ThreatExpert Report: Adware.Trymedia, Adware-TryMedia, Win-Trojan/Trymedia.214016

Submission Summary:

Submission details:

Submission received: 2 July 2009, 13:48:05
Processing time: 7 min 5 sec
Submitted sample:

File MD5: 0xAAD0726D99C7563A3B4F4DF027C9A938
File SHA-1: 0xB584E475D04190A31947A454E7B5791B964DEFA8
Filesize: 214,016 bytes
Alias:

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Adware.Trymedia	Adware.Trymedia may download and execute new software from a remote server. This new software may or may not be malicious.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\Downloads\AbraAcademySetup.exe.partial	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
2	[file and pathname of the sample #1]	214,016 bytes	MD5: 0xAAD0726D99C7563A3B4F4DF027C9A938 SHA-1: 0xB584E475D04190A31947A454E7B5791B964DEFA8	Adware.Trymedia [PCTools] Adware-TryMedia [McAfee] AdWare.Trymedia [Ikarus] Win-Trojan/Trymedia.214016 [AhnLab]

The following directory was created:

c:\Downloads

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	233,472 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_CURRENT_USER\Software\Trymedia Systems
HKEY_CURRENT_USER\Software\Trymedia Systems\Download Manager
HKEY_CURRENT_USER\Software\Trymedia Systems\Download Manager\jTkmQM6T80ZqpehWZNczZCuFV1c=

The newly created Registry Values are:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

AbraAcademySetup.exe = "[file and pathname of the sample #1] /r"

so that [file and pathname of the sample #1] runs every time Windows starts

[HKEY_CURRENT_USER\Software\Trymedia Systems\Download Manager\jTkmQM6T80ZqpehWZNczZCuFV1c=]

Reboots = "0"
Resumes = "0"
DownloadFolder = "C:\Downloads"
LastError = "'2'"

Other details

To mark the presence in the system, the following Mutex object was created:

Abra Academy

The following Host Name was requested from a host database:

d.trymedia.com

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
d.trymedia.com	80	(null)	(null)

The data identified by the following URL was then requested from the remote web server:

http://d.trymedia.com/dd/bigfish/30m5p_d/t_01ve/AbraAcademySetup.exe

Downloaded File Summary:

Download details:

Download retrieved: 2 July 2009 13:59:04
Processing time: 6 min 7 sec
Downloaded sample:

File MD5: 0x6509DCC6B92CB4CDFDC6322EFCFD2B6E
File SHA-1: 0x266AB4E93037BE915D26138A7C372021FDB2F53B
Filesize: 28,062,073 bytes

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%Temp%\nsy2.tmp\InstallOptions.dll	12,800 bytes	MD5: 0x57DB62366EF11FDC47922A02031F0492 SHA-1: 0x6D30DB5285B653025F94E74B9B045870DC0AEB7A
2	%Temp%\nsy2.tmp\ioSpecial.ini	699 bytes	MD5: 0x11B19C00AD94213AE0A7B8196ED32626 SHA-1: 0x01E1FC8575F33E2304D3DC02482CEA410A59D72D
3	%Temp%\nsy2.tmp\modern-header.bmp	25,818 bytes	MD5: 0xD39961E7A5660AA0520134218D0E3F4F SHA-1: 0xD1C65A5EF475A9C82D1B369035607C170521AD2D
4	%Temp%\nsy2.tmp\modern-wizard.bmp	167,102 bytes	MD5: 0x8A4A8852E51FF49D9AADFA5EAD4B5F78 SHA-1: 0xDE3ED99FB98E3E7AC6E5A83038B450A8496ADFC8
5	%Temp%\nsy2.tmp\System.dll	10,240 bytes	MD5: 0xB21538D9F049D3E3E8B666744D7CA36D SHA-1: 0xB97FC58F9AA238758A7574A2E32DAC4E97392F47
6	%Temp%\nsy2.tmp\UserInfo.dll	4,096 bytes	MD5: 0x593345196FCD1C553B0702CC026CCCCD SHA-1: 0x84446849C10E0C4D6683072F4C2EEA5A085BAC2F

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

The following directory was created:

%Temp%\nsy2.tmp

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	266,240 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Bigfishgames
HKEY_LOCAL_MACHINE\SOFTWARE\Bigfishgames\Abra Academy

The newly created Registry Value is:

[HKEY_LOCAL_MACHINE\SOFTWARE\Bigfishgames\Abra Academy]

language_id = "1033"

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.