MD5: 220d75bd346807f5e75be057e4bd00d8
SHA1: 4d643ba503f870914b46e24e7a5b43d571311321
SHA256: 295890776c958e61b4a9c91bd9cafcc321fccc7c98b4485be7f51739cb8ecefe
SSDeep: 6144:Msi1dfl8P1M9 /Sl8zIxmWj/oJoZ5j9TnHK:G1QP5 xmWjQWZF9Tq
Size: 263296 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:46
Analyzed on: Windows7 SP1 32-bit

Summary:

Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Payload

No specific payload has been found.

Process activity

The Adware creates the following process(es):
No processes have been created.
The Adware injects its code into the following process(es):

%original file name%.exe:3824

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:3824 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\inetc3.dll (812 bytes)
%Program Files%\1ClickDownload\ocmainpack.exe (544 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\decline.bmp (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\accept3.bmp (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\MainPackFA2703[1].htm (544 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\skip.bmp (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\nsDialogs.dll (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\save.bmp (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\accept.bmp (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\anon.bmp (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\1clogo.bmp (4992 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\accept1.bmp (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\accept2.bmp (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz7CDE.tmp (15339 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7CCD.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\gC0 (0 bytes)

Registry activity

The process %original file name%.exe:3824 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 0A 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\220d75bd346807f5e75be057e4bd00d8_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4AE6FCD0-212D-417D-82A8-CFA05ACC2876}]
"WpadDecisionTime" = "30 A3 52 A0 A4 AC D2 01"
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\220d75bd346807f5e75be057e4bd00d8_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\1ClickDownload]
"UID" = "284555269"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]
"WpadLastNetwork" = "{4AE6FCD0-212D-417D-82A8-CFA05ACC2876}"

[HKCU\Software\1ClickDownload]
"LastInstall0" = "30583972"

[HKLM\SOFTWARE\Microsoft\Tracing\220d75bd346807f5e75be057e4bd00d8_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\220d75bd346807f5e75be057e4bd00d8_RASAPI32]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-fb-cd-cc]
"WpadDecision" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4AE6FCD0-212D-417D-82A8-CFA05ACC2876}]
"WpadDecision" = "3"

[HKLM\SOFTWARE\Microsoft\Tracing\220d75bd346807f5e75be057e4bd00d8_RASAPI32]
"FileTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4AE6FCD0-212D-417D-82A8-CFA05ACC2876}]
"WpadNetworkName" = "Network 2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-fb-cd-cc]
"WpadDecisionTime" = "30 A3 52 A0 A4 AC D2 01"

[HKLM\SOFTWARE\Microsoft\Tracing\220d75bd346807f5e75be057e4bd00d8_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 38 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\220d75bd346807f5e75be057e4bd00d8_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\220d75bd346807f5e75be057e4bd00d8_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\220d75bd346807f5e75be057e4bd00d8_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-fb-cd-cc]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\220d75bd346807f5e75be057e4bd00d8_RASMANCS]
"ConsoleTracingMask" = "4294901760"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 263
69a0a458647b3436892cf9f2f126c252
41493bd334b04b124933a0395a535273
0592058d62e56072d9a3730ee9c845e6
1314df74c1152fa83b44e72e2e7f6345
0083b9cd57714f369f80bd3303d4fb07
549392eeb6b090fbdaa65501e8d7fac5
458b5456f8a3522a96514d0ad771be45
261c57be98cd4f2f8fd38bbd767820e3
5c7d2cefcf953e92831c3ee7e999262d
381bc1250be83e3e1262a589f03eef01
88c8b0232f1018019c8d1af51fc58bef
b496f2037c79c8ee4a06e4b4a0f92297
e14e3db7eb14423c1c47e7559854f362
8e5a557f2e06a86979f7de42510a3918
c50bbfcebe683171cb95fa15e06eaed0
bb72aed538e1d73a316fd4edc27e9dd7
6e48fbb8ed4f7f61385259ce58fb3c88
949e40c7af632803a2aa21d3f40fb596
dc07f293d5950c9ae0225ffc05dcaa4a
424d16ad29e2bd4bf4879afa6606d53d
16ae5858468dbbfb7a077dc5d4cd82f4
2e9302c206a1c28b7a0ca3121a9d9380
c78b409c8c279174f2ac1e8a5e217043
44ba592b38dc418fa8fdb287af811827
fa439b4d238abb4cebd728d140a95311

URLs

URL	IP
hxxp://data.downloadstarter.net/country.asp?st=-1&uid=284555269&tuid=3090537&sref=1CD_16_31_extr1&vmdt=|vm|&bld=16CJ	146.148.42.217
hxxp://files.download1click.ws/MainPackFA2703.exe	64.70.19.203
teredo.ipv6.microsoft.com	157.56.120.207
dns.msftncsi.com	131.107.255.255

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers

Traffic

GET /MainPackFA2703.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: files.download1click.ws

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200

Server: nginx/1.6.3

Date: Mon, 03 Apr 2017 18:03:43 GMT

Content-Type: text/html; charset=ISO-8859-1

Content-Length: 544

Connection: keep-alive
<html>.<head>..<title>WEBSITE.WS - Your Internet Add
ress For Life™</title>.</head>.<frameset rows="10
0%,*" border="0" frameborder="0">..<frame src="hXXps://VVV.world
site.ws/idn-orderflow/index.dhtml?view=advanced&sponsor=idntraffic" sc
rolling="auto">..<noframes>...<p> Your browser does not
 support frames. Continue to <a href="hXXps://VVV.worldsite.ws/idn-
orderflow/index.dhtml?view=advanced&sponsor=idntraffic">hXXps://www
.worldsite.ws/idn-orderflow/index.dhtml?view=advanced&sponsor=idntraff
ic</a>.</p>..</noframes>.</frameset>.</html
>HTTP/1.1 200..Server: nginx/1.6.3..Date: Mon, 03 Apr 2017 18:03:43
 GMT..Content-Type: text/html; charset=ISO-8859-1..Content-Length: 544
..Connection: keep-alive..<html>.<head>..<title>WEBS
ITE.WS - Your Internet Address For Life™</title>.</head
>.<frameset rows="100%,*" border="0" frameborder="0">..<fr
ame src="hXXps://VVV.worldsite.ws/idn-orderflow/index.dhtml?view=advan
ced&sponsor=idntraffic" scrolling="auto">..<noframes>...<p
> Your browser does not support frames. Continue to <a href="htt
ps://VVV.worldsite.ws/idn-orderflow/index.dhtml?view=advanced&sponsor=
idntraffic">hXXps://VVV.worldsite.ws/idn-orderflow/index.dhtml?view
=advanced&sponsor=idntraffic</a>.</p>..</noframes>.&
lt;/frameset>.</html>..
<<< skipped >>>

The Adware connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

Gw2.Hw

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

ers\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\nsDialogs.dll

iD-Jiggly.exe,us

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\nsDialogs.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp

d.XXX.DVDRip.XviD-Jiggly.torrent

dd.XXX.DVDRip.XviD-Jiggly.torrent

Erica.Lynne.Is.Badd.XXX.DVDRip.XviD-Jiggly

7%!%c

:;z!nt.AD

Windows

B.tmp\skip.bmp", i 0, i 0, i 0, i 0x2000|0x0010) i.s

iles\1ClickDownload\1ClickDownloader.exe

nne.Is.Badd.XXX.DVDRip.XviD-Jiggly

707/Erica.Lynne.Is.Badd.XXX.DVDRip.XviD-Jiggly.torrent,Erica.Lynne.Is.Badd.XXX.DVDRip.XviD-Jiggly.exe,us

284555269

DVDRip.XviD-Jiggly

Lynne.Is.Badd.XXX.DVDRip.XviD-Jiggly.torrent

rrent,Erica.Lynne.Is.Badd.XXX.DVDRip.XviD-Jiggly.exe,us

\%original file name%.exe

2845552

59532869

319096004

a.Lynne.Is.Badd.XXX.DVDRip.XviD-Jiggly

ownload.sweetpacks.com/simsdm/bundle/

e.Is.Badd.XXX.DVDRip.XviD-Jiggly.torrent

ram Files\Internet Explorer\iexplore.exe

nne.Is.Badd.XXX.DVDRip.XviD-Jiggly.torrent

.Is.Badd.XXX.DVDRip.XviD-Jiggly.torrent

c:\%original file name%.exe

C:\Users\"%CurrentUserName%"\Desktop

%Program Files%\1ClickDownload

nsj7D6B.tmp

%original file name%.exe

ers\"%CurrentUserName%"\AppData\Local\Temp\nsj7CCD.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

hXXp://files.download1click.ws/MainPackFA2703.exe

hXXp://files.download1click.ws/gzip2.exe

hXXp://data.downloadstarter.net/

hXXp://files.download1click.ws/ARURUSetup.exe

hXXp://files.download1click.ws/ARUARSetup.exe

hXXp://files.download1click.ws/BTB0612.exe

hXXp://cdn.download.sweetpacks.com/simsdm/bundle/BundleSweetIMSetup.exe

hXXp://files.download1click.ws/FmoodsV21.exe

hXXp://files.download1click.ws/IminentSetup5.exe

hXXp://files.download1click.ws/.exe

hXXp://files.download1click.ws/weatherbugsetup.msi

hXXp://files.download1click.ws/IWantThisSetupRS.exe

hXXp://files.download1click.ws/ciuvoSetup.exe

hXXp://files.download1click.ws/incredibar_install3.exe

hXXp://download.sterkly.com/DropDownDeals-S-Setup_Suite1.exe

hXXp://download.sterkly.com/FreeTwitTube-S-Setup_Suite1.exe

hXXp://download.sterkly.com/yontoo-b2.exe

hXXp://download.sterkly.com/ezLooker-S-Setup_Suite1.exe

hXXp://download.sterkly.com/BestVideoDownloader-S-Setup_Suite2.exe

hXXp://files.download1click.ws/GophotoExtSetup.exe

hXXp://files.download1click.ws/OneClickExt1_filter03.exe

hXXp://files.download1click.ws/OneClickExt1_filter13.exe

Inetc3 (Mozilla; FW 4; WinNT 6.1; msi 5.0.7601.17514; dbw ie; yo ;)

Software\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload

420087173

3090537

extr1,hXXp://extratorrent.com/download/2432707/Erica.Lynne.Is.Badd.XXX.DVDRip.XviD-Jiggly.torrent,Erica.Lynne.Is.Badd.XXX.DVDRip.XviD-Jiggly.exe,us

Erica.Lynne.Is.Badd.XXX.DVDRip.XviD-Jiggly.torrent

hXXp://extratorrent.com/download/2432707/Erica.Lynne.Is.Badd.XXX.DVDRip.XviD-Jiggly.torrent

ocmainpack.exe

168101055

184878269

168101051

1208288325

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

168428729

168428723

168428725

168428717

201983153

168428719

201983159

252314795

168428713

621413544

722076842

Erica.Lynne.Is.Badd.XXX.DVDRip.XviD-Jiggly.exe

30583972

VVV.oneclickdownloader.com

sbiectrl.exe

vmtoolsd.exe

prl_cc.exe

coherence.exe

VirtualBox.exe

VBoxSVC.exe

DrWeb

%Program Files%\1ClickDownload\Erica.Lynne.Is.Badd.XXX.DVDRip.XviD-Jiggly.magnet

)-.Yln

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

%original file name%.exe_3824_rwx_10004000_00001000:

callback%d

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Adware file.
   
3. Delete or disinfect the following files created/modified by the Adware:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\System.dll (23 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\inetc3.dll (812 bytes)
   %Program Files%\1ClickDownload\ocmainpack.exe (544 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\decline.bmp (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\accept3.bmp (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\MainPackFA2703[1].htm (544 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\skip.bmp (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\nsDialogs.dll (21 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\save.bmp (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\accept.bmp (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\anon.bmp (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\1clogo.bmp (4992 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\accept1.bmp (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7D6B.tmp\accept2.bmp (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz7CDE.tmp (15339 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.