ThreatExpert Report: not-a-virus:AdWare.Win32.FearAds.r

Submission Summary:

Submission details:

Submission received: 12 October 2008, 10:22:48
Processing time: 5 min 34 sec
Submitted sample:

File MD5: 0x2480EDFBA57CDF9BA55940ABAFC74487
Filesize: 1 402 416 bytes

Summary of the findings:

What's been found	Severity Level
Capability to send out email message(s) with the built-in SMTP client engine.
Downloads/requests other files from Internet.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).
Contains characteristics of an identified security risk.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

Possible Security Risk

Attention! The following threat category was identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File MD5	Alias
1	%AppData%\fieryads.dat	97 bytes	0xB9733DDA52573A7C32C791F02F7A8294	(not available)
2	%ProgramFiles%\FieryAds\CommLayer.dll	346 624 bytes	0x4B2E7CE0C91AB2BEA7B011ACFB77F210	not-a-virus:AdWare.Win32.FearAds.r [Kaspersky Lab]
3	%ProgramFiles%\FieryAds\FieryAds.dll	624 640 bytes	0x8B46DDEB5869B9FA00CB5BDB8646F1AA	(not available)
4	%ProgramFiles%\FieryAds\FieryAdsUninstall.exe	709 632 bytes	0x32463200C196B433B5C5053853DDF8FC	(not available)
5	%System%\borlndmm.dll	30 208 bytes	0xA509E89CC6FB430671917C92C3AF4870	(not available)
6	[file and pathname of the sample #1]	1 402 416 bytes	0x2480EDFBA57CDF9BA55940ABAFC74487	(not available)

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directory was created:

%ProgramFiles%\FieryAds

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	2 584 576 bytes

The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
FieryAds.dll	%ProgramFiles%\FieryAds\FieryAds.dll	Process name: [filename of the sample #1] Process filename: [file and pathname of the sample #1] Address space: 0xF70000 - 0x107F000
borlndmm.dll	%System%\borlndmm.dll	Process name: [filename of the sample #1] Process filename: [file and pathname of the sample #1] Address space: 0x211D0000 - 0x211E1000
CommLayer.dll	%ProgramFiles%\FieryAds\CommLayer.dll	Process name: [filename of the sample #1] Process filename: [file and pathname of the sample #1] Address space: 0x2470000 - 0x24DD000

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF272101-7F6E-4CF2-9453-B4C5D2FC32C0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF272101-7F6E-4CF2-9453-B4C5D2FC32C0}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CF272101-7F6E-4CF2-9453-B4C5D2FC32C0}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FieryAds
HKEY_LOCAL_MACHINE\SOFTWARE\FieryAds
HKEY_LOCAL_MACHINE\SOFTWARE\FieryAds\Configs
HKEY_LOCAL_MACHINE\SOFTWARE\FieryAds\Limits

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF272101-7F6E-4CF2-9453-B4C5D2FC32C0}\InprocServer32]

(Default) = "C:\PROGRA~1\FieryAds\FieryAds.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF272101-7F6E-4CF2-9453-B4C5D2FC32C0}]

(Default) = "FieryAds advertising module v1.4.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FieryAds]

DisplayName = "The common module support Fiery network"
UninstallString = "%ProgramFiles%\FieryAds\FieryAdsUninstall.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\FieryAds\Limits]

PRD = "10/12/2008"

[HKEY_LOCAL_MACHINE\SOFTWARE\FieryAds\Configs]

DAF = 24 C5 50 2D AB 66 E3 40
LUPStart = 24 C5 50 2D AB 66 E3 40
LUCP = 24 C5 50 2D AB 66 E3 40

[HKEY_LOCAL_MACHINE\SOFTWARE\FieryAds]

WID = "1"
DID = "0!1;0"
S = "BOOK"

Other details

Analysis of the file resources indicate the following possible countries of origin:

	Russian Federation
	Germany

The data identified by the following URLs was then requested from the remote web server:

http://updates.bcob.ru/?v=1.4.0&clv=1.1&u=00CD1A40&s=BOOK&wid=1&did=0!1;0&dai=0
http://config.bcob.ru/?v=1.4.0&clv=1.1&u=00CD1A40&s=BOOK&wid=1&did=0!1;0&dai=0

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.