Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\TV3.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\ј«ЛЩНшВзµзКУ.lnk
Malicious functions:
Creates and executes the following:
- %TEMP%\pplivesetup_forqd236.exe
- %TEMP%\is-GQPV6.tmp\opplayw222.tmp /SL5="$1011C,631424,73728,%TEMP%\RarSFX0\opplayw222.exe"
- %PROGRAM_FILES%\sogouInput\filmst.exe
- %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\jisu.exe
- %TEMP%\RarSFX0\opplayw222.exe
- %TEMP%\RarSFX0\2222.exe
- %TEMP%\RarSFX0\PPLive7039.exe
- %TEMP%\Loader_forqd236.exe
- %TEMP%\pplivetj.exe 7039
- %TEMP%\pplivesetup_forqd236.exe (downloaded from the Internet)
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\ј«ЛЩНшВзµзКУ\Р¶ФШ ј«ЛЩНшВзµзКУ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ј«ЛЩНшВзµзКУ\ј«ЛЩНшВзµзКУ.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ј«ЛЩНшВзµзКУ.lnk
- %ALLUSERSPROFILE%\Desktop\ј«ЛЩНшВзµзКУ.lnk
- %TEMP%\pplivesetup_forqd236.exe
- %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\is-41MKS.tmp
- %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\is-V8T30.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\pplivesetup_forqd236[1].exe
- %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\is-6OFEK.tmp
- %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\unins000.dat
- %HOMEPATH%\Favorites\AAA®??Oµ.lnk
- %HOMEPATH%\Favorites\IO±¦.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\s1[1]
- %HOMEPATH%\Favorites\AAA®EO?µ.lnk
- %HOMEPATH%\Favorites\Internet Exp1orer.lnk
- %ALLUSERSPROFILE%\Desktop\IO±¦.lnk
- %ALLUSERSPROFILE%\Desktop\Internet Exp1orer.lnk
- %ALLUSERSPROFILE%\Desktop\AAA®EO?µ.lnk
- %ALLUSERSPROFILE%\Desktop\AAA®??Oµ.lnk
- %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\is-7PM38.tmp
- %TEMP%\Loader_forqd236.exe
- %TEMP%\nsy2.tmp
- %TEMP%\nsd3.tmp\System.dll
- %TEMP%\pplivetj.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\dll[1].aspx
- %TEMP%\RarSFX0\opplayw222.exe
- %TEMP%\RarSFX0\PPLive7039.exe
- %TEMP%\RarSFX0\2222.exe
- %TEMP%\is-GQPV6.tmp\opplayw222.tmp
- %PROGRAM_FILES%\sogouInput\is-1B50Q.tmp
- %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\is-LJDUK.tmp
- %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\is-BNMI5.tmp
- %PROGRAM_FILES%\sogouInput\is-L9HJ0.tmp
- %TEMP%\is-4JOCD.tmp\is-TKGDR.tmp
- %TEMP%\is-4JOCD.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-4JOCD.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\is-1VE5U.tmp
- %TEMP%\is-4JOCD.tmp\LnkHelper.dll
Deletes the following files:
- %TEMP%\RarSFX0\2222.exe
- %TEMP%\is-GQPV6.tmp\opplayw222.tmp
- %TEMP%\RarSFX0\PPLive7039.exe
- %TEMP%\RarSFX0\opplayw222.exe
- %TEMP%\is-4JOCD.tmp\_isetup\_shfoldr.dll
- %TEMP%\nsd3.tmp\System.dll
- %TEMP%\~DFDF33.tmp
- %TEMP%\is-4JOCD.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-4JOCD.tmp\LnkHelper.dll
Moves the following files:
- from %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\is-7PM38.tmp to %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\jisu.exe
- from %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\is-BNMI5.tmp to %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\data.dat
- from %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\is-V8T30.tmp to %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\mm.ico
- from %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\is-6OFEK.tmp to %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\tao.ico
- from %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\is-41MKS.tmp to %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\mm2.ico
- from %TEMP%\is-4JOCD.tmp\is-TKGDR.tmp to %TEMP%\is-4JOCD.tmp\LnkHelper.dll
- from %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\is-1VE5U.tmp to %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\unins000.exe
- from %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\is-LJDUK.tmp to %PROGRAM_FILES%\ј«ЛЩНшВзµзКУ\ethernet.dll
- from %PROGRAM_FILES%\sogouInput\is-L9HJ0.tmp to %PROGRAM_FILES%\sogouInput\filmst.exe
- from %PROGRAM_FILES%\sogouInput\is-1B50Q.tmp to %PROGRAM_FILES%\sogouInput\ethernet.dll
Network activity:
Connects to:
- 'www.op##p.com':80
- 'localhost':1041
- 'www.fj##w.com':8812
- 'localhost':1043
- 'www.wd##.net':80
- 'localhost':1036
- 'do####ad.pplive.com':80
- 'localhost':1039
TCP:
HTTP GET requests:
- www.op##p.com/s1/
- do####ad.pplive.com/pplivesetup_forqd236.exe
- www.wd##.net/net/dll.aspx?ti################################################################################################################################################
UDP:
- DNS ASK www.op##p.com
- DNS ASK www.fj##w.com
- DNS ASK www.wd##.net
- DNS ASK do####ad.pplive.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'PPLiveGUI' WindowName: 'PPTV'
- ClassName: 'PPLiveLoadingWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''