Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020122720201228\index.dat
Network activity
TCP
HTTP GET requests
- http://du######-vip.blogspot.com/
- http://4.##.#logspot.com/-SpELBFnRMqs/XG57gzJomlI/AAAAAAAACJA/mQeSCVsRgVIE0NMsyetv3c3w9jxzjb8lgCK4BGAYYCw/s1600/1%2B%25281%2529.gif
- http://3.##.#logspot.com/-1HdU8BOt8kY/XG58nNRiKII/AAAAAAAACJY/NWHp95xl1ZQ7q-FQuMYHdElB1nB33gqwwCK4BGAYYCw/s1600/pasang%2Biklan.gif
- http://2.##.#logspot.com/-kHqmCo6dDOg/XG58VgbraKI/AAAAAAAACJM/WZPXErDa9og25nKm3fmox0VhZTe_rU-ewCK4BGAYYCw/s1600/alat-bantu-sex.gif
- http://wi####s.amung.us/small.js
- http://du######-vip.blogspot.com/js/cookienotice.js
- http://st##.pc2ads.com/js/adv_out.js
- http://www.google.com/cse/api/partner-pub-6884865816638407/cse/5550805230/queries/js?oe#########################################################################################
- http://www.google.com/cse/query_renderer.js
- http://co###ten.com/apu.php?zo############
- http://fo###.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7h.eot
- http://go.##clasrv.com/apu.php?zo############
- http://pa#####.#ooglesyndication.com/pagead/js/adsbygoogle.js
- http://fo###.gstatic.com/s/righteous/v9/1cXxaUPXBpj2rGoU7C9WiHGB.eot
- http://fo###.gstatic.com/s/ptsansnarrow/v12/BngRUXNadjH0qYEzV7ab-oWlsbCGwRk.eot
- http://ma####.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.eot?
- http://fo###.#oogleapis.com/css?fa###########################################################################
- http://ma####.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
- http://go.##lasrv.com/apu.php?zo############
- http://na####.propellerads.com/1?z=############
- http://th###adir.com/2?z=#######
- http://cd#.#opcash.net/show.js
- http://du######-vip.blogspot.com/favicon.ico
- http://wh##.amung.us/pingjs/?k=###############################################################################################
UDP
- DNS ASK yo##ube.com
- DNS ASK go#####analytics.com
- DNS ASK ma####.bootstrapcdn.com
- DNS ASK i.##gur.com
- DNS ASK re#####es.blogblog.com
- DNS ASK go.##clasrv.com
- DNS ASK co###ten.com
- DNS ASK google.com
- DNS ASK st##.pc2ads.com
- DNS ASK 1.##.#logspot.com
- DNS ASK cse.google.com
- DNS ASK 2.##.#logspot.com
- DNS ASK 3.##.#logspot.com
- DNS ASK 4.##.#logspot.com
- DNS ASK wi####s.amung.us
- DNS ASK t.###cout.com
- DNS ASK go.##lasrv.com
- DNS ASK wh##.amung.us
- DNS ASK na####.propellerads.com
- DNS ASK aj##.#oogleapis.com
- DNS ASK du######-vip.blogspot.com
- DNS ASK bl##ger.com
- DNS ASK fa###ook.com
- DNS ASK i.##img.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK microsoft.com
- DNS ASK fo###.gstatic.com
- DNS ASK r4########ne6ns6.googlevideo.com
- DNS ASK ad###elink.com
- DNS ASK pa#####.#ooglesyndication.com
- DNS ASK m.###ebook.com
- DNS ASK st####.xx.fbcdn.net
- DNS ASK fb##n.net
- DNS ASK fb##x.com
- DNS ASK cd#.#opcash.net
- DNS ASK th###adir.com
- DNS ASK cd#.#ynt.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c start https://www.yo##ube.com/watch?v=###########
- '%WINDIR%\syswow64\cmd.exe' /c start http://du######-vip.blogspot.com
- '%WINDIR%\syswow64\cmd.exe' /c start https://www.fa###ook.com/messages/t/tenchifiles
- '%WINDIR%\syswow64\cmd.exe' /c start https://www.yo##ube.com/channel/UCpij2XK105znAsDNj_HS0zg?su################
