Technical Information
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\foxitreader514.0104_enu_setup(1).exe
- %TEMP%\_isd9b.tmp
- %TEMP%\{b576b4b2-0e4b-475e-bf02-01b37e043c0f}\0x040c.ini
- %TEMP%\_isdab.tmp
- %TEMP%\{b576b4b2-0e4b-475e-bf02-01b37e043c0f}\0x0410.ini
- %TEMP%\_isdbc.tmp
- %TEMP%\{b576b4b2-0e4b-475e-bf02-01b37e043c0f}\0x0413.ini
- %TEMP%\_isdbd.tmp
- %TEMP%\{b576b4b2-0e4b-475e-bf02-01b37e043c0f}\0x0415.ini
- %TEMP%\_isdcd.tmp
- %TEMP%\{b576b4b2-0e4b-475e-bf02-01b37e043c0f}\0x0419.ini
- %TEMP%\_isd9a.tmp
- %TEMP%\{b576b4b2-0e4b-475e-bf02-01b37e043c0f}\0x040a.ini
- %TEMP%\_isdde.tmp
- %TEMP%\_ise10.tmp
- %TEMP%\{b576b4b2-0e4b-475e-bf02-01b37e043c0f}\1033.mst
- %TEMP%\_ise40.tmp
- %TEMP%\{b576b4b2-0e4b-475e-bf02-01b37e043c0f}\windows installer 3.0 for windows xp and later (x86).prq
- %TEMP%\_ise60..dll
- %TEMP%\_is2b05.tmp
- %TEMP%\{b576b4b2-0e4b-475e-bf02-01b37e043c0f}\ask toolbar.msi
- %TEMP%\apnlogs\ci.log
- %WINDIR%\installer\f336f.mst
- %TEMP%\{86d4b82a-abed-442a-be86-96357b70f4fe}\instapp.exe
- %TEMP%\{b576b4b2-0e4b-475e-bf02-01b37e043c0f}\0x0816.ini
- %TEMP%\_isdff.tmp
- %TEMP%\{b576b4b2-0e4b-475e-bf02-01b37e043c0f}\0x0409.ini
- %TEMP%\_isd89.tmp
- %TEMP%\{b576b4b2-0e4b-475e-bf02-01b37e043c0f}\0x0407.ini
- %TEMP%\is-4slgv.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4slgv.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-4slgv.tmp\fxcustom.dll
- %TEMP%\is-4slgv.tmp\apnstub.exe
- %TEMP%\is-4slgv.tmp\apnic.dll
- %TEMP%\is-4slgv.tmp\toolbar.bmp
- %ProgramFiles(x86)%\foxit software\foxit reader\is-75sb1.tmp
- %ProgramFiles(x86)%\foxit software\foxit reader\is-pcdei.tmp
- %ProgramFiles(x86)%\foxit software\foxit reader\is-qgm6e.tmp
- %ProgramFiles(x86)%\foxit software\foxit reader\is-s69t6.tmp
- %ProgramFiles(x86)%\foxit software\foxit reader\plugins\is-bqsb4.tmp
- %TEMP%\is-uhttg.tmp\foxitreader514.0104_enu_setup(1).tmp
- %ProgramFiles(x86)%\foxit software\foxit reader\plugins\is-egfu3.tmp
- %ProgramFiles(x86)%\foxit software\foxit reader\plugins\is-mn3fo.tmp
- %ProgramFiles(x86)%\foxit software\foxit reader\plugins\is-hcgqs.tmp
- %ProgramFiles(x86)%\foxit software\foxit reader\plugins\is-6ftbr.tmp
- %ProgramFiles(x86)%\foxit software\foxit reader\is-lrkus.tmp
- %ProgramFiles(x86)%\foxit software\foxit reader\is-r2flc.tmp
- %TEMP%\is-4slgv.tmp\is-v0kq1.tmp
- %TEMP%\new9df.tmp.exe
- %TEMP%\_isd49.tmp
- %TEMP%\{b576b4b2-0e4b-475e-bf02-01b37e043c0f}\setup.ini
- %TEMP%\{b576b4b2-0e4b-475e-bf02-01b37e043c0f}\_ismsidel.ini
- %TEMP%\_isd69.tmp
- %ProgramFiles(x86)%\foxit software\foxit reader\is-qrev5.tmp
- %TEMP%\{86d4b82a-abed-442a-be86-96357b70f4fe}\runie.exe
- %TEMP%\{86d4b82a-abed-442a-be86-96357b70f4fe}\askpartnercobrandingtool.exe
Deletes the following files
- %TEMP%\_isd49.tmp
- %TEMP%\_isd69.tmp
- %TEMP%\_isd89.tmp
- %TEMP%\_isd9a.tmp
- %TEMP%\_isd9b.tmp
- %TEMP%\_isdab.tmp
- %TEMP%\_isdbc.tmp
- %TEMP%\_isdbd.tmp
- %TEMP%\_isdcd.tmp
- %TEMP%\_isdde.tmp
- %TEMP%\_isdff.tmp
- %TEMP%\_ise10.tmp
- %TEMP%\_ise40.tmp
- %TEMP%\_ise60..dll
- %TEMP%\_is2b05.tmp
Moves the following files
- from %ProgramFiles(x86)%\foxit software\foxit reader\is-75sb1.tmp to %ProgramFiles(x86)%\foxit software\foxit reader\unins000.exe
- from %ProgramFiles(x86)%\foxit software\foxit reader\is-pcdei.tmp to %ProgramFiles(x86)%\foxit software\foxit reader\foxit reader.exe
- from %ProgramFiles(x86)%\foxit software\foxit reader\is-qgm6e.tmp to %ProgramFiles(x86)%\foxit software\foxit reader\foxit updater.exe
- from %ProgramFiles(x86)%\foxit software\foxit reader\is-s69t6.tmp to %ProgramFiles(x86)%\foxit software\foxit reader\updaterinfo.xml
- from %ProgramFiles(x86)%\foxit software\foxit reader\plugins\is-bqsb4.tmp to %ProgramFiles(x86)%\foxit software\foxit reader\plugins\updater.fpi
- from %ProgramFiles(x86)%\foxit software\foxit reader\plugins\is-egfu3.tmp to %ProgramFiles(x86)%\foxit software\foxit reader\plugins\foxitreaderocx.ocx
- from %ProgramFiles(x86)%\foxit software\foxit reader\is-qrev5.tmp to %ProgramFiles(x86)%\foxit software\foxit reader\pdfreader.xml
- from %ProgramFiles(x86)%\foxit software\foxit reader\plugins\is-mn3fo.tmp to %ProgramFiles(x86)%\foxit software\foxit reader\plugins\adrmsplugindll.fpi
- from %ProgramFiles(x86)%\foxit software\foxit reader\plugins\is-hcgqs.tmp to %ProgramFiles(x86)%\foxit software\foxit reader\plugins\facebook_plugin.fpi
- from %ProgramFiles(x86)%\foxit software\foxit reader\plugins\is-6ftbr.tmp to %ProgramFiles(x86)%\foxit software\foxit reader\plugins\speech.fpi
- from %ProgramFiles(x86)%\foxit software\foxit reader\is-lrkus.tmp to %ProgramFiles(x86)%\foxit software\foxit reader\readme.txt
- from %ProgramFiles(x86)%\foxit software\foxit reader\is-r2flc.tmp to %ProgramFiles(x86)%\foxit software\foxit reader\fxcustom.dll
- from %TEMP%\is-4slgv.tmp\is-v0kq1.tmp to %TEMP%\is-4slgv.tmp\apntoolbarinstaller.exe
Network activity
Connects to
- 'im#.###a###ytics.com':80
TCP
HTTP GET requests
- http://im#.###a###ytics.com/images/nocache/apn/tr.gif?ev#########################################################################################################################################...
UDP
- DNS ASK ap####ia.ask.com
- DNS ASK we####rch.ask.com
- DNS ASK im#.###a###ytics.com
- DNS ASK wz###.ask.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\foxitreader514.0104_enu_setup(1).exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-uhttg.tmp\foxitreader514.0104_enu_setup(1).tmp' /SL5="$10254,13973906,586752,%TEMP%\RarSFX0\FoxitReader514.0104_enu_Setup(1).exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-4slgv.tmp\apnstub.exe' /tb=FXTV5
- '%TEMP%\is-4slgv.tmp\apnstub.exe' /tbr /sa /hpr toolbar=FXTV5
- '%TEMP%\is-4slgv.tmp\apntoolbarinstaller.exe' /tbr /sa /hpr toolbar=FXTV5
- '%TEMP%\new9df.tmp.exe' /s /v"/qn REBOOT=ReallySuppress PARTNER=FXTV5 SA=YES HPR=1 IF=first GUID=249B6CAF-3348-462E-B593-343040B69D93 SAGUID=298778E9-2384-4177-AA6D-51E1DE726B92 "
- '%TEMP%\{86d4b82a-abed-442a-be86-96357b70f4fe}\askpartnercobrandingtool.exe' FXTV5
- '%TEMP%\is-4slgv.tmp\apnstub.exe' /tb=FXTV5' (with hidden window)
- '%TEMP%\is-4slgv.tmp\apnstub.exe' /tbr /sa /hpr toolbar=FXTV5' (with hidden window)
- '%TEMP%\new9df.tmp.exe' /s /v"/qn REBOOT=ReallySuppress PARTNER=FXTV5 SA=YES HPR=1 IF=first GUID=249B6CAF-3348-462E-B593-343040B69D93 SAGUID=298778E9-2384-4177-AA6D-51E1DE726B92 "' (with hidden window)
- '%TEMP%\{86d4b82a-abed-442a-be86-96357b70f4fe}\askpartnercobrandingtool.exe' FXTV5' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\{B576B4B2-0E4B-475E-BF02-01B37E043C0F}\Ask Toolbar.msi" /L*vx %TEMP%\APNLogs\ci.log /qn REBOOT=ReallySuppress PARTNER=FXTV5 SA=YES HPR=1 IF=first GUID=249B6CAF-3348-462E-B593-343040B...
