ThreatExpert Report: AdWare.Win32.Advantage

Submission Summary:

Submission details:

Submission received: 22 October 2012, 13:07:50
Processing time: 12 min 15 sec
Submitted sample:

File MD5: 0x27894994FE333528DCAD3D7D87A84652
File SHA-1: 0x9C6A686515E3B689974CC66C46F848BA4056031E
Filesize: 1,686,632 bytes
Alias: AdWare.Win32.Advantage [Ikarus]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonPrograms%\FreeGamesWay.com\Sea Patrol\About AdVantage.lnk	1,445 bytes	MD5: 0x5385A9587C54C53732AE8F04B252F18D SHA-1: 0x0FFBFE911A1656F8503D77EA354E5EF6DFDFFBD0	(not available)
2	%CommonPrograms%\FreeGamesWay.com\Sea Patrol\AdVantage Customer Support.lnk	1,445 bytes	MD5: 0xD6B92BA7EFF92D7F2B21C133AD9FFD23 SHA-1: 0x6C6E4459E3FDA50F485FA1413243C6D1E9689491	(not available)
3	%CommonPrograms%\FreeGamesWay.com\Sea Patrol\Enjoy Free Games!.lnk	1,739 bytes	MD5: 0x6AB793124389D415941726E1F57DE446 SHA-1: 0x2085C929CEE03FCD4D4360F29E5B6E795ECC7403	(not available)
4	%CommonPrograms%\FreeGamesWay.com\Sea Patrol\Free Games Way.lnk	1,725 bytes	MD5: 0xEF9652845853355D4C8DFD93074199BA SHA-1: 0x3954BF71D4DC3F4211E6F2020E9012C2C4DB76E2	(not available)
5	%CommonPrograms%\FreeGamesWay.com\Sea Patrol\MyPlayCity Games.lnk	1,711 bytes	MD5: 0xA0A5BA87012B2B2177ACF91C0D9A5A6C SHA-1: 0xD4A7F145E251BD56A46800C2C1C7FDACD8D81343	(not available)
6	%CommonPrograms%\FreeGamesWay.com\Sea Patrol\Readme\License.lnk	792 bytes	MD5: 0x088D2E00901523CF4D25FA4F14D68684 SHA-1: 0x931B97E7C14BC9A09499B9D414023F0AA5C625B4	(not available)
7	%CommonPrograms%\FreeGamesWay.com\Sea Patrol\Readme\Readme.lnk	787 bytes	MD5: 0x0E8BAEEA62D7D11713170F906A33F405 SHA-1: 0xFA10E932A43417E6C60A1BD8C04F99A37FEACEB3	(not available)
8	%CommonPrograms%\FreeGamesWay.com\Sea Patrol\Sea Patrol Homepage.lnk	793 bytes	MD5: 0x2CCBAD33E127EA1AFBBA2FE9547AE7C4 SHA-1: 0xB0839EE6FFC6D19F12B8C6F232310EA456A8ABCF	(not available)
9	%CommonPrograms%\FreeGamesWay.com\Sea Patrol\Sea Patrol.lnk	1,778 bytes	MD5: 0x5D6DFEE0D148B2DB404A38CFA7446C83 SHA-1: 0x350E8DE537BDF5209B6EE123D78746D138FAA3E6	(not available)
10	%DesktopDir%\Free Games Way.lnk	1,707 bytes	MD5: 0xF2ECC25C959D912A24C1A485A3CDFB66 SHA-1: 0xE488CA333921CA54F96F40AD804A7E5B9E01389F	(not available)
11	%DesktopDir%\MyPlayCity Games.lnk	1,693 bytes	MD5: 0x18B2E86EDD555A1C1BD9293518AC29BC SHA-1: 0x08C4B221505CDEFDCE0D03A409A6D496B8E75F36	(not available)
12	%DesktopDir%\Sea Patrol.lnk	1,760 bytes	MD5: 0xA4C1EC9616E34F88124288C4A7381410 SHA-1: 0x183E31E63A1432B092792B254412859F83DF946A	(not available)
13	%StartMenu%\MyPlayCity Games.lnk	1,693 bytes	MD5: 0x51E980DF31005FEFBBA7B01A12483A8B SHA-1: 0xDED8F25F0734E29B1C10136E6E4C5C0CDB7FC9AD	(not available)
14	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\adv_icon.ico	13,206 bytes	MD5: 0x1B733A8C0A3CFB782188B9E0BAB8BEAB SHA-1: 0xA4E16187EA1440D9DF5936ED8E94D591C541475A	(not available)
15	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\Config.cfg %System%\Config.cfg	144 bytes	MD5: 0x9332D0C9D02DCA2FAAB14CEF8CEBCD2A SHA-1: 0x667F255F2B7B2DA6D553B90195F7B16C7919DD4D	(not available)
16	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\Data\Data.pp	8,406,696 bytes	MD5: 0xC5F71734A628D5EF64AE4A62B09467F4 SHA-1: 0x0F712F7E2DABE0AE0588A38540DDCBBD4AB28574	(not available)
17	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\EnjoyFreeGames.ico	47,166 bytes	MD5: 0xF328E79C4C21A9C7908F15893D9C0667 SHA-1: 0x52F1C91F4FC0F0F381EA148DF9B2756E591F8073	(not available)
18	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\EnjoyFreeGames.url	85 bytes	MD5: 0x3CE2FEA4F46237F5AB3AF6728DA8C2A5 SHA-1: 0x4208E82C3885B4449C9CCBF617A7471E50A07CF4	(not available)
19	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\file_id.diz	547 bytes	MD5: 0x71A656BD73AC82FE6399435BDE4A65AA SHA-1: 0x61A0169632C3D5644A497108BC84F8B1348740AD	(not available)
20	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\FreeGamesWay.ico	39,438 bytes	MD5: 0xF83B1BEAF807F68531C72551DD05CB39 SHA-1: 0xF3CBBDDA5ACBB6351EBD831F8862B4E7AD91366B	(not available)
21	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\FreeGamesWay.url	83 bytes	MD5: 0xEE96ABF71CC71CA7998C92132A9266E3 SHA-1: 0x9E3B5A452F8955696692D730D1BA08AA2A989932	(not available)
22	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\homepage.url	93 bytes	MD5: 0xF508CDF8923EDD30DFAD93A39700E80C SHA-1: 0x7CEB07CA12A074C96CE72F279A41C6450D56DCAC	(not available)
23	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\install.url	106 bytes	MD5: 0x06BFCC2A5B390BC3A7A922D73BD5FE4A SHA-1: 0xC736227DC192F60AB71CD48408E499F36FDF1DCB	(not available)
24	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\license.txt	1,417 bytes	MD5: 0xB2C8C9F082B03735BB8F023D2672C119 SHA-1: 0xA8422BBF38C1FCB1F32343BD6F969A534914BFA0	(not available)
25	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\MiniFMOD.dll	19,968 bytes	MD5: 0x954E736B110204268533E97A6F865CE3 SHA-1: 0x9B56C0B64842514FCE3BE7F10DD5792FAD39D003	(not available)
26	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\MyPlayCity.ico	47,166 bytes	MD5: 0x6B86C533B5BA16473724AB8E04B876B9 SHA-1: 0xA1695DEC23DDBD3EAAC08F242DA9C29A9ADDFF79	(not available)
27	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\MyPlayCity.url	81 bytes	MD5: 0xAE98AD57ADE0250130A26370539A6669 SHA-1: 0xF8193763B97990E248150BC9D4527D48BA7EECF6	(not available)
28	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\play.url	83 bytes	MD5: 0x81E09FB086452B59EBCE15F2FCC6A147 SHA-1: 0x523543387706B4792EAC34E5611CBBA8F66F1AFB	(not available)
29	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\README.TXT	3,679 bytes	MD5: 0xDF546A72DCF30675BD6EC87ED00E65C5 SHA-1: 0x6346C9C287CF1B457EE08562660AA363DEFF3C31	(not available)
30	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\Sound\1.xm	222,087 bytes	MD5: 0x0EB80EA1013CFDAD081E2C959A59451B SHA-1: 0xFA418C88654EF21B09481F8EAE24A2E754917E7B	(not available)
31	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\Sound\2.xm	352,960 bytes	MD5: 0xC0D8F336B4CCDDEB426B4BCD2A62C650 SHA-1: 0x18438E898CD751AFF4EEDDD61C8ECA0557DA7C65	(not available)
32	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\Spatrol.exe	750,592 bytes	MD5: 0x33CDB8E48CCA2D39D46CBA042468B7EE SHA-1: 0xC7628E5190D7F6ABDBBD20FDE5EFB69A6BC40F9F	(not available)
33	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\Spatrol.ico	46,278 bytes	MD5: 0x3AE491A6AF78B8BE48800E130AA71BC4 SHA-1: 0x01013197A7FB9A54C1C72B4523B87145F905DC91	(not available)
34	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\unins000.dat	13,187 bytes	MD5: 0x5CAF6E63434D364A72E8E1BD12779CBF SHA-1: 0xA714FF7AE30DD0F1DEA3C39F2F990D567DB600CC	(not available)
35	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\unins000.exe	673,593 bytes	MD5: 0x4E240CE9F35B9386F546B2A91423808F SHA-1: 0x1BA0CAFEFB156371A168FEDDA78ECB423D25213D	(not available)
36	%ProgramFiles%\FreeGamesWay.com\Sea Patrol\uninst.url	105 bytes	MD5: 0xC6E76072958F26476A5A1C68D787F7C9 SHA-1: 0x89AB87B6006FB8EC2AA15C8FEDDA59DC57265F95	(not available)
37	%FontsDir%\spatrol.ttf	49,348 bytes	MD5: 0x5DD943099949C8402A3F9457F8D3D5B6 SHA-1: 0xE84C63C9AED8BD72E602B2F011F4DF54F3ED74C5	(not available)
38	[file and pathname of the sample #1]	1,686,632 bytes	MD5: 0x27894994FE333528DCAD3D7D87A84652 SHA-1: 0x9C6A686515E3B689974CC66C46F848BA4056031E	AdWare.Win32.Advantage [Ikarus]

Notes:

%CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%StartMenu% is a variable that refers to the file system directory containing Start menu items. A typical path is C:\Documents and Settings\[UserName]\Start Menu.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
%FontsDir% is a variable that refers to a virtual folder containing fonts. A typical path is C:\Windows\Fonts.

The following directories were created:

%CommonPrograms%\FreeGamesWay.com
%CommonPrograms%\FreeGamesWay.com\Sea Patrol
%CommonPrograms%\FreeGamesWay.com\Sea Patrol\Readme
%ProgramFiles%\FreeGamesWay.com
%ProgramFiles%\FreeGamesWay.com\Sea Patrol
%ProgramFiles%\FreeGamesWay.com\Sea Patrol\Data
%ProgramFiles%\FreeGamesWay.com\Sea Patrol\Sound

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	77,824 bytes
is-QIGR8.tmp	%Temp%\is-U8FJ4.tmp\is-QIGR8.tmp	720,896 bytes
AdVantageSetup.exe	%Temp%\is-NI01G.tmp\AdVantageSetup.exe	135,168 bytes

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sea Patrol_is1
HKEY_CURRENT_USER\Software\FreeGamesWay.com
HKEY_CURRENT_USER\Software\FreeGamesWay.com\Games
HKEY_CURRENT_USER\Software\FreeGamesWay.com\Games\Sea Patrol

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sea Patrol_is1]

Inno Setup: Setup Version = "5.1.6"
Inno Setup: App Path = "%ProgramFiles%\FreeGamesWay.com\Sea Patrol"
InstallLocation = "%ProgramFiles%\FreeGamesWay.com\Sea Patrol\"
Inno Setup: Icon Group = "FreeGamesWay.com\Sea Patrol"
Inno Setup: User = "%UserName%"
Inno Setup: Selected Tasks = "desktopIcon,quicklaunchIcon"
Inno Setup: Deselected Tasks = ""
DisplayName = "Sea Patrol Powered by AdVantage"
DisplayIcon = "%ProgramFiles%\FreeGamesWay.com\Sea Patrol\spatrol.exe"
UninstallString = ""%ProgramFiles%\FreeGamesWay.com\Sea Patrol\unins000.exe""
QuietUninstallString = ""%ProgramFiles%\FreeGamesWay.com\Sea Patrol\unins000.exe" /SILENT"
DisplayVersion = "2.0"
Publisher = "FreeGamesWay.com"
URLInfoAbout = "http://www.FreeGamesWay.com/"
HelpLink = "http://www.FreeGamesWay.com/support"
URLUpdateInfo = "http://www.FreeGamesWay.com/sea_patrol"
NoModify = 0x00000001
NoRepair = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]

Cranberry Cyr (TrueType) = "spatrol.ttf"

Other details

Analysis of the file resources indicate the following possible countries of origin:

	Russian Federation
	Netherlands

To mark the presence in the system, the following Mutex objects were created:

DirectSound DllMain mutex (0x00000488)
DirectSound Administrator shared thread array (lock)
_!SHMSFTHISTORY!_
MeMediaSetup_SharedMutex

The following Internet Connections were established:

Server Name	Server Port	Connect as User	Connection Password
www.freegamesway.com	80	(null)	(null)
app.memedia.com	80	(null)	(null)
downloads.memedia.com	80	(null)	(null)

The following GET requests were made:

AppInstall?app=Setup&url=MPLC070710&id=F002F21415F446F3943FEFA3A8297B31&ui=JH&ver=6.41&svr=5.1
MPLC070710/setup.cfg
AppInstall?app=Setup_CFG&url=MPLC070710&id=F002F21415F446F3943FEFA3A8297B31&ui=QF&ver=6.41&svr=5.1
sea_patrol/install.html
sea_patrol/index.jpg

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.