Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'VIDC.FFDS' = 'ff_vfw.dll'
Malicious functions:
Executes the following:
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\ffdshow\ffdshow.ax"
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 616
- '%TEMP%\ffdshow.exe' /VERYSILENT
- '%TEMP%\is-SAQ98.tmp\ffdshow.tmp' /SL5="$30092,4266850,140800,%TEMP%\ffdshow.exe" /VERYSILENT
Modifies file system:
Creates the following files:
- %ProgramFiles%\ffdshow\custom matrices\is-SVR8I.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-DF5MN.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-1SFKP.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-G90N2.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-UQ24F.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-0GT7F.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-RQKCJ.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-NHVGT.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-S7JLR.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-9T2AL.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-0RND7.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-N57BU.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-IT9MT.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-ROSAJ.tmp
- %ProgramFiles%\ffdshow\languages\is-0VC76.tmp
- %ProgramFiles%\ffdshow\languages\is-H2C5C.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-07NON.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-R65B3.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-O3NRN.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-F5L2T.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-SSK95.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\ffdshow\Video decoder configuration.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ffdshow\VFW configuration.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ffdshow\Audio decoder configuration.lnk
- %ProgramFiles%\ffdshow\is-3OCAO.tmp
- %ProgramFiles%\ffdshow\is-RGMF5.tmp
- %TEMP%\dw.log
- %TEMP%\2C7CA.dmp
- %ProgramFiles%\ffdshow\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\ffdshow\Uninstall ffdshow.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ffdshow\Homepage.url
- %ProgramFiles%\ffdshow\is-3T8BN.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-NS7CG.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-178A0.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-94MA2.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-7ITBF.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-0VS01.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-168CV.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-TL9DI.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-5L8TA.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-V2EJL.tmp
- %ProgramFiles%\ffdshow\custom matrices\is-RSUJ7.tmp
- %ProgramFiles%\ffdshow\languages\is-NDO30.tmp
- %ProgramFiles%\ffdshow\is-4DTSJ.tmp
- %ProgramFiles%\ffdshow\is-72NI7.tmp
- %ProgramFiles%\ffdshow\is-BAHIN.tmp
- %ProgramFiles%\ffdshow\is-V32SK.tmp
- %ProgramFiles%\ffdshow\is-ASJOJ.tmp
- %ProgramFiles%\ffdshow\is-DCFBU.tmp
- %ProgramFiles%\ffdshow\is-QR9J3.tmp
- %ProgramFiles%\ffdshow\is-RGKAO.tmp
- %ProgramFiles%\ffdshow\is-IACJG.tmp
- %ProgramFiles%\ffdshow\is-UC545.tmp
- %ProgramFiles%\ffdshow\is-DM5V9.tmp
- <Current directory>\GoogleMap.html
- <Current directory>\CarMarker.png
- <Current directory>\AxInterop.WMPLib.dll
- <Current directory>\setting.ini
- <Current directory>\Interop.WMPLib.dll
- %TEMP%\is-BC8R2.tmp\WinCPUID.dll
- %TEMP%\is-BC8R2.tmp\ffSpkCfg.dll
- %TEMP%\is-BC8R2.tmp\_isetup\_shfoldr.dll
- %TEMP%\ffdshow.exe
- %TEMP%\is-SAQ98.tmp\ffdshow.tmp
- %ProgramFiles%\ffdshow\languages\is-TORJ7.tmp
- %ProgramFiles%\ffdshow\languages\is-4NBJF.tmp
- %ProgramFiles%\ffdshow\languages\is-O6RMJ.tmp
- %ProgramFiles%\ffdshow\languages\is-RFILI.tmp
- %ProgramFiles%\ffdshow\languages\is-5GHQH.tmp
- %ProgramFiles%\ffdshow\languages\is-L1TFQ.tmp
- %ProgramFiles%\ffdshow\languages\is-6HM3Q.tmp
- %ProgramFiles%\ffdshow\languages\is-Q4KLS.tmp
- %ProgramFiles%\ffdshow\languages\is-KVMB1.tmp
- %ProgramFiles%\ffdshow\languages\is-UMPG4.tmp
- %ProgramFiles%\ffdshow\languages\is-POUJE.tmp
- %ProgramFiles%\ffdshow\is-2HOE4.tmp
- <SYSTEM32>\is-O2QFA.tmp
- %ProgramFiles%\ffdshow\is-HTL1H.tmp
- %ProgramFiles%\ffdshow\is-B0JT3.tmp
- %ProgramFiles%\ffdshow\is-DHJEF.tmp
- %ProgramFiles%\ffdshow\languages\is-95FGH.tmp
- %ProgramFiles%\ffdshow\languages\is-2A9DL.tmp
- %ProgramFiles%\ffdshow\languages\is-DAIFC.tmp
- <SYSTEM32>\is-7120H.tmp
- %ProgramFiles%\ffdshow\languages\is-UO2EP.tmp
Deletes the following files:
- %TEMP%\is-SAQ98.tmp\ffdshow.tmp
- %TEMP%\ffdshow.exe
- %TEMP%\is-BC8R2.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-BC8R2.tmp\ffSpkCfg.dll
- %TEMP%\is-BC8R2.tmp\WinCPUID.dll
Moves the following files:
- from %ProgramFiles%\ffdshow\custom matrices\is-G90N2.tmp to %ProgramFiles%\ffdshow\custom matrices\eqm_v3ehr.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-UQ24F.tmp to %ProgramFiles%\ffdshow\custom matrices\eqm_v3hr.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-R65B3.tmp to %ProgramFiles%\ffdshow\custom matrices\eqm_avc_hr.cfg
- from %ProgramFiles%\ffdshow\custom matrices\is-0RND7.tmp to %ProgramFiles%\ffdshow\custom matrices\eqm_v1.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-DF5MN.tmp to %ProgramFiles%\ffdshow\custom matrices\eqm_v3ulr_rev3.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-S7JLR.tmp to %ProgramFiles%\ffdshow\custom matrices\hvs-best-picture.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-1SFKP.tmp to %ProgramFiles%\ffdshow\custom matrices\eqm_v3lr.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-SVR8I.tmp to %ProgramFiles%\ffdshow\custom matrices\eqm_v3uhr_rev2.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-N57BU.tmp to %ProgramFiles%\ffdshow\custom matrices\andreas_doppelte_99er.matrix.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-IT9MT.tmp to %ProgramFiles%\ffdshow\custom matrices\andreas_einfache_99er.matrix.xcm
- from %ProgramFiles%\ffdshow\languages\is-H2C5C.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.2052.sc
- from %ProgramFiles%\ffdshow\custom matrices\is-ROSAJ.tmp to %ProgramFiles%\ffdshow\custom matrices\andreas_78er.matrix.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-O3NRN.tmp to %ProgramFiles%\ffdshow\custom matrices\CG-Animation Matrix.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-07NON.tmp to %ProgramFiles%\ffdshow\custom matrices\eqm_autogk_sharp.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-F5L2T.tmp to %ProgramFiles%\ffdshow\custom matrices\Bulletproof's Heavy Compression Matrix.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-SSK95.tmp to %ProgramFiles%\ffdshow\custom matrices\Bulletproof's High Quality Matrix.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-9T2AL.tmp to %ProgramFiles%\ffdshow\custom matrices\hvs-better-picture.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-5L8TA.tmp to %ProgramFiles%\ffdshow\custom matrices\Ultimate Matrix.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-168CV.tmp to %ProgramFiles%\ffdshow\custom matrices\Ultra Low Bitrate Matrix.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-V2EJL.tmp to %ProgramFiles%\ffdshow\custom matrices\Soulhunters V5.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-RSUJ7.tmp to %ProgramFiles%\ffdshow\custom matrices\Standard.xcm
- from %ProgramFiles%\ffdshow\is-3OCAO.tmp to %ProgramFiles%\ffdshow\gnu_license.txt
- from %ProgramFiles%\ffdshow\is-RGMF5.tmp to %ProgramFiles%\ffdshow\Boost_Software_License_1.0.txt
- from %ProgramFiles%\ffdshow\custom matrices\is-TL9DI.tmp to %ProgramFiles%\ffdshow\custom matrices\Very Low Bitrate Matrix.xcm
- from %ProgramFiles%\ffdshow\is-3T8BN.tmp to %ProgramFiles%\ffdshow\openIE.js
- from %ProgramFiles%\ffdshow\custom matrices\is-RQKCJ.tmp to %ProgramFiles%\ffdshow\custom matrices\MPEG.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-7ITBF.tmp to %ProgramFiles%\ffdshow\custom matrices\pvcd.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-NHVGT.tmp to %ProgramFiles%\ffdshow\custom matrices\hvs-good-picture.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-0GT7F.tmp to %ProgramFiles%\ffdshow\custom matrices\Low Bitrate Matrix.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-NS7CG.tmp to %ProgramFiles%\ffdshow\custom matrices\q_matrix_def.cfg
- from %ProgramFiles%\ffdshow\custom matrices\is-178A0.tmp to %ProgramFiles%\ffdshow\custom matrices\Soulhunters V3.xcm
- from %ProgramFiles%\ffdshow\custom matrices\is-0VS01.tmp to %ProgramFiles%\ffdshow\custom matrices\q_matrix.cfg
- from %ProgramFiles%\ffdshow\custom matrices\is-94MA2.tmp to %ProgramFiles%\ffdshow\custom matrices\q_matrix2.cfg
- from %ProgramFiles%\ffdshow\languages\is-0VC76.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1053.sv
- from %ProgramFiles%\ffdshow\is-QR9J3.tmp to %ProgramFiles%\ffdshow\TomsMoComp_ff.dll
- from %ProgramFiles%\ffdshow\is-B0JT3.tmp to %ProgramFiles%\ffdshow\libmpeg2_ff.dll
- from %ProgramFiles%\ffdshow\is-RGKAO.tmp to %ProgramFiles%\ffdshow\xvidcore.dll
- from %ProgramFiles%\ffdshow\is-DCFBU.tmp to %ProgramFiles%\ffdshow\ff_kernelDeint.dll
- from %ProgramFiles%\ffdshow\is-2HOE4.tmp to %ProgramFiles%\ffdshow\ff_wmv9.dll
- from <SYSTEM32>\is-O2QFA.tmp to <SYSTEM32>\ff_vfw.dll
- from %ProgramFiles%\ffdshow\is-DHJEF.tmp to %ProgramFiles%\ffdshow\ffdshow.ax
- from %ProgramFiles%\ffdshow\is-HTL1H.tmp to %ProgramFiles%\ffdshow\ffdshow.ax.manifest
- from %ProgramFiles%\ffdshow\is-ASJOJ.tmp to %ProgramFiles%\ffdshow\ff_liba52.dll
- from %ProgramFiles%\ffdshow\is-BAHIN.tmp to %ProgramFiles%\ffdshow\ff_libdts.dll
- from %ProgramFiles%\ffdshow\is-DM5V9.tmp to %ProgramFiles%\ffdshow\unins000.exe
- from %ProgramFiles%\ffdshow\is-V32SK.tmp to %ProgramFiles%\ffdshow\ffmpeg.dll
- from %ProgramFiles%\ffdshow\is-IACJG.tmp to %ProgramFiles%\ffdshow\ff_unrar.dll
- from %ProgramFiles%\ffdshow\is-UC545.tmp to %ProgramFiles%\ffdshow\ff_samplerate.dll
- from %ProgramFiles%\ffdshow\is-4DTSJ.tmp to %ProgramFiles%\ffdshow\ff_libfaad2.dll
- from %ProgramFiles%\ffdshow\is-72NI7.tmp to %ProgramFiles%\ffdshow\ff_libmad.dll
- from <SYSTEM32>\is-7120H.tmp to <SYSTEM32>\ff_vfw.dll.manifest
- from %ProgramFiles%\ffdshow\languages\is-KVMB1.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1041.ja
- from %ProgramFiles%\ffdshow\languages\is-UMPG4.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1042.ko
- from %ProgramFiles%\ffdshow\languages\is-TORJ7.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1038.hu
- from %ProgramFiles%\ffdshow\languages\is-4NBJF.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1040.it
- from %ProgramFiles%\ffdshow\languages\is-6HM3Q.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1049.ru
- from %ProgramFiles%\ffdshow\languages\is-NDO30.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1051.sk
- from %ProgramFiles%\ffdshow\languages\is-Q4KLS.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1045.pl
- from %ProgramFiles%\ffdshow\languages\is-L1TFQ.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1046.br
- from %ProgramFiles%\ffdshow\languages\is-95FGH.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1029.cs
- from %ProgramFiles%\ffdshow\languages\is-2A9DL.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1031.de
- from %ProgramFiles%\ffdshow\languages\is-UO2EP.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1026.bg
- from %ProgramFiles%\ffdshow\languages\is-DAIFC.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1028.tc
- from %ProgramFiles%\ffdshow\languages\is-5GHQH.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1035.fi
- from %ProgramFiles%\ffdshow\languages\is-O6RMJ.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1036.fr
- from %ProgramFiles%\ffdshow\languages\is-POUJE.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1033.en
- from %ProgramFiles%\ffdshow\languages\is-RFILI.tmp to %ProgramFiles%\ffdshow\languages\ffdshow.1034.es
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
