verisign.com/pca3-g5.crl04

hXXp://ocsp.verisign.com0

hXXp://sv.symcb.com/sv.crl0f

hXXps://d.symcb.com/cps0%

hXXps://d.symcb.com/rpa0

hXXp://sv.symcd.com0&

hXXp://sv.symcb.com/sv.crt0

hXXp://s2.symcb.com0

hXXp://VVV.symauth.com/cps0(

hXXp://VVV.symauth.com/rpa00

hXXp://s1.symcb.com/pca3-g5.crl0

 hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0

 hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0

VMC@.xJ 

ruDp

u.Uj@

MSVCRT.dll

HttpSendRequestA

HttpSendRequestExA

HttpQueryInfoA

FtpCreateDirectoryA

FtpOpenFileA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpEndRequestA

InternetCrackUrlA

WININET.dll

inetc.dll

Open URL Error

URL Parts Error

FtpCreateDir failed (550)

Error FTP path (550)

Downloading %s

%dkB (%d%%) of %dkB @ %d.
dkB/s

(%d %s%s remaining)

REST %d

SIZE %s

Content-Length: %d

Content-Type: application/x-www-form-urlencoded

Authorization: basic %s

Proxy-authorization: basic %s

%s:%s

FtpCommandA

wininet.dll

%u MB

%u kB

%u bytes

%d:d:d

%s - %s

(Err=%d)

NSIS_Inetc (Mozilla)

Filename: %s

/password

Uploading %s

9!9-9B9}9

.reloc

System.dll

callback%d

@.reloc

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp

nsh1A06.tmp

s\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\setup.exe

=1&name=PowerISO+6.6+Multilingual+(x86x64)+Incl+Key+++Portable+[SadeemPC]

\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\Y4qzFSXsu6

labba.ablemicrosporoph.bid/stub_maker.php?program=sevenzip&tid=11598112&pid=2831&b_typ=pe&reb=1&name=PowerISO+6.6+Multilingual+(x86x64)+Incl+Key+++Portable+[SadeemPC]

c:\%original file name%.exe

%original file name%.exe

ers\"%CurrentUserName%"\AppData\Local\Temp\nsr19F5.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

201702281113

hXXp://flabba.ablemicrosporoph.bid/stub_maker.php?program=sevenzip&tid=11598112&pid=2831&b_typ=pe&reb=1&name=PowerISO+6.6+Multilingual+(x86x64)+Incl+Key+++Portable+[SadeemPC]

***~'''?%%%

/%svmA

***$000_

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

%original file name%.exe_2748_rwx_10004000_00001000:

callback%d

setup.exe_3516:

.text

`.rdata

@.data

.ndata

.rsrc

Vj%SSS

uDSSh

hu2.iu

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

%s%s.dll

ers\"%CurrentUserName%"\AppData\Local\Temp\nsw21B4.tmp\System.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw21B4.tmp\System.dll

\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw21B4.tmp

Sorry, PowerISO x64 only runs on 64-bit Windows systems.

.reloc

System.dll

callback%d

.RU%?

ShellExecuteExA

MSVCRT.dll

InstOpt.dll

.ashdisc

SHDeleteKeyA

shlwapi.dll

PowerISO %s

\PowerISO.exe,0

\PowerISO.exe" "%1"

regsvr32.exe

PWRISOSH.DLL

PortugueseBR

QfWQ*.kq?8

.DuYy

VMC@.xJ 

ruDp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw21B4.tmp

nsw21B4.tmp

:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw21B4.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\setup.exe

%Program Files%\PowerISO

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp

setup.exe

ers\"%CurrentUserName%"\AppData\Local\Temp\nsm2174.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

2"&,\45>

*.**)

.uy}"

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.51</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

, FIREFOX

, AND/OR CHROME

(2) DURING INSTALLATION - RESET YOUR HOME PAGE AND/OR DEFAULT SEARCH FOR INTERNET EXPLORER, FIREFOX AND CHROME TO TROVI SEARCH, IF NOT CURRENTLY POWERED BY TROVI'S SEARCH PLATFORM

If you elect to change your browser settings via Search Protect, your settings preferences will be applied to Chrome

, Firefox

If you elect to change your browser settings via your web browser, Search Protect will be disabled for that setting, therefore its ability to prevent third-party software from changing your settings will be halted.

In Chrome, browser settings can be changed via the Chrome menu or wrench icon. In Firefox, settings can be changed via the Firefox button o

04090000

6.6.0.0

setup.exe_3516_rwx_10004000_00001000:

callback%d

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Adware file.
   
3. Delete or disinfect the following files created/modified by the Adware:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm2175.tmp (191716 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw21B4.tmp\System.dll (22 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\Y4qzFSXsu6 (211 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\launch_reb[1].htm (211 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\inetc.dll (44 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\System.dll (23 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh1A06.tmp\B (45628 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.