ADW_SEARCHCLOUD

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes downloaded files whose malicious routines are exhibited by the affected system.

Arrival Details

This adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This adware drops the following files:

• %Program Files%\SearchCloud\Setup_SearchCloudHidden.exe
• %Program Files%\SearchCloud\Uninstall.exe
• %Program Files%\SearchCloud\Uninstall.ini

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It creates the following folders:

• %Program Files%\SearchCloud

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

Autostart Technique

This adware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
SearchCloud = "%Program Files%\SearchCloud\pluskeyU.exe" (if download was not successful)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
SearchCloud = "%Program Files%\SearchCloud\SearchCloudU.exe" (if download was successful)

Other System Modifications

This adware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Key

HKEY_CURRENT_USER\Software\Microsoft\
Key\sKey

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
SearchCloud

HKEY_CURRENT_USER\Software\SearchCloud

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Key\sKey
serial = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
Key\sKey
sChk = "1"

HKEY_CURRENT_USER\Software\SearchCloud
exec = "1001"

HKEY_CURRENT_USER\Software\SearchCloud
update = "1001"

HKEY_CURRENT_USER\Software\SearchCloud
pid = "searchcloud"

HKEY_CURRENT_USER\Software\SearchCloud
Run Date = "{date of last execution of SearchCloud.exe}"

It adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
SearchCloud
DisplayName = "SearchCloud"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
SearchCloud
DisplayIcon = "%Program Files%\SearchCloud\Uninstall.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
SearchCloud
UninstallString = "%Program Files%\SearchCloud\Uninstall.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
SearchCloud
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
SearchCloud
NoRepair = "1"

Download Routine

This adware accesses the following websites to download files:

• http://search.{BLOCKED}her.com/support/serialMk.asp?mode=serial&domain=searchcloud
• http://search.{BLOCKED}her.com/product/version.asp?domain=searchcloud&serial={random characters}
• http://search.{BLOCKED}her.com/support/installPro.asp?domain=searchcloud&serial={random characters}&sort=INS
• http://search.{BLOCKED}her.com/product/log.asp?serial={random characters}

It connects to the following URL(s) to download its component file(s):

• http://search.{BLOCKED}her.com/product/program/SearchCloud/1001/searchcloud/DelLog.exe
• http://search.{BLOCKED}her.com/product/program/SearchCloud/1001/searchcloud/SearchCloud.dll
• http://search.{BLOCKED}her.com/product/program/SearchCloud/1001/searchcloud/SearchCloud.exe
• http://search.{BLOCKED}her.com/product/program/SearchCloud/1001/searchcloud/SearchCloudU.exe
• http://search.{BLOCKED}her.com/product/program/SearchCloud/1001/searchcloud/Uninstall.exe
• http://search.{BLOCKED}her.com/product/program/SearchCloud/1001/searchcloud/Uninstall.ini

It saves the files it downloads using the following names:

• %Program Files%\SearchCloud\DelLog.exe
• %Program Files%\SearchCloud\SearchCloud.dll
• %Program Files%\SearchCloud\SearchCloud.exe
• %Program Files%\SearchCloud\SearchCloudU.exe
• %Program Files%\SearchCloud\Uninstall.exe
• %Program Files%\SearchCloud\Uninstall.ini

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It executes downloaded files :

• %Program Files%\SearchCloud\SearchCloudU.exe
• %Program Files%\SearchCloud\SearchCloud.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

NOTES:

This adware installs a global keyboard hook using the exported function GetAddress of the dropped file %Program Files%\SearchCloud\SearchCloud.dll. It monitors text boxes in the webpages displayed in Internet Explorer.

It accesses the following URL to get the URL to access to display advertisements:

• http://search.{BLOCKED}ther.com/support/keyInfo.asp?keyword={search symbol typedin the browser}&domain=searchcloud&urlYN=N&serial={random characters}&linkurl={search URL}

It then opens an Internet Explorer window with the returned URL.