Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\DllHost.exe' /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\ish667309\images\BG_gray.gif
- %TEMP%\ish667309\images\Close.png
- %TEMP%\ish667309\DAT\upd.DAT
- %TEMP%\ish667309\images\BG.gif
- %TEMP%\ish667309\images\Close_gray.png
- %TEMP%\ish667309\images\Color_Button.png
- %TEMP%\ish667309\images\Color_Button_gray.png
- %TEMP%\ish667309\images\Close_Hover.png
- %TEMP%\ish667309\images\Close_Hover_gray.png
- %TEMP%\ish667309\css\sdk-ui\checkbox.css
- %TEMP%\ish667309\css\sdk-ui\images\button-bg.png
- %TEMP%\ish667309\css\sdk-ui\browse.css
- %TEMP%\ish667309\css\sdk-ui\button.css
- %TEMP%\ish667309\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\ish667309\css\sdk-ui\progress-bar.css
- %TEMP%\ish667309\csshover3.htc
- %TEMP%\ish667309\css\sdk-ui\images\progress-bg.png
- %TEMP%\ish667309\css\sdk-ui\images\progress-bg2.png
- %TEMP%\ish667309\images\Color_Button_Hover.png
- %TEMP%\ish667309\locale\EN.locale
- %TEMP%\ish667309\bootstrap_57611.html
- %TEMP%\ish667309\images\xxClose.png
- %TEMP%\ish667309\images\xxProgressBar.png
- %PROGRAM_FILES%\is673393.log
- %HOMEPATH%\Desktop\Continue PDF Reader Installation.lnk
- %TEMP%\000A5198.log
- %TEMP%\ICReinstall_<Имя вируса>.exe
- %TEMP%\ish667309\images\Grey_Button_Hover.png
- %TEMP%\ish667309\images\icon.png
- %TEMP%\ish667309\images\Color_Button_Hover_gray.png
- %TEMP%\ish667309\images\Grey_Button.png
- %TEMP%\ish667309\images\icon_gray.png
- %TEMP%\ish667309\images\ProgressBar.png
- %TEMP%\ish667309\images\ssClose_Hover.png
- %TEMP%\ish667309\images\Loader.gif
- %TEMP%\ish667309\images\Progress.png
- %TEMP%\ish667309\css\main.css
- %TEMP%\ish660414\csshover3.htc
- %TEMP%\ish660414\DAT\upd.DAT
- %TEMP%\ish660414\css\sdk-ui\images\progress-bg2.png
- %TEMP%\ish660414\css\sdk-ui\progress-bar.css
- %TEMP%\ish660414\images\BG.gif
- %TEMP%\ish660414\images\Close_gray.png
- %TEMP%\ish660414\images\Close_Hover.png
- %TEMP%\ish660414\images\BG_gray.gif
- %TEMP%\ish660414\images\Close.png
- %TEMP%\ish660414\css\main.css
- %TEMP%\ish660414\css\sdk-ui\browse.css
- %TEMP%\000A12E4.log
- %TEMP%\ish660414\css\ie6_main.css
- %TEMP%\ish660414\css\sdk-ui\button.css
- %TEMP%\ish660414\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\ish660414\css\sdk-ui\images\progress-bg.png
- %TEMP%\ish660414\css\sdk-ui\checkbox.css
- %TEMP%\ish660414\css\sdk-ui\images\button-bg.png
- %TEMP%\ish660414\images\Close_Hover_gray.png
- %TEMP%\ish660414\images\ssClose_Hover.png
- %TEMP%\ish660414\images\xxClose.png
- %TEMP%\ish660414\images\Progress.png
- %TEMP%\ish660414\images\ProgressBar.png
- %TEMP%\ish660414\images\xxProgressBar.png
- %TEMP%\000A2EAD.log
- %TEMP%\ish667309\css\ie6_main.css
- %TEMP%\ish660414\locale\EN.locale
- %TEMP%\000A2C3D.log
- %TEMP%\ish660414\images\Color_Button_Hover.png
- %TEMP%\ish660414\images\Color_Button_Hover_gray.png
- %TEMP%\ish660414\images\Color_Button.png
- %TEMP%\ish660414\images\Color_Button_gray.png
- %TEMP%\ish660414\images\Grey_Button.png
- %TEMP%\ish660414\images\icon_gray.png
- %TEMP%\ish660414\images\Loader.gif
- %TEMP%\ish660414\images\Grey_Button_Hover.png
- %TEMP%\ish660414\images\icon.png
Удаляет следующие файлы:
- %TEMP%\ish660414\images\icon.png
- %TEMP%\ish660414\images\Grey_Button_Hover.png
- %TEMP%\ish660414\images\Loader.gif
- %TEMP%\ish660414\images\icon_gray.png
- %TEMP%\ish660414\images\Grey_Button.png
- %TEMP%\ish660414\images\Color_Button_gray.png
- %TEMP%\ish660414\images\Color_Button.png
- %TEMP%\ish660414\images\Color_Button_Hover_gray.png
- %TEMP%\ish660414\images\Color_Button_Hover.png
- %TEMP%\ish660414\images\Progress.png
- %PROGRAM_FILES%\is673393.log
- %TEMP%\ish660414\locale\EN.locale
- %TEMP%\ish667309\bootstrap_57611.html
- %TEMP%\000A5198.log
- %TEMP%\000A2EAD.log
- %TEMP%\ish660414\images\ssClose_Hover.png
- %TEMP%\ish660414\images\ProgressBar.png
- %TEMP%\ish660414\images\xxProgressBar.png
- %TEMP%\ish660414\images\xxClose.png
- %TEMP%\ish660414\images\Close_Hover_gray.png
- %TEMP%\ish660414\css\sdk-ui\checkbox.css
- %TEMP%\ish660414\css\sdk-ui\button.css
- %TEMP%\ish660414\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\ish660414\css\sdk-ui\images\button-bg.png
- %TEMP%\ish660414\css\sdk-ui\browse.css
- %TEMP%\000A2C3D.log
- %TEMP%\000A12E4.log
- %TEMP%\ish660414\css\main.css
- %TEMP%\ish660414\css\ie6_main.css
- %TEMP%\ish660414\css\sdk-ui\images\progress-bg.png
- %TEMP%\ish660414\images\Close.png
- %TEMP%\ish660414\images\BG_gray.gif
- %TEMP%\ish660414\images\Close_Hover.png
- %TEMP%\ish660414\images\Close_gray.png
- %TEMP%\ish660414\images\BG.gif
- %TEMP%\ish660414\css\sdk-ui\progress-bar.css
- %TEMP%\ish660414\css\sdk-ui\images\progress-bg2.png
- %TEMP%\ish660414\DAT\upd.DAT
- %TEMP%\ish660414\csshover3.htc
Сетевая активность:
Подключается к:
- 'rp.####dfreaderapp.com':80
- 'os#.###pdfreaderapp.com':80
- 'cd###.##epdfreaderapp.com':80
- 'os#####.thepdfreaderapp.com':80
TCP:
Запросы HTTP GET:
- cd###.##epdfreaderapp.com/app/Cmp/PDF-Reader-v2.cis
Запросы HTTP POST:
- rp.####dfreaderapp.com/?pc#############
- os#.###pdfreaderapp.com/CM/?v=###############
- os#####.thepdfreaderapp.com/CM/?v=###############
- rp.####dfreaderapp.com/?pc############
UDP:
- DNS ASK rp.####dfreaderapp.com
- DNS ASK os#.###pdfreaderapp.com
- DNS ASK cd###.##epdfreaderapp.com
- DNS ASK os#####.thepdfreaderapp.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebCheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
