Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding 1C3120D0DC1881AD2EBBA8F1DD81C4CE
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' /i "<SYSTEM32>\1.msi" /qn /norestart
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\EasyMP3Downloader\res\welcome.swf
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\buynow.gif
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\All.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\bg.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\Pop.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\Rock.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\More & Other.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\res\loading.swf
- %PROGRAM_FILES%\EasyMP3Downloader\res\categories_en.html
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\_downloading.gif
- %PROGRAM_FILES%\EasyMP3Downloader\lang\English.lan
- %PROGRAM_FILES%\EasyMP3Downloader\EasyMP3Downloader.exe
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\Blues.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\_popunit.gif
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\_play.gif
- %PROGRAM_FILES%\EasyMP3Downloader\uninst.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Easy MP3 Downloader\Uninstall Easy MP3 Downloader.lnk
- %WINDIR%\Installer\{B01A3722-5D6F-408B-A7AF-42D83537F133}\_.exe
- %PROGRAM_FILES%\EasyMP3Downloader\swscale-0.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Easy MP3 Downloader\Easy MP3 Downloader.lnk
- %HOMEPATH%\Desktop\Secenekler Menusu 2013.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\3909592[1]
- %HOMEPATH%\Desktop\EasyMP3Downloader.lnk
- %TEMP%\aut9.tmp
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\trialbg.png
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\World Music.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\R&B & Soul.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\Religious.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\res\trialnotify.mht
- %PROGRAM_FILES%\EasyMP3Downloader\skins\default.skn
- %PROGRAM_FILES%\EasyMP3Downloader\res\player.dat
- %PROGRAM_FILES%\EasyMP3Downloader\res\result_en.html
- %PROGRAM_FILES%\EasyMP3Downloader\res\keywordlist_en.html
- %PROGRAM_FILES%\EasyMP3Downloader\avcodec-52.dll
- %WINDIR%\Installer\MSI6.tmp
- C:\Config.Msi\28517.rbs
- %PROGRAM_FILES%\EasyMP3Downloader\avcore-0.dll
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\_playing.gif
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\_download.gif
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\entersn.gif
- %TEMP%\aut2.tmp
- <SYSTEM32>\1.msi
- %TEMP%\aut1.tmp
- %TEMP%\obgxcwo
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\28514.msi
- %WINDIR%\Installer\MSI3.tmp
- %PROGRAM_FILES%\EasyMP3Downloader\avformat-52.dll
- %PROGRAM_FILES%\EasyMP3Downloader\const.dat
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\Country & Folk.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\SDL.dll
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\Jazz.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\avutil-50.dll
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\about.png
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\Classical.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\avdevice-52.dll
- %PROGRAM_FILES%\EasyMP3Downloader\avfilter-1.dll
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\Electronic.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\c_cospel.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\Indie & Alertnative.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\_tabheadbg.gif
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\Rap & Hip-Hop.jpg
- %PROGRAM_FILES%\EasyMP3Downloader\res\images\_star.gif
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\1.msi
Deletes the following files:
- C:\Config.Msi\28517.rbs
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\28514.msi
- %TEMP%\aut9.tmp
- <SYSTEM32>\1.msi
- %WINDIR%\Installer\MSI5.tmp
- %TEMP%\obgxcwo
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI3.tmp
Network activity:
Connects to:
- 'ul.to':80
- 'localhost':1035
TCP:
HTTP GET requests:
- ul.to/ref/3909592
UDP:
- DNS ASK ul.to
Miscellaneous:
Searches for the following windows:
- ClassName: 'IEFrame' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'BUTTON' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'