Gen.Packed.FakeAV.2_584388a669

by malwarelabrobot on August 9th, 2016 in Malware Descriptions.

Gen:Packed.FakeAV.2 (BitDefender), TrojanSpy:Win32/Nivdort.Y (Microsoft), HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Packed.FakeAV.2 (B) (Emsisoft), Heur.AdvML.B (Symantec), Win32.Fosforo (Ikarus), Gen:Packed.FakeAV.2 (FSecure), Win32:Stealer-DQ [Trj] (Avast), Gen:Packed.FakeAV.2 (AdAware), GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan-Spy, Trojan, Fake-AV, Packed


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 584388a669225b29232c8581a9688424
SHA1: ca0983fc78b3505d22ac2148856f6714314080b5
SHA256: 7f42e92f286d3eb7d41df4ad171476e18943435c4be201866fd1571f981fffcc
SSDeep: 3072:cHEaljAVydnIQnseh1fsppJx7E7kyyFRkTU:cHE4v1hh56Jx7E78oU
Size: 123864 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2016-05-23 14:46:22
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan-Spy. Spy program intended for stealing user's confidential data.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1004

The Trojan injects its code into the following process(es):

vmacthlp.exe:936
wmiprvse.exe:468
lsass.exe:776
spoolsv.exe:1448
Explorer.EXE:1684
jqs.exe:1972

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1004 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\JibyEvxo\TordUlcac.exe (123 bytes)

The Trojan deletes the following file(s):

C:\%original file name%.exe (0 bytes)

Registry activity

The process vmacthlp.exe:936 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process %original file name%.exe:1004 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 51 1E 68 D6 33 9F 6B BB 0E 32 FC 49 66 4E 51"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GupuQjep" = "%Documents and Settings%\All Users\Application Data\JibyEvxo\TordUlcac.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in kernel32.dll:

CreateProcessInternalW

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 1952 2048 4.34383 e2a077eabc08414eefabdf27052378b3
bss 8192 48 0 0 d41d8cd98f00b204e9800998ecf8427e
.rdata 12288 664 1024 2.43563 46287cb0c778ae192c2757af9b19fd89
.rsrc 16384 100020 100352 5.54355 170d9f71a6a2e400040cefc07cfdf9cb

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

wmiprvse.exe_468_rwx_00DD0000_00027000:

c:\%original file name%.exe
.text
.rdata
@.data
.reloc
u.Sh8
KERNEL32.DLL
%u(%u)
user32.dll
kernelbase.dll
\notepad.exe
iertutil.dll
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
hXXp://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
dbghelp.dll
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryW
WinExec
KERNEL32.dll
USER32.dll
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExA
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExW
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
CertOpenStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
PFXImportCertStore
CertEnumCertificatesInStore
CRYPT32.dll
NETAPI32.dll
SHLWAPI.dll
IPHLPAPI.DLL
MSVCRT.dll
GetProcessHeap
RegCreateKeyA
CryptImportKey
CryptDestroyKey
HttpSendRequestExA
HttpQueryInfoA
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpSendRequestA
WININET.dll
7&7,747:7
.pdata
@.reloc
SHELL32.DLL
msvcrt.dll
DelegateExecute
%s\%s.txt
iexplore.exe
firefox.exe
explorer.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\kernelbase.dll

lsass.exe_776_rwx_00AC0000_00027000:

c:\%original file name%.exe
.text
.rdata
@.data
.reloc
u.Sh8
KERNEL32.DLL
%u(%u)
user32.dll
kernelbase.dll
\notepad.exe
iertutil.dll
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
hXXp://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
dbghelp.dll
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryW
WinExec
KERNEL32.dll
USER32.dll
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExA
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExW
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
CertOpenStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
PFXImportCertStore
CertEnumCertificatesInStore
CRYPT32.dll
NETAPI32.dll
SHLWAPI.dll
IPHLPAPI.DLL
MSVCRT.dll
GetProcessHeap
RegCreateKeyA
CryptImportKey
CryptDestroyKey
HttpSendRequestExA
HttpQueryInfoA
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpSendRequestA
WININET.dll
7&7,747:7
.pdata
@.reloc
SHELL32.DLL
msvcrt.dll
DelegateExecute
%s\%s.txt
iexplore.exe
firefox.exe
explorer.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\kernelbase.dll

wmiprvse.exe_468_rwx_00F00000_00014000:

.text
.rdata
@.data
.reloc
u.Sh8
KERNEL32.DLL
%u(%u)
user32.dll
kernelbase.dll
\notepad.exe
iertutil.dll
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
hXXp://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
dbghelp.dll
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryW
WinExec
KERNEL32.dll
USER32.dll
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExA
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExW
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
CertOpenStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
PFXImportCertStore
CertEnumCertificatesInStore
CRYPT32.dll
NETAPI32.dll
SHLWAPI.dll
IPHLPAPI.DLL
MSVCRT.dll
GetProcessHeap
RegCreateKeyA
CryptImportKey
CryptDestroyKey
HttpSendRequestExA
HttpQueryInfoA
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpSendRequestA
WININET.dll
7&7,747:7
DelegateExecute
%s\%s.txt
iexplore.exe
firefox.exe
explorer.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\kernelbase.dll

lsass.exe_776_rwx_00BC0000_00014000:

.text
.rdata
@.data
.reloc
u.Sh8
KERNEL32.DLL
%u(%u)
user32.dll
kernelbase.dll
\notepad.exe
iertutil.dll
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
hXXp://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
dbghelp.dll
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryW
WinExec
KERNEL32.dll
USER32.dll
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExA
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExW
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
CertOpenStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
PFXImportCertStore
CertEnumCertificatesInStore
CRYPT32.dll
NETAPI32.dll
SHLWAPI.dll
IPHLPAPI.DLL
MSVCRT.dll
GetProcessHeap
RegCreateKeyA
CryptImportKey
CryptDestroyKey
HttpSendRequestExA
HttpQueryInfoA
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpSendRequestA
WININET.dll
7&7,747:7
DelegateExecute
%s\%s.txt
iexplore.exe
firefox.exe
explorer.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\kernelbase.dll

spoolsv.exe_1448_rwx_00B60000_00027000:

c:\%original file name%.exe
.text
.rdata
@.data
.reloc
u.Sh8
KERNEL32.DLL
%u(%u)
user32.dll
kernelbase.dll
\notepad.exe
iertutil.dll
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
hXXp://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
dbghelp.dll
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryW
WinExec
KERNEL32.dll
USER32.dll
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExA
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExW
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
CertOpenStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
PFXImportCertStore
CertEnumCertificatesInStore
CRYPT32.dll
NETAPI32.dll
SHLWAPI.dll
IPHLPAPI.DLL
MSVCRT.dll
GetProcessHeap
RegCreateKeyA
CryptImportKey
CryptDestroyKey
HttpSendRequestExA
HttpQueryInfoA
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpSendRequestA
WININET.dll
7&7,747:7
.pdata
@.reloc
SHELL32.DLL
msvcrt.dll
DelegateExecute
%s\%s.txt
iexplore.exe
firefox.exe
explorer.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\kernelbase.dll

spoolsv.exe_1448_rwx_00F40000_00014000:

.text
.rdata
@.data
.reloc
u.Sh8
KERNEL32.DLL
%u(%u)
user32.dll
kernelbase.dll
\notepad.exe
iertutil.dll
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
hXXp://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
dbghelp.dll
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryW
WinExec
KERNEL32.dll
USER32.dll
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExA
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExW
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
CertOpenStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
PFXImportCertStore
CertEnumCertificatesInStore
CRYPT32.dll
NETAPI32.dll
SHLWAPI.dll
IPHLPAPI.DLL
MSVCRT.dll
GetProcessHeap
RegCreateKeyA
CryptImportKey
CryptDestroyKey
HttpSendRequestExA
HttpQueryInfoA
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpSendRequestA
WININET.dll
7&7,747:7
DelegateExecute
%s\%s.txt
iexplore.exe
firefox.exe
explorer.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\kernelbase.dll

Explorer.EXE_1684_rwx_00ED0000_00027000:

c:\%original file name%.exe
.text
.rdata
@.data
.reloc
u.Sh8
KERNEL32.DLL
%u(%u)
user32.dll
kernelbase.dll
\notepad.exe
iertutil.dll
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
hXXp://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
dbghelp.dll
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryW
WinExec
KERNEL32.dll
USER32.dll
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExA
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExW
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
CertOpenStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
PFXImportCertStore
CertEnumCertificatesInStore
CRYPT32.dll
NETAPI32.dll
SHLWAPI.dll
IPHLPAPI.DLL
MSVCRT.dll
GetProcessHeap
RegCreateKeyA
CryptImportKey
CryptDestroyKey
HttpSendRequestExA
HttpQueryInfoA
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpSendRequestA
WININET.dll
7&7,747:7
.pdata
@.reloc
SHELL32.DLL
msvcrt.dll
DelegateExecute
%s\%s.txt
iexplore.exe
firefox.exe
explorer.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\kernelbase.dll

jqs.exe_1972_rwx_010B0000_00027000:

c:\%original file name%.exe
.text
.rdata
@.data
.reloc
u.Sh8
KERNEL32.DLL
%u(%u)
user32.dll
kernelbase.dll
\notepad.exe
iertutil.dll
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
hXXp://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
dbghelp.dll
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryW
WinExec
KERNEL32.dll
USER32.dll
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExA
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExW
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
CertOpenStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
PFXImportCertStore
CertEnumCertificatesInStore
CRYPT32.dll
NETAPI32.dll
SHLWAPI.dll
IPHLPAPI.DLL
MSVCRT.dll
GetProcessHeap
RegCreateKeyA
CryptImportKey
CryptDestroyKey
HttpSendRequestExA
HttpQueryInfoA
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpSendRequestA
WININET.dll
7&7,747:7
.pdata
@.reloc
SHELL32.DLL
msvcrt.dll
DelegateExecute
%s\%s.txt
iexplore.exe
firefox.exe
explorer.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\kernelbase.dll

Explorer.EXE_1684_rwx_01FF0000_00014000:

.text
.rdata
@.data
.reloc
u.Sh8
KERNEL32.DLL
%u(%u)
user32.dll
kernelbase.dll
\notepad.exe
iertutil.dll
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
hXXp://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
dbghelp.dll
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryW
WinExec
KERNEL32.dll
USER32.dll
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExA
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExW
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
CertOpenStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
PFXImportCertStore
CertEnumCertificatesInStore
CRYPT32.dll
NETAPI32.dll
SHLWAPI.dll
IPHLPAPI.DLL
MSVCRT.dll
GetProcessHeap
RegCreateKeyA
CryptImportKey
CryptDestroyKey
HttpSendRequestExA
HttpQueryInfoA
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpSendRequestA
WININET.dll
7&7,747:7
DelegateExecute
%s\%s.txt
iexplore.exe
firefox.exe
explorer.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\kernelbase.dll

jqs.exe_1972_rwx_011E0000_00014000:

.text
.rdata
@.data
.reloc
u.Sh8
KERNEL32.DLL
%u(%u)
user32.dll
kernelbase.dll
\notepad.exe
iertutil.dll
Content-Type: application/x-www-form-urlencoded
aSHELL32.DLL
hXXp://
hXXps://
PID: %u [%0.2u:%0.2u:%0.2u]
ntdll.dll
dbghelp.dll
\%u.dmp
GetWindowsDirectoryA
GetWindowsDirectoryW
WinExec
KERNEL32.dll
USER32.dll
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExA
RegEnumKeyW
RegOpenKeyExA
RegOpenKeyExW
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
CertOpenStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertCloseStore
PFXImportCertStore
CertEnumCertificatesInStore
CRYPT32.dll
NETAPI32.dll
SHLWAPI.dll
IPHLPAPI.DLL
MSVCRT.dll
GetProcessHeap
RegCreateKeyA
CryptImportKey
CryptDestroyKey
HttpSendRequestExA
HttpQueryInfoA
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersA
HttpSendRequestA
WININET.dll
7&7,747:7
DelegateExecute
%s\%s.txt
iexplore.exe
firefox.exe
explorer.exe
chrome.exe
\System32\KERNEL32.DLL
\System32\kernelbase.dll


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:1004

  3. Delete the original Trojan file.
  4. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\All Users\Application Data\JibyEvxo\TordUlcac.exe (123 bytes)

  5. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "GupuQjep" = "%Documents and Settings%\All Users\Application Data\JibyEvxo\TordUlcac.exe"

  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now