Technical Information
Modifies file system
Creates the following files
- <Current directory>\fpt.sign.exe.new
- %TEMP%\csccee2.tmp
- %TEMP%\gkpgpcqe.out
- %TEMP%\gkpgpcqe.cmdline
- %TEMP%\gkpgpcqe.0.cs
- %HOMEPATH%\desktop\fpt.sign.lnk
- <Current directory>\times.ttf
- <Current directory>\core2duo.dll
- <Current directory>\windowsbase.dll
- <Current directory>\itextsharp.dll
- <Current directory>\interop.iwshruntimelibrary.dll
- <Current directory>\baopqap.dll
- <Current directory>\dll.rar
- C:\temptqdt\extractor.sys
- <Current directory>\updatesign.exe
- <Current directory>\del.txt
- %TEMP%\rescef3.tmp
- %TEMP%\gkpgpcqe.dll
Deletes the following files
- <Current directory>\del.txt
- C:\temptqdt\extractor.sys
- <Current directory>\dll.rar
- <Current directory>\updatesign.exe
- %TEMP%\rescef3.tmp
- %TEMP%\csccee2.tmp
- %TEMP%\gkpgpcqe.out
- %TEMP%\gkpgpcqe.0.cs
- %TEMP%\gkpgpcqe.cmdline
- %TEMP%\gkpgpcqe.dll
Moves the following files
- from <Current directory>\fpt.sign.exe.new to <Current directory>\fpt.sign.exe
Deletes itself.
Network activity
Connects to
- 'si#######ce.taichinhcong.com':80
TCP
HTTP GET requests
- http://si#######ce.taichinhcong.com/
UDP
- DNS ASK si#######ce.taichinhcong.com
Miscellaneous
Creates and executes the following
- '<Current directory>\updatesign.exe' FPT.SIGN
- '<Current directory>\fpt.sign.exe'
- 'C:\temptqdt\extractor.sys' e -ep "<Current directory>\DLL.rar" BaoPQAP.dll "<Current directory>" /o+
- 'C:\temptqdt\extractor.sys' e -ep "<Current directory>\DLL.rar" Interop.IWshRuntimeLibrary.dll "<Current directory>" /o+
- 'C:\temptqdt\extractor.sys' e -ep "<Current directory>\DLL.rar" itextsharp.dll "<Current directory>" /o+
- 'C:\temptqdt\extractor.sys' e -ep "<Current directory>\DLL.rar" WindowsBase.dll "<Current directory>" /o+
- 'C:\temptqdt\extractor.sys' e -ep "<Current directory>\DLL.rar" Core2Duo.dll "<Current directory>" /o+
- 'C:\temptqdt\extractor.sys' e -ep "<Current directory>\DLL.rar" times.ttf "<Current directory>" /o+
- 'C:\temptqdt\extractor.sys' e -ep "<Current directory>\DLL.rar" BaoPQAP.dll "<Current directory>" /o+' (with hidden window)
- 'C:\temptqdt\extractor.sys' e -ep "<Current directory>\DLL.rar" Interop.IWshRuntimeLibrary.dll "<Current directory>" /o+' (with hidden window)
- 'C:\temptqdt\extractor.sys' e -ep "<Current directory>\DLL.rar" itextsharp.dll "<Current directory>" /o+' (with hidden window)
- 'C:\temptqdt\extractor.sys' e -ep "<Current directory>\DLL.rar" WindowsBase.dll "<Current directory>" /o+' (with hidden window)
- 'C:\temptqdt\extractor.sys' e -ep "<Current directory>\DLL.rar" Core2Duo.dll "<Current directory>" /o+' (with hidden window)
- 'C:\temptqdt\extractor.sys' e -ep "<Current directory>\DLL.rar" times.ttf "<Current directory>" /o+' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\gkpgpcqe.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCEF3.tmp" "%TEMP%\CSCCEE2.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\gkpgpcqe.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCEF3.tmp" "%TEMP%\CSCCEE2.tmp"
