PUA_INBOXTOOLBAR

This potentially unwanted application may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.

Arrival Details

This potentially unwanted application may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be manually installed by a user.

Installation

This potentially unwanted application drops the following files:

• %Application Data%\Inbox Toolbar\buttons.xml
• %Application Data%\Inbox Toolbar\config.ini
• %Application Data%\Inbox Toolbar\skins.xml
• %Application Data%\Inbox Toolbar\translate.ini
• %AppDataLocalLow%\Inbox Toolbar\buttons.xml
• %AppDataLocalLow%\Inbox Toolbar\config.ini
• %AppDataLocalLow%\Inbox Toolbar\skins.xml
• %AppDataLocalLow%\Inbox Toolbar\translate.ini

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %AppDataLocalLow% is the protected mode folder of Internet Explorer, where it usually is C:\Users\{user name}\AppData\LocalLow on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• {malware path}\Buttons
• {malware path}\Plugins
• {malware path}\Update
• %Application Data%\Inbox Toolbar
• %AppDataLocalLow%\Inbox Toolbar

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %AppDataLocalLow% is the protected mode folder of Internet Explorer, where it usually is C:\Users\{user name}\AppData\LocalLow on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This potentially unwanted application adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
InboxToolbar = ""{malware path}\Inbox.exe" /STARTUP"

Other System Modifications

This potentially unwanted application adds the following registry keys:

HKEY_CURRENT_USER\Software\Inbox Toolbar

HKEY_CURRENT_USER\Software\Inbox Toolbar\
UrlSearchHooks

HKEY_LOCAL_MACHINE\SOFTWARE\Inbox Toolbar

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{GUID 3}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID 1}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Inbox.AppServer

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID 2}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Inbox Toolbar
DrvHomepage = "http://www.inbox.com/homepage.aspx?tbid={data}&iwk={data}&lng=en"

HKEY_CURRENT_USER\Software\Inbox Toolbar
OriginalHP = "{Previous Homepage}"

HKEY_CURRENT_USER\Software\Inbox Toolbar
OldScope = "{Default GUID of SearchScope}"

HKEY_CURRENT_USER\Software\Inbox Toolbar
EPM = "1"

HKEY_CURRENT_USER\Software\Inbox Toolbar\
UrlSearchHooks
{CLSID} = ""

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{GUID 3}
DisplayName = "Inbox Search"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{GUID 3}
URL = "http://www2.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid={data}&iwk={data}&lng=en"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{GUID 3}
SuggestionsURL_JSON = "http://www.inbox.com/s.aspx?q={searchTerms}"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{GUID 3}
ShowSearchSuggestions = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{GUID 3}
FaviconURLFallback = "http://www2.inbox.com/favicon.ico"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes\{GUID 3}
FaviconPath = "%AppDataLocalLow%\Microsoft\Internet Explorer\Services\search_{GUID 3}.ico"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID 1}\LocalServer32
(Default) = "{malware path}\Inbox.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID 1}\ProgID
(Default) = "Inbox.AppServer"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID 1}\TypeLib
(Default) = "{GUID 2}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{GUID 1}\Version
(Default) = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Inbox.AppServer\Clsid
(Default) = "{GUID 1}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID 2}\1.0
(Default) = "Inbox"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID 2}\1.0\
0\win32
(Default) = "{malware path}\Inbox.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{GUID 2}\1.0\
HELPDIR
(Default) = "{malware path}\"

HKEY_LOCAL_MACHINE\SOFTWARE\Inbox Toolbar
UPDV = "{value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Inbox Toolbar
UPDD = "{value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Inbox Toolbar
ASKUPD1E = "{value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Inbox Toolbar
ASKUPD1H = "{value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Inbox Toolbar
ASKUPD1S = "{value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Inbox Toolbar
TUID = "{value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Inbox Toolbar
ONEBROWSERSETUP = "{1 or 0}"

HKEY_LOCAL_MACHINE\SOFTWARE\Inbox Toolbar
IE_INSTAL = "{1 or 0}"

HKEY_LOCAL_MACHINE\SOFTWARE\Inbox Toolbar
FF_INSTAL = "{1 or 0}"

HKEY_LOCAL_MACHINE\SOFTWARE\Inbox Toolbar
CH_INSTAL = "{1 or 0}"

HKEY_LOCAL_MACHINE\SOFTWARE\Inbox Toolbar
EPMApp = "{value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Inbox Toolbar
DINST = "{value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Inbox Toolbar
IWK = "{value}"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = "http://www.inbox.com/homepage.aspx?tbid={data}&iwk={data}&lng=en"

(Note: The default value data of the said registry entry is {Default Homepage}.)

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Search Bar = "http://www2.inbox.com/search/dispatcher.aspx?tp=aus&qkw={data}&tbid={data}&iwk={data}&{language}"

(Note: The default value data of the said registry entry is {Default Search Bar}.)

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\SearchScopes
DefaultScope = "{GUID 3}"

(Note: The default value data of the said registry entry is {Default GUID of SearchScope}.)

Other Details

This potentially unwanted application connects to the following possibly malicious URL:

• http://{BLOCKED}.{BLOCKED}x.com/cr_confirm.asmx/GetXMLLog?TbId={data}&TUID={data}&Action_Type={data}
• http://www2.{BLOCKED}x.com/ws_cfg.asmx/GetXML?cu={value}
• http://www2.{BLOCKED}x.com/ws_cfg.asmx/GetXMLFF?cu={value}
• http://www2.{BLOCKED}x.com/ws_conf.asmx/GetXMLInst?TbId={data}&TUID={data}&Action={data}&Result_Code={data}