PUA.WIN32.HAO.GA

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application drops the following files:

• %Application Data%\baidu\hao123-jp\hao123.1.0.0.1100.exe
• %Desktop%\hao123.lnk
• %Programs%\日本hao123\hao123.lnk
• %Programs%\日本hao123\hao123のアンインストール.lnk
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\hao123.lnk
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\hao123.lnk
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\hao123.lnk

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista, 7, and 8.. %Programs% is the folder that contains the user’s program groups, which is usually C:\Windows\Start Menu\Programs or C:\Documents and Settings\{User name}\Start Menu\Programs on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs on Windows Vista, 7, and 8.)

It creates the following folders:

• %Application Data%\baidu
• %Application Data%\baidu\hao123-jp
• %Programs%\日本hao123

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.. %Programs% is the folder that contains the user’s program groups, which is usually C:\Windows\Start Menu\Programs or C:\Documents and Settings\{User name}\Start Menu\Programs on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs on Windows Vista, 7, and 8.)

Other System Modifications

This Potentially Unwanted Application adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
hao123desk-international

HKEY_CURRENT_USER\Software\Baidu

HKEY_CURRENT_USER\Software\Baidu\
Hao123-international

HKEY_CURRENT_USER\Software\Baidu\
Hao123-international\hao123desk

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
hao123desk-international
DisplayIcon = ""%Application Data%\baidu\hao123-jp\hao123.1.0.0.1100.exe""

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
hao123desk-international
DisplayName = "日本hao123ショートカット"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
hao123desk-international
DisplayVersion = "1.0.0.1100"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
hao123desk-international
HelpLink = "http://www.{BLOCKED}3.com/desk.html"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
hao123desk-international
Publisher = "hao123"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
hao123desk-international
UninstallString = ""%Application Data%\baidu\hao123-jp\hao123.1.0.0.1100.exe" uninstall"

HKEY_CURRENT_USER\Software\Baidu\
Hao123-international\hao123desk
LaunchCount = "1"

HKEY_CURRENT_USER\Software\Baidu\
Hao123-international\hao123desk
LaunchCount = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
StartPage2
FavoritesVersion = "2"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
StartPage2
FavoritesChanges = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
StartPage2
Favorites = {hex values}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
StartPage2
FavoritesResolve = {hex values}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Taskband
FavoritesVersion = "2"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Taskband
FavoritesChanges = "35"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Taskband
FavoritesResolve = {hex values}

Other Details

This Potentially Unwanted Application does the following:

• It connects to the following URL(s) to update itself:
  • http://dl.client.{BLOCKED}u.com/hao123/desk/jp/update-jp?ver=1100.1.12.1.0:ggMAAAAAAQAAANot0FQAYEAARv-7-9qBHE2prARf-1RRwwIAAAAjuudMAGATADdVvqXR8GZMlhMQgRmocuUCAAAA87jnTABwWwB2oQGMmH0wSI1Lr98OvrdFAgAAAN2550wA4AIApWb+EsP7y0aj+4XZCo92qQIAAAAA&ver4=MQA=&ver5=YWE1NTAxNTg5Nzg5OWU2ZTgzNzI4ODcyOGNlOTQ2MmEA
• It sets the home page of the google chrome to the following URL(s):
  • http://jp.{BLOCKED}.com/?guide=1