Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\nsm9251.tmp\BI.exe' { "user_ie_security_level" : "" , "json_send_time" : "16/4/2013 21:21:2:79" , "internal_error_description" : "HttpPost result: try1- Cannot load xml file %TEMP%\nsm9251.tmp\offer.xml; try2- Cannot load xml file %TEMP%\nsm9251.tmp\offer.xml; try3- Cannot load xml file %TEMP%\nsm9251.tmp\offer.xml" , "internal_error_number" : "3" , "is_parallel" : "0" , "vector_id" : "" , "rule_id" : "" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "551832" , "general_status_code" : "3" , "duration_details" : " InitPluginsDir:15 initializeParams:250 load_BITool:15 send_BI_Init:78 load_DownloadACC:63 retrieveUISource:15 unpack_webappfolder:1810 unpack_icon:16 RetrieveMainOfferKey:0 unpack_OpenCandyDll:109 load_webapphost:0 unpack_ProxyInstaller:31 navigate_loadingUI:140 navigateAsync_constMainOffer:812 BuildUserProfile:156 retrieve cid:0 callService1:13291 callService1:1342 callService1:1528 " , "phase_duration" : "" , "error_details" : "Error Parsing the offer xml response file" , "result" : "Error" , "user_operating_system_bits" : "" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "" , "user_acount_type" : "" , "user_ie_version" : "" , "user_default_browser_version" : "" , "user_default_browser" : "" , "user_service_pack" : "" , "user_operating_system" : "" , "revision_number" : "12" , "build_id" : "00000000" , "dm_version" : "1.3.7.8_HF7" , "bundle_id" : "b5b008a3-95e0-4878-b256-cf146b0745e8" , "machine_user_id" : "{C92F3A24-6F43-4DEE-AB1F-7DB410AB05FE}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "E9E8B883-270C-46DD-8D6B-DDBA3C22439C" , "publisher_internal_id" : "27" , "publisher_id" : "Avi Goldfinger" , "publisher_account_id" : "Avi_Goldfinger" , "order" : "2.0" , "phase" : "InitComplete" , "Is_Test" : "0" }
- '%TEMP%\nsm9251.tmp\BI.exe' { "json_send_time" : "16/4/2013 21:20:42:688" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "551832" , "user_type" : "NULL" , "result" : "Success" , "user_operating_system_bits" : "" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "" , "user_acount_type" : "" , "user_ie_version" : "" , "user_default_browser_version" : "" , "user_default_browser" : "" , "user_service_pack" : "" , "user_operating_system" : "" , "revision_number" : "12" , "build_id" : "00000000" , "dm_version" : "1.3.7.8_HF7" , "bundle_id" : "b5b008a3-95e0-4878-b256-cf146b0745e8" , "machine_user_id" : "{C92F3A24-6F43-4DEE-AB1F-7DB410AB05FE}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "E9E8B883-270C-46DD-8D6B-DDBA3C22439C" , "publisher_internal_id" : "27" , "publisher_id" : "Avi Goldfinger" , "publisher_account_id" : "Avi_Goldfinger" , "order" : "1.0" , "phase" : "Init" , "Is_Test" : "0" }
Запускает на исполнение:
- '<SYSTEM32>\conhost.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsm9251.tmp\WebApp\Js\json2debug.js
- %TEMP%\nsm9251.tmp\WebApp\Js\json2minified.js
- %TEMP%\nsm9251.tmp\WebApp\Js\json2.js
- %TEMP%\nsm9251.tmp\WebApp\Js\jquery-ui-1.8.16.custom.min.js
- %TEMP%\nsm9251.tmp\WebApp\Js\jquery.min.js
- %TEMP%\nsm9251.tmp\OCSetupHlp.dll
- %TEMP%\nsm9251.tmp\ProxyInstaller.exe
- %TEMP%\nsm9251.tmp\icon.png
- %TEMP%\nsm9251.tmp\WebApp\Js\script.js
- %TEMP%\nsm9251.tmp\WebApp\Js\xml2json.js
- %TEMP%\nsm9251.tmp\WebApp\Images\truste.png
- %TEMP%\nsm9251.tmp\WebApp\Js\API.js
- %TEMP%\nsm9251.tmp\WebApp\Images\myiweb-logo.png
- %TEMP%\nsm9251.tmp\WebApp\Images\loaderb64-transparent.gif
- %TEMP%\nsm9251.tmp\WebApp\Images\myiweb-logo.jpg
- %TEMP%\nsm9251.tmp\WebApp\Js\ProgressBar.js
- %TEMP%\nsm9251.tmp\WebApp\Js\Store.js
- %TEMP%\nsm9251.tmp\WebApp\Js\PIE.htc
- %TEMP%\nsm9251.tmp\WebApp\Js\DD_belatedPNG_0.0.8a-min.js
- %TEMP%\nsm9251.tmp\WebApp\Js\ExternalParams.js
- %TEMP%\nsm9251.tmp\inetc.dll
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\bullet[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\background_gradient[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\info_48[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\errorPageStrings[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\httpErrorPagesScripts[1]
- %WINDIR%\Temp\MPTelemetrySubmit\watson_manifest.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_80070422_76a4385aa7fdcd3dc476f7ea51e8ea5565f02fd_06a1223f\Report.wer
- %WINDIR%\Temp\MPTelemetrySubmit\client_manifest.txt
- %TEMP%\nsmE225.tmp\inetc.dll
- %TEMP%\nsmE225.tmp\a.txt
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\jquery.min[1].js
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\error[1]
- %TEMP%\nsm9251.tmp\xml.dll
- %TEMP%\nsm96E3.tmp\a.txt
- %TEMP%\nsm9251.tmp\offer.xml
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\navcancl[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\ErrorPageTemplate[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\551529[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\error[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\warning[1]
- %TEMP%\nsm9251.tmp\WebApp\Images\conduit-logo.png
- %TEMP%\nsm9251.tmp\WebApp\Css\Buttons.rtl.css
- %TEMP%\nsm9251.tmp\WebApp\Css\Copy of Buttons.css
- %TEMP%\nsm9251.tmp\WebApp\Css\Buttons.ltr.css
- %TEMP%\nsm9251.tmp\WebApp\SilentSuccess.htm
- %TEMP%\nsm9251.tmp\WebApp\Css\Buttons.css
- %TEMP%\nsm9251.tmp\WebApp\Css\css.ltr.css
- %TEMP%\nsm9251.tmp\WebApp\Css\css.rtl.css
- %TEMP%\nsm9251.tmp\WebApp\Css\css.css
- %TEMP%\nsm9251.tmp\WebApp\Css\PIE.htc
- %TEMP%\nsm9251.tmp\WebApp\Css\Reset.css
- %TEMP%\nsm9251.tmp\DownloadACC.exe
- %TEMP%\nsm9251.tmp\WebApp\Failed.htm
- %TEMP%\nsm9251.tmp\BI.exe
- %TEMP%\nsm9251.tmp\System.dll
- %TEMP%\nsm9251.tmp\webapphost.dll
- %TEMP%\nsm9251.tmp\WebApp\ProgressBar.htm
- %TEMP%\nsm9251.tmp\WebApp\Reset.css
- %TEMP%\nsm9251.tmp\WebApp\PIE.htc
- %TEMP%\nsm9251.tmp\WebApp\Loading.htm
- %TEMP%\nsm9251.tmp\WebApp\NoneSilentSuccess.htm
- %TEMP%\nsm9251.tmp\WebApp\Images\-.png
- %TEMP%\nsm9251.tmp\WebApp\Images\Nana10.png
- %TEMP%\nsm9251.tmp\WebApp\Images\NextButton_Sprite wide.png
- %TEMP%\nsm9251.tmp\WebApp\Images\InternetTurbo.png
- %TEMP%\nsm9251.tmp\WebApp\Images\InstallationFailed.png
- %TEMP%\nsm9251.tmp\WebApp\Images\InstallationSuccessful.png
- %TEMP%\nsm9251.tmp\WebApp\Images\button_grey_close.png
- %TEMP%\nsm9251.tmp\WebApp\Images\check-V.png
- %TEMP%\nsm9251.tmp\WebApp\Images\button.png
- %TEMP%\nsm9251.tmp\WebApp\Images\X.png
- %TEMP%\nsm9251.tmp\WebApp\Images\bla.png
- %TEMP%\nsm9251.tmp\WebApp\Images\4e9cf9e9-dc9b-4640-832e-afbf4f2d0e5d.png
- %TEMP%\nsm9251.tmp\WebApp\Images\BG.png
- %TEMP%\nsm96E3.tmp\inetc.dll
- %TEMP%\nsm9251.tmp\WebApp\Images\01Net-Logo.jpg
- %TEMP%\nsm9251.tmp\WebApp\Images\1JPJ.jpg
- %TEMP%\nsm9251.tmp\WebApp\Images\CancelBG.png
- %TEMP%\nsm9251.tmp\WebApp\Images\CancelBGGoogleDialog.png
- %TEMP%\nsm9251.tmp\WebApp\Images\BrotherSoft.png
- %TEMP%\nsm9251.tmp\WebApp\Images\BoxBg.png
- %TEMP%\nsm9251.tmp\WebApp\Images\BoxBgNew.png
Удаляет следующие файлы:
- %TEMP%\nsmE225.tmp\inetc.dll
- %WINDIR%\Temp\MPTelemetrySubmit\watson_manifest.txt
- %WINDIR%\Temp\MPTelemetrySubmit\client_manifest.txt
- %TEMP%\nsm96E3.tmp\a.txt
- %TEMP%\nsm96E3.tmp\inetc.dll
- %TEMP%\nsmE225.tmp\a.txt
Сетевая активность:
Подключается к:
- 'aj##.#oogleapis.com':80
- 'cm#.########tionengine.conduit-services.com':80
- '20#.#6.232.182':80
- 'localhost':62703
- 'ud#.###duit-data.com':80
- 'of######.#######.distributionengine.conduit-services.com':80
TCP:
Запросы HTTP GET:
- cm#.########tionengine.conduit-services.com//MainOffer/551529/?Cu##############################################
- aj##.#oogleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js
Запросы HTTP POST:
- ud#.###duit-data.com/
UDP:
- DNS ASK aj##.#oogleapis.com
- DNS ASK cm#.########tionengine.conduit-services.com
- DNS ASK wa####.microsoft.com
- DNS ASK of######.#######.distributionengine.conduit-services.com
- DNS ASK ud#.###duit-data.com
- '22#.0.0.252':5355
