Technical Information
Malicious functions
Searches for windows to
detect programs and games:
- ClassName: 'TWINCONTROL', WindowName: 'CFQQLogin'
Modifies file system
Creates the following files
- %APPDATA%\e_uiengine\90afea1eeb37be7a93471c36152ab43a\90afea1eeb37be7a93471c36152ab43a.jpg
- %APPDATA%\e_uiengine\90afea1eeb37be7a93471c36152ab43a\90afea1eeb37be7a93471c36152ab43a.jpg.data
- %APPDATA%\e_uiengine\869ddb29e096281fe91b179144b7e06b\869ddb29e096281fe91b179144b7e06b.jpg
- %APPDATA%\e_uiengine\869ddb29e096281fe91b179144b7e06b\869ddb29e096281fe91b179144b7e06b.jpg.data
- %WINDIR%\syswow64\iiaqpkq.exe
- %WINDIR%\svchost.exe
- C:\mytemp
Deletes the following files
- C:\mytemp
- %WINDIR%\syswow64\iiaqpkq.exe
Network activity
TCP
HTTP GET requests
- http://www.ya##66.com/
- http://st####.ename.com.cn/upload/images/common//contact-qq.png
- http://st####.ename.com.cn/upload/images/common/search-icon.png
- http://www.en###.com.cn/auctioninterface/updateDomainshow?do################################################################################
- http://st####.ename.com.cn/upload/templateimages/system1/top-bg-1.png
- http://pa#####.#ooglesyndication.com/pagead/js/adsbygoogle.js
- http://12#.#o80.com/images/zzsc.js
- http://12#.#o80.com/images/zzsc.css
- http://st####.ename.com.cn/upload/images/common/templet-link.png
- http://12#.#o80.com/images/new.css
- http://st####.ename.com.cn/data/1/d/b/6/1db675577d891fb6113bae22a5d8780e_email.png
- http://st####.ename.com.cn/data/1/d/b/6/1db675577d891fb6113bae22a5d8780e_tel.png
- http://st####.ename.com.cn/templet/system1/system.css
- http://12#.#o80.com/images/record_Bg.png
- http://ss.##img.com/static/superman/font/iconfont-a37745d6f3.eot?
- http://www.ba##u.com/img/baidu_resultlogo@2.png
- http://www.ba##u.com/img/baidu_jgylogo3.gif
- http://www.ba##u.com/img/bd_logo1.png?qu######
- http://www.ba##u.com/img/bd_logo1.png
- http://st####.ename.com.cn/js/jquery-1.11.3.min.js
- http://www.we##e.com/5.htm
- http://www.ba##u.com/
- http://www.ya##66.com/1.js
- http://i.##hu.com/p/=v2=YMVzYWLATWZ52da45mNvbQ==/blog/view/209721480.htm
- http://mp.#ohu.com/
- http://i.##hu.com/p/=v2=YMVzYWLATWZ52da45mNvbQ==/blog/view/209721581.htm
- http://www.01##.com/?s?#####
- http://12#.#o80.com/
- http://ss.##img.com/static/superman/js/lib/jquery-1-cc52697ab1.10.2.js
UDP
- DNS ASK 01##.com
- DNS ASK ab##m.net
- DNS ASK ya##66.com
- DNS ASK i.##hu.com
- DNS ASK mp.#ohu.com
- DNS ASK ba##u.com
- DNS ASK we##e.com
- DNS ASK 13##80.com
- DNS ASK st####.ename.com.cn
- DNS ASK 12#.#o80.com
- DNS ASK ss.##img.com
- DNS ASK en###.com.cn
- DNS ASK pa#####.#ooglesyndication.com
- DNS ASK s1##.cnzz.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\iiaqpkq.exe'
- '%WINDIR%\svchost.exe'
