Trojan.DownLoader34.65251

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WinAdobe' = '%ALLUSERSPROFILE%\Adobe\Winadobe.exe'

Modifies file system

Creates the following files

%TEMP%\nsb68f0.tmp
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\close_200.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\progressbar_pole_null_200.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\progressbar_pole_null_100.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\progressbar_pole_null_125.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\progressbar_pole_null_150.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\yellow_button_200.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\yellow_button_100.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\yellow_button_125.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\transparent.gif
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\gray_button_200.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\yellow_button_150.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\yellow_button_mini_125.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\yellow_button_mini_150.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\yellow_button_short_200.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\yellow_button_short_100.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\yellow_button_short_125.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\yellow_button_short_150.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\info_icon_100.png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\sc[1]
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\yellow_button_mini_200.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\yellow_button_mini_100.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\progressbar_blue_active_150.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\progressbar_blue_active_125.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\progressbar_blue_active_100.png
%ALLUSERSPROFILE%\intel\msicyc.exe
%ALLUSERSPROFILE%\intel\msi.dll
%ALLUSERSPROFILE%\intel\flashplayer32_xa_install.exe
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\160[1]
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\warning_icon_200.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\status_icon_caution_200.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\status_icon_caution_100.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\status_icon_caution_125.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\status_icon_caution_150.png
%TEMP%\nsr6901.tmp\system.dll
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\status_icon_x_200.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\status_icon_x_125.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\status_icon_x_150.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\status_icon_check_200.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\status_icon_check_100.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\status_icon_check_125.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\status_icon_check_150.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\progressbar_darkgray_base_200.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\progressbar_darkgray_base_100.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\progressbar_blue_active_200.png
%LOCALAPPDATA%\adobe\543c22a3-1033-4a42-a62d-fe70c04c964a\status_icon_x_100.png
%ALLUSERSPROFILE%\adobe\winadobe.exe
%TEMP%\e13c4797595f8061e2b931a692f8eb8c-lk.txt

Deletes the following files

%TEMP%\nsr6901.tmp\system.dll

Substitutes the following files

%TEMP%\Adobe_ADMLogs\Adobe_ADM.log
%TEMP%\Adobe_ADMLogs\Adobe_GDE.log

Network activity

TCP

HTTP GET requests

http://95.##9.214.255/adobe.exe
http://stats.adobe.com/b/ss/adbacdcprod/1/H.25.4/s22490036267121?AQ##############################################################################################################################...

'get.adobe.com':443

'dlmping2.adobe.com':443

'accounts.google.com':443

'go###eapis.com':443

UDP

DNS ASK get.adobe.com
DNS ASK stats.adobe.com
DNS ASK dlmping2.adobe.com
DNS ASK accounts.google.com
DNS ASK go###eapis.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%ALLUSERSPROFILE%\intel\flashplayer32_xa_install.exe'
'%ALLUSERSPROFILE%\intel\msicyc.exe'
'%ALLUSERSPROFILE%\adobe\winadobe.exe'
'%WINDIR%\syswow64\cmd.exe' /S /C "%ALLUSERSPROFILE%\Adobe\Winadobe.exe"' (with hidden window)

Executes the following