Technical Information
Malicious functions
Executes the following (exploit)
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 364
Modifies file system
Creates the following files
- %TEMP%\1348503.cvr
Network activity
Connects to
- 'sy##.#aboola.com':443
- 'cr#.####2.amazontrust.com':80
- 'oc##.###02.amazontrust.com':80
- 'cr#.####ca1.amazontrust.com':80
- 'oc##.####ca1.amazontrust.com':80
- 'oc##.thawte.com':80
- 'oc##.###tg2.amazontrust.com':80
- 'oc##.#tartssl.com':80
- 'o.##2.us':80
- 'ma###.prod.bidr.io':443
- 'ad#.####tive-serving.com':443
- 'ss####nc.criteo.com':443
- 'c1.##form.net':443
- 'oc##.#ectigo.com':80
- 'x.###switch.net':443
- 'x.##2.us':80
- 'st####.rapidssl.com':80
TCP
HTTP GET requests
- http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEEd2ZS%2B1tSOQCghYR08TOI4%3D
- http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEEFp4omnKZDQfqNId3YHWQI%3D
- http://x.##2.us/x.cer
- http://o.##2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
- http://oc##.###tg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
- http://oc##.####ca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D
- http://cr#.####ca1.amazontrust.com/rootca1.crl
- http://oc##.###02.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEA%2B8BqDpAwOTX2KnyFtS9aw%3D
- http://cr#.####2.amazontrust.com/r2m02.crl
- http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV
- http://st####.rapidssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhhZrQET0hvbSHUJmNfBKqR%2FiT7wQUU8oXWfxrwAMhLxqu5KqoHIJW2nUCEAI6oJP8gn8D%2F19dd4BsEgc%3D
Other
- 'sy##.#aboola.com':443
- 'x.###switch.net':443
- 'c1.##form.net':443
- 'ss####nc.criteo.com':443
- 'ad#.####tive-serving.com':443
- 'ma###.prod.bidr.io':443
UDP
- DNS ASK sy##.#aboola.com
- DNS ASK cr#.####2.amazontrust.com
- DNS ASK oc##.###02.amazontrust.com
- DNS ASK cr#.####ca1.amazontrust.com
- DNS ASK oc##.####ca1.amazontrust.com
- DNS ASK oc##.thawte.com
- DNS ASK oc##.###tg2.amazontrust.com
- DNS ASK oc##.#tartssl.com
- DNS ASK o.##2.us
- DNS ASK ma###.prod.bidr.io
- DNS ASK ad#.####tive-serving.com
- DNS ASK ss####nc.criteo.com
- DNS ASK c1.##form.net
- DNS ASK oc##.#ectigo.com
- DNS ASK x.###switch.net
- DNS ASK x.##2.us
- DNS ASK st####.rapidssl.com
