Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM JasMine*
- '%WINDIR%\syswow64\taskkill.exe' /F /IM iWorksBrowser.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM scanchk.exe
Modifies file system
Creates the following files
- %TEMP%\nsbedf2.tmp
- C:\shbscn\bin\shb_amt_bk_bill_scn\shb_amt_bk_bill_scn.tlb
- C:\shbscn\bin\help\shb_amt_bk_bill_scn\help.htm
- C:\shbscn\bin\help\shb_amt_bk_bill_scn\help.files\colorschememapping.xml
- C:\shbscn\bin\help\shb_amt_bk_bill_scn\help.files\filelist.xml
- C:\shbscn\bin\help\shb_amt_bk_bill_scn\help.files\header.htm
- C:\shbscn\bin\help\shb_amt_bk_bill_scn\help.files\image001.png
- C:\shbscn\bin\help\shb_amt_bk_bill_scn\help.files\image005.png
- C:\shbscn\bin\shb_amt_bk_bill_scn\commonclass.dll
- C:\shbscn\bin\help\shb_amt_bk_bill_scn\help.files\image007.png
- C:\shbscn\bin\help\shb_amt_bk_bill_scn\help.files\image009.png
- C:\shbscn\bin\help\shb_amt_bk_bill_scn\help.files\image011.png
- C:\shbscn\bin\help\shb_amt_bk_bill_scn\help.files\image013.png
- C:\shbscn\bin\help\shb_amt_bk_bill_scn\help.files\item0001.xml
- C:\shbscn\bin\help\shb_amt_bk_bill_scn\help.files\props0002.xml
- C:\shbscn\bin\shb_amt_bk_bill_scn\dll_unreg.bat
- C:\shbscn\bin\shb_amt_bk_bill_scn\dll_reg.bat
- C:\shbscn\bin\shb_amt_bk_bill_scn\npshbamtbkbillscnplugin.dll
- C:\shbscn\bin\shb_amt_bk_bill_scn\shb_amt_bk_bill_scn.dll
- C:\shbscn\bin\shb_amt_bk_bill_scn\shb_servicecall.dll
- C:\shbscn\bin\shb_amt_bk_bill_scn\shb_customcontrols.dll
- C:\shbscn\bin\shb_amt_bk_bill_scn\shb_inzimodule.dll
- C:\shbscn\bin\shb_amt_bk_bill_scn\shb_billscanner.dll
- C:\shbscn\bin\shb_amt_bk_bill_scn\shb_commonmanager.dll
- C:\shbscn\bin\help\shb_amt_bk_bill_scn\help.files\image003.png
- C:\shbscn\bin\shb_amt_bk_bill_scn\interop.inziscantwainlib.dll
- C:\shbscn\bin\shb_amt_bk_bill_scn\interop.inzipreproclib.dll
- C:\shbscn\bin\shb_amt_bk_bill_scn\interop.inziimgviewlib.dll
- C:\shbscn\bin\shb_amt_bk_bill_scn\axinterop.inziscantwainlib.dll
- C:\shbscn\bin\shb_amt_bk_bill_scn\axinterop.inzipreproclib.dll
- C:\shbscn\bin\shb_amt_bk_bill_scn\axinterop.inziimgviewlib.dll
- %TEMP%\nsqee02.tmp\execcmd.dll
- C:\shbscn\bin\help\shb_amt_bk_bill_scn\help.files\themedata.thmx
- C:\shbscn\bin\shb_amt_bk_bill_scn\uninst.exe
Deletes the following files
- %TEMP%\nsqee02.tmp\execcmd.dll
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C "TASKKILL /F /IM JasMine*"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C "TASKKILL /F /IM iWorksBrowser.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C "TASKKILL /F /IM scanchk.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C "TASKKILL /F /IM JasMine*"
- '%WINDIR%\syswow64\cmd.exe' /C "TASKKILL /F /IM iWorksBrowser.exe"
- '%WINDIR%\syswow64\cmd.exe' /C "TASKKILL /F /IM scanchk.exe"
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\SHBSCN\BIN\SHB_AMT_BK_BILL_SCN\Dll_Reg.bat""
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /tlb /codebase "C:\SHBSCN\BIN\SHB_AMT_BK_BILL_SCN\SHB_AMT_BK_BILL_SCN.dll"
