Gen.Variant.Adware.Symmi.43685_9ac2819d8d

by malwarelabrobot on August 4th, 2014 in Malware Descriptions.

not-a-virus:AdWare.Win32.BetterSurf.b (Kaspersky), Gen:Variant.Adware.Symmi.43685 (AdAware)
Behaviour: Adware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 9ac2819d8d52bdff4656d71389747c6c
SHA1: 90d2772ea748dcf5404dd2f9743b82d7a231c143
SHA256: 12536cfeeace4d00c649715f678ff30bca086eef66f288cddf4099380a644c84
SSDeep: 12288:DRSAnNXG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BTq4ya/QTcJ8ePx/b5uO7ALvHXAU:D4oXG4GQm4OaHYJ8eP4D5uOHBBm4yaed
Size: 673736 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Appsinstall
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit


Summary:

Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Payload

No specific payload has been found.

Process activity

The PUP creates the following process(es):

%original file name%.exe:1252

The PUP injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1252 makes changes in the file system.
The PUP creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsc2.tmp\aminsis.dll (12792 bytes)

The PUP deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2.tmp\aminsis.dll (0 bytes)

Registry activity

The process %original file name%.exe:1252 makes changes in the system registry.
The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE E7 5F CD 1F B9 38 79 8C 6A AD 98 1F 31 95 B3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc2.tmp\aminsis.dll,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

MD5 File path
450753ad96785a240a39deccab3af0d0 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsc2.tmp\aminsis.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Rich Media View
Product Name: Rich Media View release 484
Product Version: 1.1
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.1
File Description:
Comments:
Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 23628 24064 4.46394 856b32eb77dfd6fb67f21d6543272da5
.rdata 28672 4764 5120 3.4982 dc77f8a1e6985a4361c55642680ddb4f
.data 36864 154712 1024 3.3278 7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata 192512 45056 0 0 d41d8cd98f00b204e9800998ecf8427e
.rsrc 237568 3144 3584 2.93155 9e32741be4c51069007cf0c37b983f2f

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 131
22896c2530bfc5c51b1ebdf948693ee1
9ce321523274d078ae76b858aa433a62
5fe38bad8e5a32f44298fcda50141777
b1be454f65a009e28acbd68a45d99d81
54cc3f1ec749c18037b2102cf1045937
1541a1013daa7ab5c46743e907d1bd12
dfdeea0d7c0ebddd905374d2fabdca8d
b7859d7d82d62eecf5130eca0acff970
c131d7bd1f738d156a2b7273503ac98c
35c6cf7ff88b36099ab73a83faf74922
b48294711bfdc64d620c27ecda37142d
1d45264f391ceb347662c060142f9dbd
e5a115003cb58031dbd688e8959287bb
382f80be1320326a254130652f9ccf02
f7cb71358efe6a9fe1cd1f86ca0895f1
5b690feae04d3337d04d8e779d84c53e
de8879da602249e4040acc5680942c9f
37b63a19d4ac3557a8b5cd3307ad2d82
a8f318fb99d7f565ab86e77e3f9a14af
4fa744c5a2d0b40bf23768a65b0c4f06
c5fe7b573cc0bb84f59a0243be07fd0e
a746001470b122c02ace2e6fab6ede53
6bf36093a9bfc2ee79a13b2389762e1b
eaa5e1b357a04665441e4564388092e4
e21f498d85ab20375dc75dc677a5bb91

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The PUP connects to the servers at the folowing location(s):

Strings from Dumps were not found.


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:1252

  2. Delete the original PUP file.
  3. Delete or disinfect the following files created/modified by the PUP:

    %Documents and Settings%\%current user%\Local Settings\Temp\nsc2.tmp\aminsis.dll (12792 bytes)

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet

x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now