home

trzf6d3.tmp

Yordan Damyanov

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The file trzf6d3.tmp by Yordan Damyanov has been detected as adware by 21 anti-malware scanners. This is a trojan Bot that uses IRC to communicate with a comand and control network. The Trojan drops other malicious software and opens a backdoor on the infected computer and will run automatically on each boot. The file has been seen being downloaded from www.dolfine.info and multiple other hosts.
Publisher:
Yordan Damyanov  (signed and verified)

MD5:
4549908471f7994ecf6a6b40ba3a19b7

SHA-1:
55bb245540c924575511f74d9a69511a35a712a0

SHA-256:
4381beb9fe25305db02b549be57f17f6c79311501b67e511c6f5e5afbe4ed305

Scanner detections:
21 / 68

Status:
Adware

Explanation:
Part of a backdoor IRC bot network.

Analysis date:
11/16/2024 1:28:21 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.GenericKD.1956239
820

Avira AntiVirus
TR/Agent.1570376
7.11.183.128

avast!
Win32:Adware-gen [Adw]
2014.9-141107

AVG
Generic5
2015.0.3298

Baidu Antivirus
Adware.Win32.Vonteera
4.0.3.14117

Bitdefender
Trojan.GenericKD.1956239
1.0.20.1555

Comodo Security
ApplicUnwnt
20007

Emsisoft Anti-Malware
Trojan.GenericKD.1956239
8.14.11.07.02

ESET NOD32
Win32/AdWare.Vonteera (variant)
8.10682

Fortinet FortiGate
Riskware/Vonteera
11/7/2014

F-Secure
Trojan.GenericKD.1956239
11.2014-07-11_6

G Data
Trojan.GenericKD.1956239
14.11.24

K7 AntiVirus
Adware
13.185.13930

Kaspersky
Trojan.Win32.Adond
14.0.0.2984

McAfee
Artemis!4549908471F7
5600.6954

MicroWorld eScan
Gen:Trojan.Heur2.RP.FzXaamr2wSgi
15.0.0.933

nProtect
Trojan.GenericKD.1956239
14.11.06.01

Reason Heuristics
PUP.YordanDamyanov.K
14.11.7.2

Sophos
Vonteera
4.98

Vba32 AntiVirus
Trojan.Adond
3.12.26.3

VIPRE Antivirus
Backdoor.Win32.Ircbot.gen
34566

File size:
1.5 MB (1,570,376 bytes)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\content.ie5\4bymkfxq\trzf6d3.tmp

Digital Signature
Signed by:
Yordan Damyanov

Authority:
COMODO CA Limited

Valid from:
10/7/2013 3:00:00 AM

Valid to:
10/8/2015 2:59:59 AM

Subject:
CN=Yordan Damyanov, O=Yordan Damyanov, STREET=19 Dobri Voinikov Str, L=Sofia, S=Sofia, PostalCode=1000, C=BG

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00FEEF0D77D0AC7E55D4E7707B384AC901

File PE Metadata
Compilation timestamp:
10/28/2014 12:59:55 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:boYuTfR5UE8M0rflAWQHd+91jyZijeOQ2gcUwfn3tPEoGpTopxSPgR1:boYuLF0RC+zCgekUwf3xGpUpxsgb

Entry address:
0x1308000

Entry point:
56, 50, 53, E8, 01, 00, 00, 00, CC, 58, 89, C3, 40, 2D, 00, C0, 0F, 00, 2D, E0, C5, AF, 05, 05, D7, C5, AF, 05, 80, 3B, CC, 75, 19, C6, 03, 00, BB, 00, 10, 00, 00, 68, 09, 07, 2B, 27, 68, B2, 96, 96, 65, 53, 50, E8, 0A, 00, 00, 00, 83, C0, 00, 89, 44, 24, 08, 5B, 58, C3, 55, 89, E5, 50, 53, 51, 56, 8B, 75, 08, 8B, 4D, 0C, C1, E9, 02, 8B, 45, 10, 8B, 5D, 14, 85, C9, 74, 0A, 31, 06, 01, 1E, 83, C6, 04, 49, EB, F2, 5E, 59, 5B, 58, C9, C2, 10, 00, 40, A0, 97, AA, A4, A9, 61, CB, C8, F1, D0, 1F, 16, F0, 42, B0...
 
[+]

Entropy:
7.9627  (probably packed)

Code size:
169 KB (173,056 bytes)

The file trzf6d3.tmp has been seen being distributed by the following 13 URLs.

http://www.dolfine.info/.../27fdfdd.exe

http://www.nansq.info/.../8f9c9174.exe

http://www.colompia.info/.../fa19c0.exe

http://www.nansq.info/.../c682d054.exe

http://91.74.184.67/.../27fdfdd.exe

http://www.golgool.info/.../a14feb7.exe

http://www.dolfine.info/.../ca267584bc.exe

http://www.golgool.info/.../c13b03bf06.exe

http://www.golgool.info/.../08c4e714.exe

http://www.nansq.info/.../cf215d6fb2.exe

http://www.dolfine.info/.../93f7f79.exe

http://www.dolfine.info/.../1883ff.exe

http://www.golgool.info/.../26516e3.exe

Remove trzf6d3.tmp - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.