Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '365Calendar 1.0' = '"%PROGRAM_FILES%\365Calendar\365Calendar.exe" -minimize'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\365Calendar\365Calendar.exe' = '%PROGRAM_FILES%\365Calendar\365Calendar.exe:*:Enabled:365Calendar'
Creates and executes the following:
- '%PROGRAM_FILES%\365Calendar\365Calendar.exe' -statistics install
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\365Calendar\skin\ЙиЦГ-»¬№э.png
- %PROGRAM_FILES%\365Calendar\skin\ЙиЦГ-Д¬ИП.png
- %PROGRAM_FILES%\365Calendar\skin\Йііѕ±©.png
- %PROGRAM_FILES%\365Calendar\skin\ЙиЦГ-µг»ч.png
- %PROGRAM_FILES%\365Calendar\skin\Лш¶Ё-µг»ч.png
- %PROGRAM_FILES%\365Calendar\skin\Лш¶Ё2-µг»ч.png
- %PROGRAM_FILES%\365Calendar\skin\Лш¶Ё2-»¬№э.png
- %PROGRAM_FILES%\365Calendar\skin\Лш¶Ё-»¬№э.png
- %PROGRAM_FILES%\365Calendar\skin\Лш¶Ё-Д¬ИП.png
- %PROGRAM_FILES%\365Calendar\skin\И·ИПЎўИЎПы°ґЕҐ-Ку±к»¬№э.png
- %PROGRAM_FILES%\365Calendar\skin\№Ш±Х-Д¬ИП.png
- %PROGRAM_FILES%\365Calendar\skin\АЧХуУк.png
- %PROGRAM_FILES%\365Calendar\skin\№Ш±Х-µг»ч.png
- %PROGRAM_FILES%\365Calendar\skin\№Ш±Х-»¬№э.png
- %PROGRAM_FILES%\365Calendar\skin\АЧХуУк°йУР±щ±ў.png
- %PROGRAM_FILES%\365Calendar\skin\И·ИПЎўИЎПы°ґЕҐ-µг»ч.png
- %PROGRAM_FILES%\365Calendar\skin\И·ИПЎўИЎПы°ґЕҐ-Д¬ИП.png
- %PROGRAM_FILES%\365Calendar\skin\ЗїЙііѕ±©.png
- %PROGRAM_FILES%\365Calendar\skin\Зз.png
- %PROGRAM_FILES%\365Calendar\skin\ЦРС©.png
- %PROGRAM_FILES%\365Calendar\skin\ЦРУк.png
- %PROGRAM_FILES%\365Calendar\skin\ХуС©.png
- %PROGRAM_FILES%\365Calendar\skin\ХуУк.png
- %PROGRAM_FILES%\365Calendar\skin\цІ.png
- %HOMEPATH%\Start Menu\Programs\365Calendar\Uninstall.lnk
- %PROGRAM_FILES%\365Calendar\uninst.exe
- %HOMEPATH%\Start Menu\Programs\365Calendar\365Calendar.lnk
- %HOMEPATH%\Desktop\365Calendar.lnk
- %PROGRAM_FILES%\365Calendar\skin\УкјРС©.png
- %PROGRAM_FILES%\365Calendar\skin\МбКѕїтН·ІїЗРНј.png
- %PROGRAM_FILES%\365Calendar\skin\Он.png
- %PROGRAM_FILES%\365Calendar\skin\Лш¶Ё2-Д¬ИП.png
- %PROGRAM_FILES%\365Calendar\skin\МШґу±©Ук.png
- %PROGRAM_FILES%\365Calendar\skin\РЎС©.png
- %PROGRAM_FILES%\365Calendar\skin\Тх.png
- %PROGRAM_FILES%\365Calendar\skin\ТюІШ.png
- %PROGRAM_FILES%\365Calendar\skin\РЎУк.png
- %PROGRAM_FILES%\365Calendar\skin\СпЙі.png
- %PROGRAM_FILES%\365Calendar\skin\ёЎіѕ.png
- %PROGRAM_FILES%\365Calendar\skin\MainFrame.xml
- %PROGRAM_FILES%\365Calendar\skin\MsgTips.xml
- %PROGRAM_FILES%\365Calendar\skin\CalenderCell.xml
- %PROGRAM_FILES%\365Calendar\skin\CalenderCtrl.xml
- %PROGRAM_FILES%\365Calendar\skin\VersionCheck.xml
- %PROGRAM_FILES%\365Calendar\skin\btn_hot.png
- %PROGRAM_FILES%\365Calendar\skin\combo.png
- %PROGRAM_FILES%\365Calendar\skin\VersionCheck_new.xml
- %PROGRAM_FILES%\365Calendar\skin\bj.png
- %PROGRAM_FILES%\365Calendar\skin\AboutDlg.xml
- %PROGRAM_FILES%\365Calendar\DuiLib.dll
- %PROGRAM_FILES%\365Calendar\P2PCore.dll
- %TEMP%\nse2.tmp\System.dll
- %PROGRAM_FILES%\365Calendar\365Calendar.exe
- %PROGRAM_FILES%\365Calendar\P2SCore.dll
- %PROGRAM_FILES%\365Calendar\dat\Appsetting.cfg
- %PROGRAM_FILES%\365Calendar\dat\holiday.dat
- %PROGRAM_FILES%\365Calendar\Update.dll
- %PROGRAM_FILES%\365Calendar\calendarhelper.dll
- %PROGRAM_FILES%\365Calendar\skin\±©Ук.png
- %PROGRAM_FILES%\365Calendar\skin\ґнОуМбКѕНј±к.png
- %PROGRAM_FILES%\365Calendar\skin\vacationsmall.png
- %PROGRAM_FILES%\365Calendar\skin\±©С©.png
- %PROGRAM_FILES%\365Calendar\skin\ґу±©Ук.png
- %PROGRAM_FILES%\365Calendar\skin\¶іУк.png
- %PROGRAM_FILES%\365Calendar\skin\¶аФЖ.png
- %PROGRAM_FILES%\365Calendar\skin\ґуС©.png
- %PROGRAM_FILES%\365Calendar\skin\ґуУк.png
- %PROGRAM_FILES%\365Calendar\skin\vacation.png
- %PROGRAM_FILES%\365Calendar\skin\datebar_bg.png
- %PROGRAM_FILES%\365Calendar\skin\list_header_sep.png
- %PROGRAM_FILES%\365Calendar\skin\curday.png
- %PROGRAM_FILES%\365Calendar\skin\curdaysmall.png
- %PROGRAM_FILES%\365Calendar\skin\logo.png
- %PROGRAM_FILES%\365Calendar\skin\scrollbar.bmp
- %PROGRAM_FILES%\365Calendar\skin\scrollbar.png
- %PROGRAM_FILES%\365Calendar\skin\overtime.png
- %PROGRAM_FILES%\365Calendar\skin\overtimesmall.png
Deletes the following files:
- %PROGRAM_FILES%\365Calendar\dat\Appsetting.cfg
- %TEMP%\nse2.tmp\System.dll
Network activity:
Connects to:
- 'ca###at.7pk.com':80
- 'up###e.7pk.com':80
- 'if####.ip138.com':80
- 'm.####her.com.cn':80
TCP:
HTTP GET requests:
- ca###at.7pk.com/clientaction/clickrun/365calendar/365calendar/76C221C965FAD5BA13EF5E3336A82203/101875/0/76C221C965FAD5BA13EF5E3336A82203
- up###e.7pk.com/updateinfo.xml
- ca###at.7pk.com/clientaction/install/365calendar/365calendar/76C221C965FAD5BA13EF5E3336A82203/101875/0/76C221C965FAD5BA13EF5E3336A82203
- if####.ip138.com/ic.asp
- m.####her.com.cn/data/101010100.html
UDP:
- DNS ASK ca###at.7pk.com
- DNS ASK up###e.7pk.com
- DNS ASK if####.ip138.com
- DNS ASK m.####her.com.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'TrayClockWClass' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'TrayNotifyWnd' WindowName: '(null)'
- ClassName: 'SECalenderWndClass' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
