Adware.Generic.166427_188218cb81

by malwarelabrobot on April 8th, 2015 in Malware Descriptions.

not-a-virus:AdWare.Win32.CloverPlus.dy (Kaspersky), Adware.Generic.166427 (B) (Emsisoft), Adware.Generic.166427 (AdAware), mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Adware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 188218cb81df3fd73d196e3f5af96a00
SHA1: 42211ed560f16b0ec28ce31ea29911c78d4bca2d
SHA256: d042aa8235fefcb9c0257c2d2e20ac1f63a9968b7a46d045285c6f317dbb7cce
SSDeep: 1536:FaMftiEbfMZhASsSBarSieYqRi1T507908tiu/Ov6NYGsuV88XP qDxU79u:F7liEbfHSviecFJ8tiOKqV8k Gxd
Size: 140544 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, PolyEnE001byLennartHedlund, ACProtect14x, ACProtectv135
Company: Cinema HDV12.01
Created at: 2009-04-22 15:06:47
Analyzed on: WindowsXP SP3 32-bit


Summary:

Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Payload

No specific payload has been found.

Process activity

The Adware creates the following process(es):

updater250.exe:912
clover.exe:1136
%original file name%.exe:464

The Adware injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process updater250.exe:912 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\5671\clover.exe (352976 bytes)
%Program Files%\CloverPlus\clover.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c_exe[1].exe (352976 bytes)
%WinDir%\CloverPlus.cot (719 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\5671\clover.exe (0 bytes)
%WinDir%\CloverPlusprv.cot (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\5671 (0 bytes)

The process clover.exe:1136 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Favorites\¿¬°á\¼­Ä¡¹ÙÀ̹Ì.url (95 bytes)
%Documents and Settings%\%current user%\Favorites\¼­Ä¡¹ÙÀÌ¹Ì - ³»°¡ ¸¸µé¾î°¡´Â °Ë»öÇü ºí·Î±×.url (95 bytes)
%Documents and Settings%\%current user%\Desktop\¼­Ä¡¹ÙÀ̹Ì.url (95 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchbyme[1].ico (158104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\alive[1].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%WinDir%\searchbyme.ico (158104 bytes)

The process %original file name%.exe:464 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Program Files%\CloverPlus\updater250.exe (111712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\c_updater[1].exe (111712 bytes)
%WinDir%\CloverPlusprv.cot (733 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)

Registry activity

The process updater250.exe:912 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\CloverPlus]
"updater_loaddate" = "4-7"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\CloverPlus]
"clover.exe" = "MFC 응용 프로그램"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B 23 5A BF C0 F9 D5 0B F4 93 62 D7 86 EC D7 23"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Adware adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"clover" = "%Program Files%\CloverPlus\clover.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Adware adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"clover_u" = "%Program Files%\CloverPlus\clover_updater.exe"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process clover.exe:1136 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\CloverPlus]
"sidebar_loaddate" = "4-7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\CloverP]
"ext" = "A25BD2DA31FC4EB545CA0A57C0378AE69534BA358E28D49EF84D0F3A0FC9B57808681CF36A54C4236E4280942B2394A76D46CC50BD0E6C810E156D81273B5F13EA5457624C068F950D2A2F61EDD50D3440F5B4F1F590F51783548CB0D6584C89BD32FF9ED99C08379FFAB98C91FB82C482C0404069369CEEA4F0AB1F05E1651DAAE13177C9ABDD7A27792DFBF8B9C7209D9527999891A6E66B28A7F68FA532FB9FA8004CADF8486F1B6BF55A451CEF4F696683FD5906AFD0DA6E2BC618FD06F4E6FFCF6368089C7E437CFF3532E7CE76652991A1843F4F0A8DA6807EBCFF18F7AAD7A622C4D7A3EFED035E158E079679B075D5644CF1DA835C3D419DC41454D212846B7E2761BFB7F2C4873995CDC05876F956B2A8D5F681B9AAB77D37309C93F75577AFD44BEB548E0DFF9E315A069A6A6B900D28D06D442BC18CFFDB45B1CB856C5318B43D584FF3011477D32B396DA9DD3EA2E8E7F8F5B12CCC18747E0DA30F389F3A57E20094E327BC2065B8D71777DB924C6A0DAE7ECD21C10757B3809A5B0BC78860E8DC596118988410D4498BA6F8116376DA1C71EEB69BF83FF7265CE8569B5D8628CC2A108C2E2E7502CA4873F03CB7BB3CB9543A76F98B4F18CAE31591C6E0435F7102720B722C7360B33A1F3CA339A2DA51AA5FD63CEA6A36B360F3E584D4F1562953"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 13 3D 10 94 12 34 D4 A8 7D AB 24 CD FD D8 EB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:464 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\CloverPlus]
"updater250.exe" = "updater250"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 87 2F 9C 90 61 15 F9 84 AD 3A EC 49 09 25 67"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5 File path
7aedd69cf2565da0d4caaefaaa32f336 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c_exe[1].exe
6e928ca124dcb70da2ec716019b509e5 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\c_updater[1].exe
7aedd69cf2565da0d4caaefaaa32f336 c:\Program Files\CloverPlus\clover.exe
6e928ca124dcb70da2ec716019b509e5 c:\Program Files\CloverPlus\clover_updater.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: CloverUpdater ?? ????
Product Version: 1, 0, 0, 1
Legal Copyright: Copyright (C) 2009
Legal Trademarks:
Original Filename: CloverUpdater.EXE
Internal Name: CloverUpdater
File Version: 1, 0, 0, 1
File Description: CloverUpdater MFC ?? ????
Comments:
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 78440 40960 5.09336 ee7dde2fe17ed393d188da8187202676
.rdata 86016 18122 20480 3.35896 64e4e173ce80fe58360bf1f6ce8e4fe7
.data 106496 4072 4096 2.93139 26f02aede3dcf482c847919e95223cd9
.rsrc 110592 4096 4096 2.84033 518ae57a2c1f5cb8829e55afbdb45b86
.perplex 114688 66816 66816 5.49176 bf30bf0b5d9837134a54a6cd1852ccb5

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://e10088.dspb.akamaiedge.net/
hxxp://mng.cloverplus.com/files.php?client= 218.149.84.44
hxxp://mng.cloverplus.com/files/pav/c_updater.exe 218.149.84.44
hxxp://c.batangicon.net/log_progress.php?client=&action=update&target=0 211.110.214.22
hxxp://www.google.com/ 173.194.113.208
hxxp://www.google.com.ua/?gfe_rd=cr&ei=uj8jVdzhM9SBNLWVgPgD 173.194.113.208
hxxp://mng.cloverplus.com/files/pav/c_exe.exe 218.149.84.44
hxxp://c.batangicon.net/log_progress.php?client=&action=install&target=1 211.110.214.22
hxxp://c.batangicon.net/log_progress.php?client=&action=load&target=0 211.110.214.22
hxxp://mng.cloverplus.com/alive.php?client= 218.149.84.44
hxxp://mng.cloverplus.com/config.php?client= 218.149.84.44
hxxp://mng.cloverplus.com/cls.php?client= 218.149.84.44
hxxp://c.batangicon.net/log_progress.php?client=&action=load&target=1 211.110.214.22
hxxp://mng.cloverplus.com/ext.php?client= 218.149.84.44
hxxp://mng.cloverplus.com/fdwn/icon/searchbyme.ico 218.149.84.44
hxxp://m.batangicon.net/alive.php?client= 218.149.84.44
hxxp://m.batangicon.net/config.php?client= 218.149.84.44
hxxp://m.batangicon.net/files/pav/c_exe.exe 218.149.84.44
hxxp://m.batangicon.net/fdwn/icon/searchbyme.ico 218.149.84.44
hxxp://www.microsoft.com/ 184.86.56.154
hxxp://m.batangicon.net/files.php?client= 218.149.84.44
hxxp://m.batangicon.net/ext.php?client= 218.149.84.44
hxxp://m.batangicon.net/cls.php?client= 218.149.84.44
hxxp://m.batangicon.net/files/pav/c_updater.exe 218.149.84.44


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET MALWARE User-Agent (microsoft) - Possible Trojan Downloader
ET POLICY Microsoft user-agent automated process response to automated request

Traffic

GET /log_progress.php?client=&action=load&target=1 HTTP/1.1
Host: c.batangicon.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Tue, 07 Apr 2015 02:24:13 GMT
Server: Apache/2.2.16 (Unix) DAV/2 PHP/5.2.14
X-Powered-By: PHP/5.2.14
Set-Cookie: PHPSESSID=ba6b2ea9e76a9f008996adcf9bcc97d2; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 0
Connection: close
Content-Type: text/html



GET /config.php?client= HTTP/1.1
Host: m.batangicon.net


HTTP/1.1 200 OK
Date: Tue, 07 Apr 2015 02:24:12 GMT
Server: Apache/1.3.33 (Unix) PHP/4.4.7
X-Powered-By: PHP/4.4.7
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=EUC-KR
c32..F55F12926DE40E2DF5F4B99D5CD19602CA57523BB1D3B24E1EFF0824010C2CF2F
F233EF4691E3C88668FE04E8B1D9B0A3C5DD2FA5E4E5D559BAF9188FD1552E7472A62F
ABDC274B4DF4E9BC5EDF2926AFC633FAAB09C39787B6B9523B05328AFCC80E88E82C5A
4A314D7C7A18D09901D24ED4281B4F55A5262EFFE26DC6872E3BB199AD0BC2C1155CB5
3685DC78BC0FC6F5DD563D99D2174ACEF02E042B66EBE9C90CA50ABC048761163B5470
FAFB15E51C5F9FCFC0C1BDEF076E9B7DB110D205EF81D330858F07D8A7C061F237F2CA
8AF341BDB7C6EE9CACE2582D60AC0D55B55D7F924F9A18C5FE36B65147CE5C9A29DCB7
06AB621C36F1B7A125AB2000CF418E68BB6534F758712C0B9B1B45C4C8264699E6AE7F
0D614A65ABC906E1205C0B3FDC8A6E63090114A8FC29AB28AE01611C26E2524DA5A958
F112C6DAA9462FED58533CF8265F9AAF6E1E955A9FCCBE9057D1C7E667A4C6BA09C2BF
3855E35F90F3AEC0206A9C46DCA2D95208CB1D9D62B9AF95EF64D9D79CDD5C17082499
BDB2FB8ECA5082DBB17D268DFADDEE753AAC9C8F0163C4D7FE327A5970A94DE12B5121
E30FE4969F71D1E5E4EFD8478185E11B25EAD36F1D52354AE0878302AAAC55DE0E6DB8
AD5FF95B34E994FA436F4048630F8BEBA14035A4419E4D15564A94EF7E90CE08DAC738
092EB7898CF0C21BCF09A43C52CA2D1FF8B1EF43CEA58100EDEBF15B9D135E3BDF5C78
9C105C470131AF7D4FA823C114ACF4859DAC133F91C2BA3508F9AD87E83ADB14728E3C
53AB33E8736522F3BC76E16A7D52F4D2F3E144C568DFC29D8660A2D87B998EACABC42D
03C0D1951B626EFE4F8512C5EEF39399981586ECA34A7A5943AAC805C91B182EF9A6EE
9FF03206C326C42EE89BB84BBAB07C18D4D9D8ACAEE9A2CC29B1923EE8FFFFA423A909
AEDF4246938420038BED0A4B4C504703EBCE910E64518EB40C02DEA59A3B1126CD9CC4
02D5B816AD85CF3B0C803DA1FAAD8E1A72F3651A2A831786EFFA3ED877158D040D7FDE
1C894FFCC3CB3EDD42005D8960D32650F9702745EC94BBAF5F8F14CE1BF2B6A056
<<< skipped >>>


GET /log_progress.php?client=&action=load&target=0 HTTP/1.1
Host: c.batangicon.net
Cache-Control: no-cache
Cookie: PHPSESSID=107ab246870bd499a80580fe04706c16


HTTP/1.1 200 OK
Date: Tue, 07 Apr 2015 02:24:02 GMT
Server: Apache/2.2.16 (Unix) DAV/2 PHP/5.2.14
X-Powered-By: PHP/5.2.14
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 0
Connection: close
Content-Type: text/html



GET /?gfe_rd=cr&ei=uj8jVdzhM9SBNLWVgPgD HTTP/1.1
Connection: Keep-Alive
Host: VVV.google.com.ua


HTTP/1.1 200 OK
Date: Tue, 07 Apr 2015 02:23:54 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=windows-1251
Set-Cookie: PREF=ID=4b85f16c24e92a17:FF=0:TM=1428373434:LM=1428373435:S=KclUD5F-_1LD5oFY; expires=Thu, 06-Apr-2017 02:23:55 GMT; path=/; domain=.google.com.ua
Set-Cookie: NID=67=mBEXLn86_TQlL066yLYmKouggxnBdvJfq4YHCCT8rjSoDra2yJyLPvA4QlCZxLa_olIMcT-FR_JxXvl71uliIasHIhujbxigk7t58ojxNmFbzPruK3DxqjsLFYq75E4b; expires=Wed, 07-Oct-2015 02:23:55 GMT; path=/; domain=.google.com.ua; HttpOnly
P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
Server: gws
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Alternate-Protocol: 80:quic,p=0.5
Accept-Ranges: none
Vary: Accept-Encoding
Transfer-Encoding: chunked
8000..<!doctype html><html itemscope="" itemtype="hXXp://sche
ma.org/WebPage" lang="uk"><head><meta content="/logos/dood
les/2015/gabriela-mistrals-126th-birthday-5301646531756032-hp.jpg" ite
mprop="image"><meta content="126 ..... . ... .......... ........
 ........ #GoogleDoodle" property="og:description"><meta content
="hXXp://VVV.google.com/logos/doodles/2015/gabriela-mistrals-126th-bir
thday-5301646531756032-hp.jpg" property="og:image"><meta content
="491" property="og:image:width"><meta content="190" property="o
g:image:height"><title>Google</title><script>(fun
ction(){window.google={kEI:'uj8jVaiHPISksgHnvICQBw',kEXPI:'18167,37002
72,3700362,4003510,4011559,4020347,4020726,4025836,4028716,4028932,402
9054,4029515,4029815,4030440,4031242,4031391,4031394,4031478,4031571,4
031608,4031622,4031627,4031713,4031789,4032500,8500394,8500972,8501248
,8501295,8501313,8501350,10200083,10201001',authuser:0,kSID:'c9c918f0_
10'};google.kHL='uk';})();(function(){google.lc=[];google.li=0;google.
getEI=function(a){for(var b;a&&(!a.getAttribute||!(b=a.getAttribute("e
id")));)a=a.parentNode;return b||google.kEI};google.getLEI=function(a)
{for(var b=null;a&&(!a.getAttribute||!(b=a.getAttribute("leid")));)a=a
.parentNode;return b};google.https=function(){return"https:"==window.l
ocation.protocol};google.ml=function(){};google.time=function(){return
(new Date).getTime()};google.log=function(a,b,e,f,l){var d=new Image,h
=google.lc,g=google.li,c="",m=google.ls||"";d.onerror=d.onload=d.o
<<< skipped >>>


GET /cls.php?client= HTTP/1.1
Host: m.batangicon.net


HTTP/1.1 200 OK
Date: Tue, 07 Apr 2015 02:24:13 GMT
Server: Apache/1.3.33 (Unix) PHP/4.4.7
X-Powered-By: PHP/4.4.7
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=EUC-KR
e10..F523D1E0711315956B9F796AC282C2F0F1842C2B52A46AE1BCD0100BEAF0A17EA
D210FC6BF10A1634C55BCA368523F1F3589FA909245B181D3DB95464506091FF9D9514
54A0C2BB1A6DF8476EC2F065F9FA54435B12F6D5FC83B5C64F34950F2C295ED50B9D37
3A657DCAAB084C96AC234DA92587F3873546502AF93F78AB6D4F2C535A9A36BA65C250
66D1F66F9AE6C646CEF75987D85CCAD50EDB9994B5A8F8970E55F9D56AC9636498E58E
635D098472532B8B29C611F8120D4B9A2DC404B90BD7F44F21CEFB345D122EC8B26364
EF76B88C38A2E4FC9D14BC0CA14BDE8AA6D62DCDFDF116944855A85B889D0D7A4DE1AF
711AF52F5CA7659E925D3262498D40FDB083B5F72573E2462606171A4BC6686B15088F
BA7256AB9AAAAC8336BA726359B137F129C733C85FCFCC2B5FFA525868F3E26A31FF52
CFC4D49139FB0C289BD3DC5D381710EEC72307805E440D4792C4C0E164A02F5B13688B
F7D0D9BB80323F4D9DD64D4B9CD75BCB05864905E80CF300050DAF0BFB8ED981459B07
076C306F867E94C0B3733890D70D2B51B6C52D8F05183F04F1108BF36D55E6C963C7B7
80F1A244E82B9D03B5F165E19C20B0599294076E28B794E7C61445B25D1C2ECE51CF0F
D073197B4A5954FB5282CD7247C6F96E4038F23E43A0484B0659252419A78AA977E788
84942AC6AE14E3D19E29E0FD12C93DA62B81E4C4BD51717FD9508E8AF97E5DCBCDBADD
B8F2284B1562D5417F5683741630B6E36CCE396B61341ADAA068EFB8132ACA8366F5F0
306FF541EB39F5AEEBA767DE9A01771D30E753F6A53D0F0D38ED4087CB9985C3EAF35C
EE5FECE1E652513410DBA14FEBB6F9B4311620366039E7F63EF8CF6F4A3C76B3A74129
851E1E14C739F92C5C046BCE815E3BBEBEFA6682BB576DAF20D113FC79BD0C4986CB17
39A62BB565C91A7CF5F3C92B29ABB67A2DC24D5C39A607EFFA71FB348B8BCBE8175708
11250797B27A24BACA4FCB01265DDA0893FE5338D722DBBB8FC07B442F3D2858FD5C4D
A94A901E3978535A44DF5C535D198A27BCE478FA8884BE90589DD0AE459F79C1C6
<<< skipped >>>


GET /fdwn/icon/searchbyme.ico HTTP/1.1
Host: m.batangicon.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Tue, 07 Apr 2015 02:24:15 GMT
Server: Apache/1.3.33 (Unix) PHP/4.4.7
Last-Modified: Thu, 28 Mar 2013 10:06:18 GMT
ETag: "5f073e-27846-5154161a"
Accept-Ranges: bytes
Content-Length: 161862
Connection: close
Content-Type: image/x-icon
............ .(.......``.... .........HH.... ..T..V...@@.... .(B......
00.... ..%...4..  .... ......Y........ .....Vj........ .h....s..(.....
........ .............................................................
......'\44g.HH..NN..OO..LL..JJ..II..II..II..II..II..II..II..II..II..II
..II..II..II..II..II..GG..AA..88..00..,,..**}.((|.))}.**......44..<
<..CC..GG..II..II..II..II..II..II..II..II..II..II..II..II..II..II..
II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II
..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..
II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..JJ..LL
..OO..NN..HH..44g...'b................................................
..........................:xFF..JJ..))................................
......................................................................
............==....l...t...............................................
......................................................................
......................................................................
......................................................................
....................................))..JJ..EE....:~..................
.........................................>BB..DD...................
......................................................................
...............................................o...x..................
......................................................................
..................................................................
<<< skipped >>>


GET / HTTP/1.1
Host: VVV.google.com


HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=uj8jVdzhM9SBNLWVgPgD
Content-Length: 260
Date: Tue, 07 Apr 2015 02:23:54 GMT
Server: GFE/2.0
Alternate-Protocol: 80:quic,p=0.5
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=uj8jVdzhM9SB
NLWVgPgD">here</A>...</BODY></HTML>..HTTP/1.1 302
 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8
..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=uj8jVdzhM9SBNLWVgPg
D..Content-Length: 260..Date: Tue, 07 Apr 2015 02:23:54 GMT..Server: G
FE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><
;meta http-equiv="content-type" content="text/html;charset=utf-8">.
<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1&g
t;302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.g
oogle.com.ua/?gfe_rd=cr&ei=uj8jVdzhM9SBNLWVgPgD">here</A>
...</BODY></HTML>....



GET /files/pav/c_exe.exe HTTP/1.1
Host: m.batangicon.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Tue, 07 Apr 2015 02:23:57 GMT
Server: Apache/1.3.33 (Unix) PHP/4.4.7
Last-Modified: Tue, 24 Sep 2013 06:28:00 GMT
ETag: "5e8e26-58000-524130f0"
Accept-Ranges: bytes
Content-Length: 360448
Connection: close
Content-Type: application/octet-stream
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......[1...P...P..
.P..dL...P...X...P...X...P...L...P...O...P...O...P...O...P...P...Q..)v
[email protected]......
(........P....@.......................................................
..................P........P..`!......................................
.....................................P...............................t
ext....7.......@.................. ..`.rdata.......P.......P..........
....@[email protected]..../... ...0... [email protected]...`!...P...0...P
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>


GET /files/pav/c_updater.exe HTTP/1.1
User-Agent: microsoft
Host: m.batangicon.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Tue, 07 Apr 2015 02:23:38 GMT
Server: Apache/1.3.33 (Unix) PHP/4.4.7
Last-Modified: Tue, 06 Aug 2013 11:32:00 GMT
ETag: "5e8d66-1c000-5200deb0"
Accept-Ranges: bytes
Content-Length: 114688
Connection: close
Content-Type: application/octet-stream
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.............}...}.
..}...q...}... ...}...s...}.x.w...}.x.v...}.x.y...}...|...}...v...}.W.
{...}.Rich..}[email protected]......
o).......P....@.......................................................
...................w..........`.......................................
.....................................P..$............................t
ext...h7.......@.................. ..`.rdata...G...P...P...P..........
....@[email protected]... [email protected]...`.............
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>


GET /log_progress.php?client=&action=install&target=1 HTTP/1.1
Host: c.batangicon.net
Cache-Control: no-cache
Cookie: PHPSESSID=107ab246870bd499a80580fe04706c16


HTTP/1.1 200 OK
Date: Tue, 07 Apr 2015 02:24:02 GMT
Server: Apache/2.2.16 (Unix) DAV/2 PHP/5.2.14
X-Powered-By: PHP/5.2.14
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 0
Connection: close
Content-Type: text/html



GET / HTTP/1.1
Host: VVV.microsoft.com


HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: text/html
Last-Modified: Mon, 16 Mar 2009 20:35:26 GMT
Accept-Ranges: bytes
ETag: "67991fbd76a6c91:0"
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
Content-Length: 1020
Date: Tue, 07 Apr 2015 02:23:34 GMT
Connection: keep-alive
X-CCC: SE
X-CID: 2
<html><head><title>Microsoft Corporation</title&g
t;<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"><
;/meta><meta http-equiv="Content-Type" content="text/html; chars
et=utf-8"></meta><meta name="SearchTitle" content="Microso
ft.com" scheme=""></meta><meta name="Description" content=
"Get product information, support, and news from Microsoft." scheme=""
></meta><meta name="Title" content="Microsoft.com Home Pag
e" scheme=""></meta><meta name="Keywords" content="Microso
ft, product, support, help, training, Office, Windows, software, downl
oad, trial, preview, demo,  business, security, update, free, computer
, PC, server, search, download, install, news" scheme=""></meta&
gt;<meta name="SearchDescription" content="Microsoft.com Homepage" 
scheme=""></meta></head><body><p>Your curre
nt User-Agent string appears to be from an automated process, if this 
is incorrect, please click this link:<a href="hXXp://VVV.microsoft.
com/en/us/default.aspx?redir=true">United States English Microsoft 
Homepage</a></p></body></html>....



GET /files.php?client= HTTP/1.1
User-Agent: microsoft
Host: mng.cloverplus.com


HTTP/1.1 200 OK
Date: Tue, 07 Apr 2015 02:23:36 GMT
Server: Apache/1.3.33 (Unix) PHP/4.4.7
X-Powered-By: PHP/4.4.7
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=EUC-KR
53a..F509D2B02FF1E5916DAE84BAEFCD62B491306CE41F0694EEC059E44FA2BF6584F
22927F295968E11A092D85E9D23373E6B8A1D557D6B0F1D11CB6A87333278BBA82E9F7
2855FCDB84D64446D512F0C8363286C149F6929D3929645B0C33E04E18E04D4F3ABDDF
4E59228B7AC9CA2C06B17A7C94D5E58A3E0B178FF8842E2660FA3E977C5D1A2A535306
52DFB4C541A023F22DF668AB52C697E7A70F34907722EE07DCE1F755A4695173A737AD
53A0E8C015214101A9DA1449E97A3ED29F83F51C5BE3D77CB29BA681AC65FCDEACECC4
BC14BB2EBBB25240C413B83C710B35B596FCEB2DDEF17DFD480403F835CFBDFB4E7BAE
1AC671967831F224A94B8D070ED4D6F705941B38F64F076854793B79A4906709262355
945EB7369C5C88540E7FFF4FCC3D6D5CA450C5E552CEBACB13963E5C74A622E489100A
40EF36379B89F21DD892FE181736356D3A43371C63F0FF906151FC979554E255995785
E55077FBA61703703F375F22E9ADC45054654145D281606BAA5C3DC7D01809F5178B25
C9E04B5D1CC951877C1ED435C51039151FD38E5D0825EDB61322DE2A3E6620B9BF9CBA
A79059C0082177871F9D1BEACE71084B224F0BB9FBE2A14D706B23A619C282979DF58E
A644E5D780921FA05E92FD48B37E9E1ADFE8B08252F163225ECA39F02DCFF75E169348
5A2F1A87C7B1E3C71139C58D611D2E8BF88303823C48C49B07E9FAF4DD2D4B2A6CC241
24B23846C21E5469B7E7E257C06BA6653DFB5A442026F5E972668FFB040DBD16D32F9D
ECF8A753199F70C4C1658429EC50599A2D83662432FAFF78A67851C6192C755710A616
519E921958DDD64030A728CAEC721E7ED6E0F1416EFDDD909E1A7950D91B1CF9F072BE
031E65F6B8FF264E867C415A9BAD9F5DB2AA079B1108241A4AA6152D0C2A9095391BC6
CCFA4BA4F5E5F..0..
<<< skipped >>>


GET /files.php?client= HTTP/1.1
Host: m.batangicon.net


HTTP/1.1 200 OK
Date: Tue, 07 Apr 2015 02:23:56 GMT
Server: Apache/1.3.33 (Unix) PHP/4.4.7
X-Powered-By: PHP/4.4.7
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=EUC-KR
53a..F509D2B02FF1E5916DAE84BAEFCD62B491306CE41F0694EEC059E44FA2BF6584F
22927F295968E11A092D85E9D23373E6B8A1D557D6B0F1D11CB6A87333278BBA82E9F7
2855FCDB84D64446D512F0C8363286C149F6929D3929645B0C33E04E18E04D4F3ABDDF
4E59228B7AC9CA2C06B17A7C94D5E58A3E0B178FF8842E2660FA3E977C5D1A2A535306
52DFB4C541A023F22DF668AB52C697E7A70F34907722EE07DCE1F755A4695173A737AD
53A0E8C015214101A9DA1449E97A3ED29F83F51C5BE3D77CB29BA681AC65FCDEACECC4
BC14BB2EBBB25240C413B83C710B35B596FCEB2DDEF17DFD480403F835CFBDFB4E7BAE
1AC671967831F224A94B8D070ED4D6F705941B38F64F076854793B79A4906709262355
945EB7369C5C88540E7FFF4FCC3D6D5CA450C5E552CEBACB13963E5C74A622E489100A
40EF36379B89F21DD892FE181736356D3A43371C63F0FF906151FC979554E255995785
E55077FBA61703703F375F22E9ADC45054654145D281606BAA5C3DC7D01809F5178B25
C9E04B5D1CC951877C1ED435C51039151FD38E5D0825EDB61322DE2A3E6620B9BF9CBA
A79059C0082177871F9D1BEACE71084B224F0BB9FBE2A14D706B23A619C282979DF58E
A644E5D780921FA05E92FD48B37E9E1ADFE8B08252F163225ECA39F02DCFF75E169348
5A2F1A87C7B1E3C71139C58D611D2E8BF88303823C48C49B07E9FAF4DD2D4B2A6CC241
24B23846C21E5469B7E7E257C06BA6653DFB5A442026F5E972668FFB040DBD16D32F9D
ECF8A753199F70C4C1658429EC50599A2D83662432FAFF78A67851C6192C755710A616
519E921958DDD64030A728CAEC721E7ED6E0F1416EFDDD909E1A7950D91B1CF9F072BE
031E65F6B8FF264E867C415A9BAD9F5DB2AA079B1108241A4AA6152D0C2A9095391BC6
CCFA4BA4F5E5F..0..
<<< skipped >>>


GET /ext.php?client= HTTP/1.1
Host: m.batangicon.net


HTTP/1.1 200 OK
Date: Tue, 07 Apr 2015 02:24:15 GMT
Server: Apache/1.3.33 (Unix) PHP/4.4.7
X-Powered-By: PHP/4.4.7
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=EUC-KR
38e..F585FCCD34E04EA02A02BD22A0957AACB01F9ECA930288B62B427F3EA3C0307DC
A525FF32926995E718CD85DBF10583A6343FC480236085DDF56544728CE8D9845558C4
DAE095F8B5996C9667DD3C9350D0B77AC8B7CF3069E0B52F09A8B42E4AC48D7EEDCABC
6309F44B7C4ACF6A32234FBB5997721A1E62D3FFA30B234710047C4325EE0AEE80BEDF
4C81D6C23382136C7012FC382CCA4B044D0935D3E585A76B31865CEE94341F7D6B943F
9861E71217308175328ACC4DABAC32C32573C875A364B6A2E2375DF61D5553BEBCA2B1
5C934A1B29753312A04A15EB0741C313F6101E84896A1D1CB0C05413CB19F3C003D6C6
8234A1AB7782B213895BF2A0303AAE160B08529D8BD4C2F4E0C396A42BA2933130DD5A
6CCD2349B34BFFC8692ADD1F1AB429B09797562856F23B7BDA75E199A293B105D3D3F4
3703D5C13607AC744A22317DA7D8F11BCC51C5E7D47456BAB1C82593483C410177ADCD
3A973A310B14516D5D84BAB5341D5CBFA6CA078044C3D4B7461F9CA982132A81A992AF
45D77DB08C1550CBFFCC3060C88A0B25DABF6AD1D1081328FDAE9C0CED24726AC953B4
245186202A3282BA21EF430C30D51081B399E9420B77B36AB4F9171825CC25B7C7D47E
E6427..0..



GET /log_progress.php?client=&action=update&target=0 HTTP/1.1
Host: c.batangicon.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Tue, 07 Apr 2015 02:23:47 GMT
Server: Apache/2.2.16 (Unix) DAV/2 PHP/5.2.14
X-Powered-By: PHP/5.2.14
Set-Cookie: PHPSESSID=107ab246870bd499a80580fe04706c16; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 0
Connection: close
Content-Type: text/html



GET / HTTP/1.1
Host: VVV.microsoft.com


HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: text/html
Last-Modified: Mon, 16 Mar 2009 20:35:26 GMT
Accept-Ranges: bytes
ETag: "67991fbd76a6c91:0"
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
Content-Length: 1020
Date: Tue, 07 Apr 2015 02:24:08 GMT
Connection: keep-alive
X-CCC: SE
X-CID: 2
<html><head><title>Microsoft Corporation</title&g
t;<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"><
;/meta><meta http-equiv="Content-Type" content="text/html; chars
et=utf-8"></meta><meta name="SearchTitle" content="Microso
ft.com" scheme=""></meta><meta name="Description" content=
"Get product information, support, and news from Microsoft." scheme=""
></meta><meta name="Title" content="Microsoft.com Home Pag
e" scheme=""></meta><meta name="Keywords" content="Microso
ft, product, support, help, training, Office, Windows, software, downl
oad, trial, preview, demo,  business, security, update, free, computer
, PC, server, search, download, install, news" scheme=""></meta&
gt;<meta name="SearchDescription" content="Microsoft.com Homepage" 
scheme=""></meta></head><body><p>Your curre
nt User-Agent string appears to be from an automated process, if this 
is incorrect, please click this link:<a href="hXXp://VVV.microsoft.
com/en/us/default.aspx?redir=true">United States English Microsoft 
Homepage</a></p></body></html>....



GET /alive.php?client= HTTP/1.1
Host: m.batangicon.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Tue, 07 Apr 2015 02:24:12 GMT
Server: Apache/1.3.33 (Unix) PHP/4.4.7
X-Powered-By: PHP/4.4.7
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=EUC-KR
4e8..F509D2B02FF1E5916DA25245F027B9A26D25A2CA29F42CBEEA823EB10CCF6E911
72F5907C361A661A28DD6606BF34A435A862D57846A059109156E81353F7BB7B3444D4
85241314CA9483A01E4443749570D5C16CA582FC059914BC1897280EB9178D297A0EE7
0F4E022AAB7C5BC24232395B442285BB8005A5FD9A13A2373B3AED274C5C3FBC717D07
727959B9BBF44D8A704BA783F1836DB1C1CC351F88E15D7E9E3AFDA1559D23FF5603DB
E32B5F6876127FE0204A413D7880883F4D2347BBFC3965DF80CB5C52C8DCC333CA3CA1
EF3549656BA2725E1356C7305C675D0E5BA15CEB3B6D6962D0AAF7B46B35AFEFD422CA
80B512FD8795467505B9A0B5A05B5E63B9E284A9E95CB53CE136CB247AC1E6958E5BBF
88ACE8F58FFC5CA3BF2D8EFF40EA8D2FFAB3B7B20938F0AD1DA6F208AD4674E41C5A76
91584F89F7C97E91F799AE54221E9EA22B5F956D5518E26AF7B2C3B35A38C9D10DA277
76D503C97254CDFC8AF60015A8EB7DFB7B165CDDA7BCCA1125D2FC0DF15D8A57B7808A
FC76F27DA9C9877C84FB8DD0C66BE82C23D9D1E00878473BDE386C8A2D365A19ADA847
C5E429E0CB233F24CC5B45CC0D14E844303457E375F514F55A739D1357885484384FAC
4D807A5B2432716B14B189F4DA4B5E1570C500EE469FBD77D50DB47904F9F9CF9BC886
823F7BF4ED7B0DD2D7B1676E6386EC4493A5355FF42CE1734DECF19E8A1369E5B2DAA7
BD743DEF309E1C4BC85C04CEE07E8227D9312434D77AF9F1D9C8DAD6D76AD9E482E99F
8E17691C6AB7C3129B52FAE70982B667FA22D7564716F3FBA5EDFD9767EE23E45A333B
D5C8442F068D264284C71DE84972D09E8AD5EE4C72995A1C8E2E9485D8BAB80A9461EF
D..0..







The Adware connects to the servers at the folowing location(s):







clover.exe_1136:




.text
`.rdata
@.data
.rsrc
t'<%u
SSSSh
MFC42.DLL
MSVCRT.dll
_acmdln
GetWindowsDirectoryA
KERNEL32.dll
USER32.dll
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryInfoKeyA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
InternetOpenUrlA
WININET.dll
NETAPI32.dll
WS2_32.dll
MSVCP60.dll
URL=%s
%CONNECTION
úVORITE
ÞSKTOP
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
.PAVCException@@
.PAVCFileException@@
.PAVCMemoryException@@
c_exe
hXXp://m.batangicon.net/files.php?client=%CLIENTID
hXXp://m.batangicon.net/config.php?client=%CLIENTID
hXXp://m.batangicon.net/inf_d.php?k=
hXXp://m.batangicon.net/inf_c.php?k=
hXXp://m.batangicon.net/ext.php?client=%CLIENTID
hXXp://m.batangicon.net/cls.php?client=%CLIENTID
hXXp://m.batangicon.net/alive.php?client=%CLIENTID
hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=uninstall&target=0
hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=load&target=1
hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=update&target=1
hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=install&target=1
hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=load&target=0
hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=update&target=0
hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=install&target=0
%%WINDOWS\CloverPlusext::.cot
%%WINDOWS\CloverPlusprv::.cot
%%WINDOWS\CloverPlus::.cot
%s\%s
%CLIENTID
amclick.wisenut.co.kr
.ilikeclick.com
.overture.com
siteurl_link
FhXXp://VVV.google.com
hXXp://VVV.microsoft.com
%s/dvs/cnf.php
%s/%s/cnf.php
Software\Microsoft\%s
%s_event
%d-%d
hXXp://
Referer: %s
.webstart.
.yorinara.
hXXp://search.cuveus.com/tell.php?s=c&q=
hXXp://search.cuveus.com/tell.php?s=y&q=
ClickUrl
link_url
site_url
hXXp://click.interlink.co.kr/?
*.hellodays.co.kr
*.119data.co.kr
*.searchmap.co.kr
*.xsearch.co.kr
*.yahoo.com
/search/clicklog.php?
*.search82.com
*.dombyshop.co.kr
*.boboscoms.com
KEYWORD=
keyword=
/click.php?
rc14.overture.com
wrs.yahoo.com/_ylt=
shopping.yahoo.co.kr
kr.search.yahoo.com/r/_ylt=
hXXp://wrs.yahoo.com/_ylt=
*.ilikeclick.com
search.n2s.co.kr
*.cuveus.com
*.yozzum.com
*.interlink.co.kr
*.pooc.me
.overture.
/search/clickLog.php
cxclick.php
*.quicknet.co.kr
elink.php
*.yorinara.co.kr
*.webstart.co.kr
Software\Microsoft\Internet Explorer\New Windows\Allow
%s\%s.url
desturl
{3603D0AC-D295-4abb-A4D9-1B307EDB66CA}
SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF24}
SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF23}
SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF22}
SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF21}
SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF20}
{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF24}
{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF23}
{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF22}
{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF21}
{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF20}
%s/lua.php
url02
ovurl
<base href="%s" />
hXXp://srch.minisearch.co.kr/SEARCH/sponsor_log/sponsor_clk.php
md=%s&keyword=%s
hXXp://srch.minisearch.co.kr/SEARCH/click_log.php
x-requested-with: XMLHttpRequest
User-Agent: %s
mg=%s
%s,%s,MINI,Y,sponsor,sponsor,N,%d,-1,X,%d,1
%%WINDOWS\dhid.dh
web_title
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
hXXp://sense.web-guide.co.kr/sense/webguide_sideband.php?type=
hXXp://sense.web-guide.co.kr/sense/squid_gateway.php?affiliate_id=%s&keyword=%s
User-Agent: Mozilla/3.0 (compatible; Indy Library)
%KEYWORD
%SITE
%KEYWORDUTF8
.PAVCInternetException@@
hXXp://%s
CWebBrowser2
hXXp://c.batangicon.net
hXXp://m.batangicon.net
CLSID\%s\InprocServer32
%SYSTEM32
%WINDOWS
%s\Program Files
Software\Microsoft\Windows\CurrentVersion\Run
Content-Type: application/x-www-form-urlencoded
ip=%s&ua=%s&xfip=
Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
Windows CE
Windows NT %d.%d
Windows 98; Win 9x 4.90
Windows 98
Windows 95
Windows %d.%d
Software\Microsoft\Windows\CurrentVersion\Internet Settings
<%s> attribute has error
'<%s> ... </%s>' is not wel-formed.
it must be closed with </%s>
%s must be closed with </%s>
keyname
subper%d
keycycle_b
™%cNX%%%%%
J%FXN)
NcJ%FXNo)M
<assemblyIdentity version="1.0.0.0"
name="YourApp.exe"
<description>YourApp.exe</description>
<requestedExecutionLevel
D27CDB6E-AE6D-11CF-96B8-444553540000
{8856F961-340A-11D0-A96B-00C04FD705A2}
1, 0, 0, 1






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    updater250.exe:912
    clover.exe:1136
    %original file name%.exe:464
    

    2. 

  2. Delete the original Adware file.
    3. 

  3. Delete or disinfect the following files created/modified by the Adware:
    

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\5671\clover.exe (352976 bytes)
    %Program Files%\CloverPlus\clover.exe (2105 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c_exe[1].exe (352976 bytes)
    %WinDir%\CloverPlus.cot (719 bytes)
    %Documents and Settings%\%current user%\Favorites\¿¬°á\¼­Ä¡¹ÙÀ̹Ì.url (95 bytes)
    %Documents and Settings%\%current user%\Favorites\¼­Ä¡¹ÙÀÌ¹Ì - ³»°¡ ¸¸µé¾î°¡´Â °Ë»öÇü ºí·Î±×.url (95 bytes)
    %Documents and Settings%\%current user%\Desktop\¼­Ä¡¹ÙÀ̹Ì.url (95 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchbyme[1].ico (158104 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\alive[1].htm (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    %WinDir%\searchbyme.ico (158104 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    %Program Files%\CloverPlus\updater250.exe (111712 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\c_updater[1].exe (111712 bytes)
    %WinDir%\CloverPlusprv.cot (733 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    

    4. 

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "clover" = "%Program Files%\CloverPlus\clover.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "clover_u" = "%Program Files%\CloverPlus\clover_updater.exe"
    

    5. 

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    6. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now