Trojan.Siggen18.22464

Technical Information

Modifies file system

Creates the following files

D:\geeГ®ВўВ¶Г«ВµГ§ГўВјГ¦Г·\<File name>.exe
%HOMEPATH%\desktop\ГЇГ©ВЅВЈГ°ГўВґВ«ВІГўГЄГґВµГ§ГўВјГ¦Г·.lnk
D:\geeГ®ВўВ¶Г«ВµГ§ГўВјГ¦Г·\patch0.d3d
D:\geeГ®ВўВ¶Г«ВµГ§ГўВјГ¦Г·\meigui\data\catui.pak
D:\geeГ®ВўВ¶Г«ВµГ§ГўВјГ¦Г·\meigui\data\chrsel.pak
D:\geeГ®ВўВ¶Г«ВµГ§ГўВјГ¦Г·\meigui\data\newopui.pak
%LOCALAPPDATA%\microsoft\internet explorer\domstore\w37zlxnl\www.baidu[1].xml
%APPDATA%\microsoft\internet explorer\userdata\index.dat
%APPDATA%\microsoft\internet explorer\userdata\vzam6b7k\userdatabidupsid[1].xml
%APPDATA%\microsoft\internet explorer\userdata\kjbl0nrx\oxmlstore[1].xml

Deletes the following files

D:\geeГ®ВўВ¶Г«ВµГ§ГўВјГ¦Г·\patch0.d3d

Modifies the following files

Deletes itself.

Network activity

Connects to

'lb.##lala.com':80
'ba##u.com':80
'ss.##img.com':80
'ds##.#dstatic.com':443
'ps#.##static.com':80
'he####.baidu.com':443
'sp#.#aidu.com':443
'microsoft.com':80

TCP

HTTP GET requests

http://lb.##lala.com/upload/1639045849.txt
http://ps#.##static.com/r/www/cache/static/plugins/every_cookie_4644b13.js
http://www.ba##u.com/home/page/data/pageserver?er######################################
http://ss.##img.com/static/superman/img/spis7-d578e7ff4b.png
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://www.ba##u.com/cache/fpid/lib_1_0.js?_=#############
http://ss.##img.com/static/superman/js/components/tips-e2ceadd14d.js
http://ss.##img.com/static/superman/js/super_load-86e18c5005.js
http://ss.##img.com/static/superman/js/components/qrcode-0e4b67354f.js
http://ss.##img.com/static/superman/js/components/login_guide-4fba3971ce.js
http://ss.##img.com/static/superman/css/ubase-89d6b96e41.css?v=###
http://ss.##img.com/static/superman/js/components/video-meet-7833028d86.js
http://ss.##img.com/static/superman/js/components/content-info-b0c0e5245b.js
http://ss.##img.com/static/superman/js/components/aging-tools-a9021e54d5.js
http://ss.##img.com/static/superman/js/ubase-dddde7cd4e.js?v=###
http://ss.##img.com/static/superman/amd_modules/@baidu/video-meeting-1be7f62dac.js
http://ss.##img.com/static/superman/js/components/guide_tips-d9e617f782.js
http://ss.##img.com/static/superman/amd_modules/@baidu/aging-tools-pc-1e5afe8bdf.js
http://pa####rt.baidu.com/passApi/js/wrapper.js?cd######################################
http://ps#.##static.com/r/www/cache/static/global/js/all_async_search_7e51d6a.js
http://ss.##img.com/static/superman/js/components/advert-064271ed9b.js
http://ps#.##static.com/r/www/cache/static/bundles/es6-polyfill_5103265.js
http://ss.##img.com/static/superman/js/lib/jquery-1-edb203c114.10.2.js
http://www.ba##u.com/
http://www.ba##u.com/img/PCtm_d9c8750bed0b3c7d089fa7d55720d6cf.png
http://www.ba##u.com/img/PCfb_5bf082d29588c07f842ccde3f97243ea.png
http://www.ba##u.com/img/flexible/logo/pc/result.png
http://www.ba##u.com/img/flexible/logo/pc/result@2.png
http://www.ba##u.com/img/flexible/logo/pc/peak-result.png
http://ss.##img.com/static/superman/font/iconfont-0f8d986b45.eot?
http://ss.##img.com/static/superman/img/footer/aria-3006e33cce.png
http://ss.##img.com/static/superman/js/lib/esl-d776bfb1aa.js
http://he#####tatic.baidu.com/cd37ed75a9387c5b.js
http://ss.##img.com/static/superman/img/qrcode/qrcode@2x-daf987ad02.png
http://ss.##img.com/static/superman/img/qrcode/qrcode-hover@2x-f9b106a848.png
http://ss.##img.com/static/superman/js/polyfill-ie8-30f98ab294.js
http://ss.##img.com/static/superman/js/sbase-57dfcf5eeb.js
http://ss.##img.com/static/superman/css/ubase_sync-d600f57804.css?v=###
http://ss.##img.com/static/superman/js/s_super_index-3fffae8d60.js
http://ss.##img.com/static/superman/js/min_super-8fe39161bb.js
http://ss.##img.com/static/superman/js/components/hotsearch-186ffe4ac3.js
http://ps#.##static.com/r/www/cache/static/bundles/polyfill_9354efa.js
http://www.ba##u.com/san.js