Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\Smart PDF阅读器\Shell\open\Command] '' = '"%PROGRAM_FILES%\PDF阅读器\PDF阅读器.exe" "%1"'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\PDF阅读器\PDF阅读器.exe
- "%TEMP%\is-799GB.tmp\install5.exe" (downloaded from the Internet)
- "%TEMP%\is-799GB.tmp\install1.exe" (downloaded from the Internet)
- "%TEMP%\is-799GB.tmp\install4.exe" (downloaded from the Internet)
- "%TEMP%\is-799GB.tmp\install2.exe" (downloaded from the Internet)
- "%TEMP%\is-799GB.tmp\install3.exe" (downloaded from the Internet)
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- <LS_APPDATA>\TheWorld\Chrome\User Data\Default\Extensions\fcgdfnlelkffdljlgeflfckcoklmadea\1.1_0\is-3GS9H.tmp
- <LS_APPDATA>\TheWorld\Chrome\User Data\Default\Extensions\fcgdfnlelkffdljlgeflfckcoklmadea\1.1_0\is-1985N.tmp
- <LS_APPDATA>\TheWorld\Chrome\User Data\Default\Extensions\fcgdfnlelkffdljlgeflfckcoklmadea\1.1_0\is-NT4IA.tmp
- <LS_APPDATA>\TheWorld\Chrome\User Data\Default\Extensions\fcgdfnlelkffdljlgeflfckcoklmadea\1.1_0\is-KEIOP.tmp
- <LS_APPDATA>\TheWorld\Chrome\User Data\Default\is-BNNO0.tmp
- <LS_APPDATA>\360Chrome\Chrome\User Data\Default\Extensions\fcgdfnlelkffdljlgeflfckcoklmadea\1.1_0\is-GVGCH.tmp
- <LS_APPDATA>\360Chrome\Chrome\User Data\Default\Extensions\fcgdfnlelkffdljlgeflfckcoklmadea\1.1_0\is-I1K55.tmp
- <LS_APPDATA>\TheWorld\Chrome\User Data\Default\is-7MRST.tmp
- <LS_APPDATA>\TheWorld\Chrome\User Data\Default\is-HT84H.tmp
- %PROGRAM_FILES%\PDF阅读器\is-LTCK6.tmp
- %TEMP%\is-799GB.tmp\install4.exe
- %TEMP%\is-799GB.tmp\install3.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\smart_pdf_latest[1].txt
- %TEMP%\is-799GB.tmp\install5.exe
- %TEMP%\is-799GB.tmp\install2.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\PDF阅读器\卸载 PDF阅读器.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\PDF阅读器\PDF阅读器.lnk
- %TEMP%\is-799GB.tmp\install1.exe
- %PROGRAM_FILES%\PDF阅读器\unins000.dat
- <LS_APPDATA>\360Chrome\Chrome\User Data\Default\Extensions\fcgdfnlelkffdljlgeflfckcoklmadea\1.1_0\is-C9AOU.tmp
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\is-RHVKU.tmp
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\is-ULELD.tmp
- %APPDATA%\SogouExplorer\is-VO9PS.tmp
- %APPDATA%\SogouExplorer\is-M5I2S.tmp
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\is-C589B.tmp
- %TEMP%\is-799GB.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-20NMG.tmp\<Virus name>.tmp
- %PROGRAM_FILES%\PDF阅读器\is-0PDOV.tmp
- %TEMP%\is-799GB.tmp\isxdl.dll
- %APPDATA%\SogouExplorer\is-73I31.tmp
- <LS_APPDATA>\360Chrome\Chrome\User Data\Default\is-PBI31.tmp
- <LS_APPDATA>\360Chrome\Chrome\User Data\Default\is-L62L4.tmp
- <LS_APPDATA>\360Chrome\Chrome\User Data\Default\Extensions\fcgdfnlelkffdljlgeflfckcoklmadea\1.1_0\is-MIR15.tmp
- <LS_APPDATA>\360Chrome\Chrome\User Data\Default\is-356MR.tmp
- %APPDATA%\Maxthon3\Users\guest\Config\is-9H0QJ.tmp
- %APPDATA%\Tencent\QQBrowser\user_data\0\is-J2NTM.tmp
- %TEMP%\is-799GB.tmp\is-CTS03.tmp
- %APPDATA%\Maxthon3\Users\guest\Favorite\is-F1OMU.tmp
- %APPDATA%\Tencent\TencentTraveler\100\is-PLVER.tmp
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Tencent\TencentTraveler\100\TtConf.dat
- %APPDATA%\Tencent\QQBrowser\user_data\0\Config.db
- <LS_APPDATA>\TheWorld\Chrome\User Data\Default\Preferences
- <LS_APPDATA>\360Chrome\Chrome\User Data\Default\Preferences
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\index1.html
- %PROGRAM_FILES%\SogouExplorer\StartPage\Selector\index.html
- %APPDATA%\SogouExplorer\Config.xml
- %PROGRAM_FILES%\SogouExplorer\StartPage\Local\index2.html
Deletes the following files:
- %TEMP%\is-799GB.tmp\isxdl.dll
- %TEMP%\is-799GB.tmp\install5.exe
- %TEMP%\is-20NMG.tmp\<Virus name>.tmp
- %TEMP%\is-799GB.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-799GB.tmp\install4.exe
- %TEMP%\is-799GB.tmp\install1.exe
- %TEMP%\is-799GB.tmp\home.html
- %TEMP%\is-799GB.tmp\install3.exe
- %TEMP%\is-799GB.tmp\install2.exe
Network activity:
Connects to:
- 'go##.org':80
- 'www.go##.org':80
TCP:
HTTP GET requests:
- www.go##.org/gd_4
- www.go##.org/gd_5
- go##.org/smart_pdf/smart_pdf_latest.txt?v=###
- www.go##.org/gd_1
- www.go##.org/gd_2
- www.go##.org/gd_3
UDP:
- DNS ASK go##.org
- DNS ASK www.go##.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''