Technical Information
Malicious functions:
Creates and executes the following:
- '%APPDATA%\TheWorld3.2\TheWorld.exe' /tp:1 /w:65854 /t:32571392 /r:65770 /m:1 /f:1 /s:0 /mw:65762 /c:"" /tmp:""
- '%APPDATA%\TheWorld3.2\TheWorld.exe'
Modifies file system :
Creates the following files:
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\select.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\sep.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\sideclose.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\search.ico
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\search.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\searcharrow.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\statusitem.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\stop.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\stop_combine.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\sidemenu.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\sizestatus.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\skin.ini
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\scrollgauge.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\new.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\preview.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\privacy.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\mask.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\menuicon.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\navihistory.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\refresh_combine.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\restore.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\scrollbg.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\rebar.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\rebar_grip.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\refresh.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\toolbar.png
- %APPDATA%\TheWorld3.2\TheWorld.exe
- %APPDATA%\TheWorld3.2\TheWorld.ini
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\titlebar.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\titlebarmax.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\tool.png
- %TEMP%\tw4953.tmp
- %TEMP%\TheWorld\extension\Update\update.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\baidu[1]
- %APPDATA%\TheWorld3.2\WebApp.exe
- %APPDATA%\TheWorld3.2\WebApp.ini
- %APPDATA%\TheWorld3.2\twcache.ini
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\title_min.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\tab_new.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\tab_progress.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\tabbutton2.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\tab_close.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\tab_color.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\tab_drag.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\title_cus.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\title_max.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\title_max2.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\tabitem.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\thumb.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\title_close.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\BTN_LINE.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\BTN_SIDEMASK.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\TAB_BUTTON.png
- %APPDATA%\TheWorld3.2\Extensions\ExtProxy\proxy.ini
- %APPDATA%\TheWorld3.2\Extensions\ExtSuggest\ExtSuggest.dll
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\BTN_CLOSE.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\address2.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\backward.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\bg_pagebar.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\TAB_BUTTON_CLOSE.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\Thumbs.db
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\address.png
- %APPDATA%\TheWorld3.2\Extensions\ExtProxy\ExtProxy.dll
- %APPDATA%\TheWorld3.2\data\ico\Thumbs.db
- %APPDATA%\TheWorld3.2\data\ico\www.baidu.com.ico
- %APPDATA%\TheWorld3.2\data\ico\www.ioage.com.ico
- %APPDATA%\TheWorld3.2\data\history.dat
- %APPDATA%\TheWorld3.2\data\user.dat
- %APPDATA%\TheWorld3.2\data\cachesnap\Thumbs.db
- %APPDATA%\TheWorld3.2\Extensions\ExtDownload\ExtDownload.dll
- %APPDATA%\TheWorld3.2\Extensions\ExtMinibar\ExtMinibar.dll
- %APPDATA%\TheWorld3.2\Extensions\ExtPages\ExtPages.dll
- %APPDATA%\TheWorld3.2\data\ico\www.liusdq.com.ico
- %APPDATA%\TheWorld3.2\Extensions\ExtAddons\ExtAddons.dll
- %APPDATA%\TheWorld3.2\Extensions\ExtAdfilter\ExtAdfilter.dll
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\fav_url.ico
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\favorites.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\findbaritem.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\fav_net_login.ico
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\fav_net_nologin.ico
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\fav_sidebar.ico
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\img_lock.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\img_progress.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\img_sideols.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\forward.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\go.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\home.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\fav_directory.ico
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\bg_sidetoolbar.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\bg_toolbar.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\bottombar.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\bg_sidebar_mini.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\bg_sidebar_tool.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\bg_sidepanel.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\dropdown.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\edit.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\fav_add.ico
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\btn_sidebar_hide.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\btn_sidebar_show.png
- %APPDATA%\TheWorld3.2\skin\TheDeepWorld_Chrome\chevron.png
Sets the 'hidden' attribute to the following files:
- %APPDATA%\TheWorld3.2\twcache.ini
Deletes the following files:
- %TEMP%\TheWorld\extension\Update\update.ini
- %TEMP%\tw4953.tmp
- %APPDATA%\TheWorld3.2\Extensions\ExtProxy\proxy.ini
Moves the following files:
- from %APPDATA%\TheWorld3.2\Extensions\ExtProxy\proxy.ini.tmp to %APPDATA%\TheWorld3.2\Extensions\ExtProxy\proxy.ini
Network activity:
Connects to:
- 'localhost':1040
- 'www.ba##u.com':80
- 'ad####.ioage.com':80
- 'localhost':1036
- 'st##.ioage.com':80
TCP:
HTTP GET requests:
- www.ba##u.com/
- st##.ioage.com/web/theworld3.ini?fi################################################################################################################################################################
UDP:
- DNS ASK www.ba##u.com
- DNS ASK ad####.ioage.com
- DNS ASK st##.ioage.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'Internet Explorer_Server' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'XHinter' WindowName: ''
- ClassName: 'Shell DocObject View' WindowName: ''
- ClassName: 'Shell Embedding' WindowName: ''
