Technical Information
Malicious functions:
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %TEMP%\RarSFX1\HookDll.dll
Modifies file system:
Creates the following files:
- %TEMP%\RarSFX0\Uninstall VerbAce-Pro.exe
- %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Local Settings\History\History.IE5\index.dat-2928.2924.tmp
- %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Cookies\index.dat
- %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Cookies\index.dat-2928.2924.tmp
- %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Local Settings\<INETFILES>\Content.IE5\index.dat
- %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Local Settings\<INETFILES>\Content.IE5\index.dat-2928.2924.tmp
- %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\40000010100002i\VerbAce-Pro.exe.b5cb60.tmp
- %TEMP%\RarSFX1\ArabEng.dct
- %TEMP%\RarSFX1\VerbAce-Pro.chm
- %TEMP%\RarSFX1\HookDll.dll
- %TEMP%\RarSFX1\VerbAce-Pro.exe
- %TEMP%\RarSFX1\VAInstBroker.exe
- %TEMP%\RarSFX1\##Attributes.ini
- %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\Registry.tvr.backup.b5c
- %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\Registry.rw.tvr
- %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\Registry.rw.tvr.tmp-b60b60
- %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\Registry.rw.lck.CRNJEUFU.ffffffffb60
- %TEMP%\RarSFX0\VerbAce-Pro.exe
- %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Local Settings\History\History.IE5\index.dat
- <LS_APPDATA>\Microsoft\Internet Explorer\MSIMGSIZ.DAT
Sets the 'hidden' attribute to the following files:
- %TEMP%\RarSFX0\Uninstall VerbAce-Pro.exe
- %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Local Settings\<INETFILES>\Content.IE5\index.dat
- %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Cookies\index.dat
- %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Local Settings\History\History.IE5\index.dat
Moves the following files:
- from %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\Registry.rw.lck.CRNJEUFU.ffffffffb60 to %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\Registry.rw.lck
- from %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\Registry.rw.tvr.tmp-b60b60 to %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\Registry.rw.tvr
- from %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\Registry.tvr.backup.b5c to %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\Registry.tvr.backup
- from %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\40000010100002i\VerbAce-Pro.exe.b5cb60.tmp to %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\40000010100002i\VerbAce-Pro.exe
- from %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Local Settings\<INETFILES>\Content.IE5\index.dat-2928.2924.tmp to %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Local Settings\<INETFILES>\Content.IE5\index.dat
- from %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Cookies\index.dat-2928.2924.tmp to %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Cookies\index.dat
- from %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Local Settings\History\History.IE5\index.dat-2928.2924.tmp to %APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\%Profile%\Local Settings\History\History.IE5\index.dat
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'VerbAcePro2106' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'VAPro2106MicroWin' WindowName: ''
- ClassName: 'Shell Embedding' WindowName: ''
- ClassName: 'Shell DocObject View' WindowName: ''
- ClassName: 'Internet Explorer_Server' WindowName: ''
Creates and executes the following:
- '%TEMP%\RarSFX0\VerbAce-Pro.exe'
- '%APPDATA%\Thinstall\{633CEDFC-E96A-438B-8CDF-4CD69991026E}\40000010100002i\VerbAce-Pro.exe'
