Technical Information
Modifies file system
Creates the following files
- %TEMP%\selfdelete.bat
- nul
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020120120201202\index.dat
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://ca##.daum.net/osillot
- http://i1.##umcdn.net/cafeimg/cf_img4/title/b22_3/search_box.png
- http://im##.#aumcdn.net/thumb/C125x94/?fn######################################################################
- http://i1.##umcdn.net/cafeimg/cf_img4/title/b22_3/bar_r.png
- http://i1.##umcdn.net/cafeimg/cf_img4/title/bg/114_img.jpg
- http://i1.##umcdn.net/cafeimg/cf_img4/bg/b22_4/icon_view.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/menu/b22_4/bg_c.gif
- http://t1.##umcdn.net/cafe_cj/pcweb/build/js/util/cafe_tiara-5f90edca8e.js
- http://i1.##umcdn.net/cafeimg/cf_img4/title/b22_3/search_btn.png
- http://t1.##umcdn.net/tiara/js/v1/tiara.min.js
- http://i1.##umcdn.net/icon/minidaum/common/minidaum_v07.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/bg/b22_4/bg.jpg
- http://i1.##umcdn.net/cafeimg/cf_img2/img_blank2.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/cafeinfo/b22_4_bg.gif
- http://t1.##umcdn.net/cafeskin/1Yi9C/text_1590244111829.png
- http://ca##.daum.net/_c21_/bbs_menu_ajax?gr########################################################################################
- http://t1.##umcdn.net/cafe_image/cafetop/2019/ico_arrow12_right.svg
- http://i1.##umcdn.net/cafeimg/cf_img4/title/b22_3/bar_c.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/cafeinfo/b22_4_btn_entry.png
- http://i1.##umcdn.net/cafeimg/cf_img4/menu/b22_4/bg_t.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/menu/b22_4/bg_b.gif
- http://cd#.#hawte.com/ThawteTLSRSACAG1.crl
- http://st####.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRzhKfQYsAHQZZDzb8RtQ5PgsTjQQQUpYz%2BMszrDyzUGcYIuAAkiF3DxbcCEALZmvkM0DOfqAo6MqwMOfY%3D
- http://st####.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRzhKfQYsAHQZZDzb8RtQ5PgsTjQQQUpYz%2BMszrDyzUGcYIuAAkiF3DxbcCEAEK4AkQ7yI6EHADadcYnNg%3D
- http://i1.##umcdn.net/cafeimg/cf_img4/menu/b22_4/icon_hide.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/title/b22_3/bar_l.png
- http://i1.##umcdn.net/cafeimg/cf_img4/menu/b22_4/icon_view.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/menu/b22_4/icon_movie.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/menu/b22_4/icon_album.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/menu/b22_4/icon_memo.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/menu/b22_4/icon_board.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/menu/b22_4/icon_best.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/menu/b22_4/bg_line.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/menu/b22_4/icon_new.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/bbs/b22_4/btn_more.gif
- http://i1.##umcdn.net/cafeimg/cf_img4/bbs/b22_4/tit_bg.gif
- http://ca##.daum.net/_pageview/home.html?16###########
- http://i1.##umcdn.net/cafeimg/cf_img4/search/b22_4_btn_search.gif
- http://t1.##umcdn.net/cafe_cj/pcweb/build/js/2009/home_memo-94a8da5e2d.js
- http://st####.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRzhKfQYsAHQZZDzb8RtQ5PgsTjQQQUpYz%2BMszrDyzUGcYIuAAkiF3DxbcCEAKkqta2VkgVBji4vrr6E98%3D
- http://t1.##umcdn.net/cafe_cj/pcweb/build/js/2009/memo_reply-86383ad479.js
- http://t1.##umcdn.net/cafe_cj/pcweb/build/js/2009/thumbnail_util-2cf5922091.js
- http://t1.##umcdn.net/cafe_cj/pcweb/build/css/2009/default-d258b37699.min.css
- http://t1.##umcdn.net/cafe_cj/font/noto_sans_kr_20190405/stylesheet.css
- http://t1.##umcdn.net/cafe_cj/pcweb/build/js/2009/entrance_viewer-00086ec307.js
- http://t1.##umcdn.net/cafe_cj/pcweb/build/js/2009/home-b9125ced97.js
- http://t1.##umcdn.net/cafe_cj/pcweb/build/js/2009/member_person_module-b9ffb7d082.js
- http://t1.##umcdn.net/cafe_cj/pcweb/build/js/2009/common-62f2c56b79.js
- http://s1.##umcdn.net/svc/original/U03/cssjs/userAgent/userAgent-1.0.14.min.js
- http://s1.###e.daumcdn.net/cafe/_c21_/css/1Yi9C/322/20200920140411.4/20200920140411.13/20200608151525.1.css?gr#############
- http://t1.##umcdn.net/cafe_cj/pcweb/build/css/2009/ie8-e9f131fbc8.min.css
- http://t1.##umcdn.net/cafe_cj/pcweb/build/css/article-all-55f68f5e89.min.css
- http://t1.##umcdn.net/cafe_cj/font/spoqa_sans_kr_20200326/stylesheet.css
- http://t1.##umcdn.net/cafe_cj/pcweb/build/css/article-all-style-ie8-523f7f7508.min.css
- http://t1.##umcdn.net/cafe_cj/pcweb/js/1/jquery-1.12.4.min.js
- http://ca##.daum.net/_c21_/visit_member_hdn?gr#########
- http://ca##.daum.net/_c21_/home?gr#########
- http://t1.##umcdn.net/cafe_cj/pcweb/build/js/2009/url_reloader-dcf52eb6ec.js
- http://t1.##umcdn.net/cafe_cj/pcweb/build/css/2009/top-1348c0ec09.min.css
- http://t1.##umcdn.net/cafe_cj/pcweb/build/js/2009/common-lib-3f301e8151.js
- http://t1.##umcdn.net/cafe_cj/pcweb/build/css/2009/ie-cf9a3e08bb.min.css
- http://t1.##umcdn.net/cafe_cj/font/spoqa_sans_kr_20200326/SpoqaHanSansBold.eot?
- http://t1.##umcdn.net/cafe_cj/pcweb/build/js/2009/dwr/dwrstub-compressed-460b84c946.js
- http://t1.##umcdn.net/cafe_cj/pcweb/build/js/2009/dwr/engine-2.0.5-31661804d3.js
- http://t1.##umcdn.net/cafe_image/cf_img4/cafe_ranking/icon/cafe-gold_32.png
- http://t1.##umcdn.net/cafe_image/cf_img4/img/icon_noti.gif
- http://t1.##umcdn.net/cafe_cj/font/noto-serif/noto-serif-bold.eot
- http://t1.##umcdn.net/cafe_cj/font/noto-serif/noto-serif-regular.eot
- http://t1.##umcdn.net/cafe_cj/font/nanum-gothic/nanum-gothic-bold.eot
- http://t1.##umcdn.net/cafe_cj/font/nanum-gothic/nanum-gothic-regular.eot
- http://t1.##umcdn.net/cafe_cj/font/noto-sans/noto-sans-bold.eot
- http://t1.##umcdn.net/cafe_cj/font/noto-sans/noto-sans-regular.eot
- http://t1.##umcdn.net/cafe_cj/font/noto-sans/noto-sans-medium.eot
- http://t1.##umcdn.net/cafe_cj/font/noto-sans/noto-sans-light.eot
- http://t1.##umcdn.net/cafe_cj/font/noto_sans_kr_20190405/NotoSansKoreanBold.eot?
- http://t1.##umcdn.net/cafe_cj/font/noto_sans_kr_20190405/NotoSansKoreanRegular.eot?
- http://t1.##umcdn.net/cafe_cj/font/noto_sans_kr_20190405/NotoSansKoreanLight.eot?
- http://t1.##umcdn.net/cafe_cj/font/spoqa_sans_kr_20200326/SpoqaHanSansRegular.eot?
- http://t1.##umcdn.net/cafe_cj/font/spoqa_sans_kr_20200326/SpoqaHanSansLight.eot?
- http://t1.##umcdn.net/cafe_cj/pcweb/build/js/2009/attach_uploader-8ef2ed6a0e.js
- http://ca##.daum.net/favicon.ico
UDP
- DNS ASK ca##.daum.net
- DNS ASK t1.##umcdn.net
- DNS ASK s1.##umcdn.net
- DNS ASK s1.###e.daumcdn.net
- DNS ASK i1.##umcdn.net
- DNS ASK im##.#aumcdn.net
- DNS ASK lo###s.daum.net
- DNS ASK st##.#iara.daum.net
- DNS ASK we###.ad.daum.net
- DNS ASK st####.thawte.com
- DNS ASK cd#.#hawte.com
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'BUTTON' WindowName: ''
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /flushdns' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\SelfDelete.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /flushdns
- '%WINDIR%\syswow64\ipconfig.exe' /flushdns
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\SelfDelete.bat
- '%WINDIR%\syswow64\ping.exe' -n 0127.0.0.1
