MD5: 8ce9157890da386be7cca4dd65f0f613
SHA1: eb14d494e8f97c897f9baa180cb0512b5fa43f09
SHA256: 5791f5907e978fb06585c053c7b4885133be78fc2b6dd85ac7faa88cb5e220a1
SSDeep: 6144:oe34YejMW9BaDBFcyR7OjwHXISXJiwmge9qxsuwTTx54XFTMWXMxx2foRMW9BaDp:bqM4aPc N1iZBL4XFTMPdM4aPcu
Size: 399004 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Cinema PlusV07.02
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit

Summary:

Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Payload

No specific payload has been found.

Process activity

The PUP creates the following process(es):

%original file name%.exe:1676

The PUP injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1676 makes changes in the file system.
The PUP creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\b_setup.exe (7846 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\setup.dll (6720 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\conf (113 bytes)

The PUP deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\local.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\conf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\NSISdl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1676 makes changes in the system registry.
The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CA 20 E1 2A 09 3F 36 89 0F 71 43 CB D2 22 0F 14"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp2.tmp\,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the PUP adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ICloud Generator V 3.1.2" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\b_setup.exe"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 385
87af60575e95350381303447cd2e0d96
0b26705557ed087df3a4e86054649170
f66749fac171b2a4f5f2a7550f5e78eb
24490f1552fbe05b0e518433d1c927b4
81128e76322d1d4e63606a027d4d1c36
21970fa6d812a33ffc229b96eceb1bae
ab01e2dc7a26a914027e73bc98eb7452
19c600cd0b59636af78613dc63deff30
d2a635fbacbad0ac837646edca81bf8f
a24506925709abb2c9cd0c419ea2ecd7
1bdf99e3c8aef33fd3f694378574c64e
297ea80c532f1e653b6bfad9b0f5bdcb
c64333ff5aa15b72d05f9604fd5b650c
8bc5e8828e0f2dc2bc636874594512d0
15399070593f311505d112b9c4738605
6cad8969964bda9bf93648e4f8d842c4
bf9d2df7b005ab40b413f9eba9589b95
9462c92f54151d6f6faee759d0be457f
dd4634c10a37abc7eee65626c3f19cc7
2470a83a4efffe5d4f7832796432ea53
94f281f53ee0859ab9149c10edc88c92
a7b0dca6353427d531a8ce0b66b26a97
cd8fa2b9267480f91c4535548e452dd1
30aed6ed499070bc8e5e51d344c1a95a
8889fd1e4a22e8889acd6cb5f84a09ef

URLs

URL	IP
hxxp://pe-wine.club/launch_reb.php?p=sevenzip&pid=1248&tid=3829143&b_typ=pe	46.21.100.248
hxxp://d1gahxamcuu9d3.cloudfront.net/stub_maker.php?program=sevenzip&tid=3829143&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot
hxxp://tadly.fc-greed.website/stub_maker.php?program=sevenzip&tid=3829143&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot	54.230.200.78

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /stub_maker.php?program=sevenzip&tid=3829143&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot HTTP/1.0

Host: tadly.fc-greed.website

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: application/force-download

Content-Length: 80156

Connection: close

Server: Microsoft-IIS/7.5

X-Powered-By: PHP/5.3.28

Content-Disposition: attachment; filename="54e7c6842324c.exe"

X-Powered-By: ASP.NET

Date: Fri, 20 Feb 2015 23:43:00 GMT

X-Cache: Miss from cloudfront

Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: JOnJzyQLiXHBCMl1Ma_oTfSgQsEKmP8Qo8-sJqdtw54gHzBnl3PGQA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z...........0.......p....@.........
.................................................................s....
.......@..............................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
[email protected]...@[email protected].
[email protected]..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
..>[email protected].>[email protected]
...Pr@..}[email protected]... M.......M....3.....FQ.....NU..
M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...
[email protected]}[email protected].}.j.W.E......E.......Pp@.
[email protected]@.W...E..E.h [email protected]...\r
@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.
......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[...U.
<<< skipped >>>

GET /launch_reb.php?p=sevenzip&pid=1248&tid=3829143&b_typ=pe HTTP/1.0

Host: pe-wine.club

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Date: Fri, 20 Feb 2015 23:43:48 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 113

Connection: close

Content-Type: text/html; charset=UTF-8
s=boot..u=hXXp://tadly.fc-greed.website/stub_maker.php?program=sevenzi
p&tid=3829143&pid=1248&b_typ=pe&reb=1&name=..

The PUP connects to the servers at the folowing location(s):

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1676

2. Delete the original PUP file.
   
3. Delete or disinfect the following files created/modified by the PUP:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\b_setup.exe (7846 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\setup.dll (6720 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\NSISdl.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\conf (113 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
   "ICloud Generator V 3.1.2" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\b_setup.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.