Technical Information
Malicious functions:
Creates and executes the following:
- '%ProgramFiles%\WizSearch\WizSearch_Renew.exe'
- '%ProgramFiles%\WizSearch\WizSearch_Renew.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\WizSearch\WizSearch_Helper.dll"
Modifies file system:
Creates the following files:
- %HOMEPATH%\Favorites\јоЗОЅєЖ®ё®Ж® 11№ш°Ў.url
- %WINDIR%\gmarket16.ico
- %WINDIR%\auction16.ico
- %ProgramFiles%\WizSearch\WizSearch_Renew.exe
- %HOMEPATH%\Favorites\»х·Оїо јј»у Gё¶ДП.url
- %HOMEPATH%\Favorites\АОЕНіЭјоЗО їБјЗ.url
- %WINDIR%\11st16.ico
- %WINDIR%\gmarket32.ico
- %WINDIR%\auction32.ico
- %WINDIR%\11st32.ico
- %HOMEPATH%\Desktop\Бцё¶ДП.url
- %HOMEPATH%\Desktop\їБјЗ.url
- %HOMEPATH%\Desktop\11№ш°Ў.url
Network activity:
Connects to:
- 'www.wi###arch.co.kr':80
- 'localhost':1038
TCP:
HTTP GET requests:
- http://www.wi###arch.co.kr/core/ver/update_topsi.html
- http://www.wi###arch.co.kr/barcon/gmarket16.ico
- http://www.wi###arch.co.kr/core/count_live.asp?ex#######
- http://www.wi###arch.co.kr/core/v3/WizSearch_Renew.exe
- http://www.wi###arch.co.kr/barcon/auction16.ico
- http://www.wi###arch.co.kr/barcon/auction32.ico
- http://www.wi###arch.co.kr/barcon/11st32.ico
- http://www.wi###arch.co.kr/barcon/11st16.ico
- http://www.wi###arch.co.kr/barcon/gmarket32.ico
UDP:
- DNS ASK www.wi###arch.co.kr
Miscellaneous:
Searches for the following windows:
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
