PUA.MSIL.AppSync.AA

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application drops the following copies of itself into the affected system:

• %application data%\appsync\{malware file name}.bin

It creates the following folders:

• %Application Data%\AppSync\chrome_BITS_3756_19263
• %Application Data%\AppSync\Adobe_ADMLogs
• %Application Data%\AppSync\acrocef_low
• %Application Data%\AppSync\IXP000.TMP
• %Application Data%\AppSync\hsperfdata_Administrator
• %Application Data%\AppSync\ToUnzip
• %Application Data%\AppSync\WebInstaller
• %Application Data%\AppSync\WPDNSE
• %Application Data%\AppSync\Deployment
• %Application Data%\AppSync\acrord32_sbx
• %Application Data%\AppSync
• %Application Data%\AppSync\Low
• %Application Data%\AppSync\CR_E83EE.tmp
• %Application Data%\AppSync\mozilla-temp-files

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Dropping Routine

This Potentially Unwanted Application drops the following files:

• %Application Data%\AppSync\SetupExe(201701240615299E0).log
• %Application Data%\AppSync\MSIa2c4d.LOG
• %Application Data%\AppSync\IXP000.TMP\SmallInstaller.exe
• %Application Data%\AppSync\AdobeSFX.log
• %Application Data%\AppSync\dd_vcredistUI0FC1.txt
• %Application Data%\AppSync\dd_vcredistUI0FD5.txt
• %Application Data%\AppSync\vminst.log_20170124_112725.log
• %Application Data%\AppSync\IXP000.TMP\McUpdater.dll
• %Application Data%\AppSync\MSI6f768.LOG
• %Application Data%\AppSync\MSI25c23.LOG
• %Application Data%\AppSync\MSIf9aa9.LOG
• %Application Data%\AppSync\dd_wcf_CA_smci_20161212_135109_353.txt
• %Application Data%\AppSync\wmsetup.log
• %Application Data%\AppSync\ToUnzip\AppMaster.exe
• %Application Data%\AppSync\dd_vcredistMSI0FC1.txt
• %Application Data%\AppSync\jusched.log
• %Application Data%\AppSync\dd_NDP452-KB2901907-x86-x64-AllOS-ENU_decompression_log.txt
• %User Temp%\reveal.dll
• %Application Data%\AppSync\dd_SetupUtility.txt
• %Application Data%\AppSync\MSI5a7c3.LOG
• %Application Data%\AppSync\ose00000.exe
• %Application Data%\AppSync\MSId1a0.LOG
• %AppDataLocal%\GDIPFONTCACHEV1.DAT
• %Application Data%\AppSync\MSIb5e83.LOG
• %User Temp%\handleFS.dll
• %Application Data%\AppSync\MSI7e436.LOG
• %User Temp%\Action.log
• %Application Data%\AppSync\WebInstaller\ServiceUpdaterLogs.log
• %Application Data%\AppSync\MSI27204.LOG
• %Application Data%\AppSync\MSIbab6b.LOG
• %Application Data%\AppSync\MSI547d8.LOG
• %Application Data%\AppSync\IXP000.TMP\McUtil.dll
• %Application Data%\AppSync\Action.log
• %Application Data%\AppSync\MSI18620.LOG
• %Application Data%\AppSync\StructuredQuery.log
• %Application Data%\AppSync\au-descriptor-1.8.0_211-b12.xml
• %Application Data%\AppSync\RGI282A.tmp-tmp
• %Application Data%\AppSync\ASPNETSetup_00001.log
• %Application Data%\AppSync\dd_wcf_CA_smci_20161212_135110_351.txt
• %Application Data%\AppSync\MSIa6383.LOG
• %Application Data%\AppSync\MSI19f3b.LOG
• %Application Data%\AppSync\MSI11747.LOG
• %Application Data%\AppSync\Adobe_ADMLogs\Adobe_GDE.log
• %Application Data%\AppSync\RGI282A.tmp
• %Application Data%\AppSync\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207-MSI_netfx_Full_GDR_x64.msi.txt
• %Application Data%\AppSync\Tom.bmp
• %Application Data%\AppSync\ASPNETSetup_00000.log
• %Application Data%\AppSync\handleFS.dll
• %Application Data%\AppSync\MSI351f6.LOG
• %Application Data%\AppSync\MSIbaba9.LOG
• %Application Data%\AppSync\Adobe_ADMLogs\Adobe_ADM.log
• %Application Data%\AppSync\Microsoft .NET Framework 4.5.2 Setup_20161212_135033207.html
• %Application Data%\AppSync\AdobeARM.log
• %Application Data%\AppSync\jawshtml.html
• %Application Data%\AppSync\All.log
• %Application Data%\AppSync\reveal.dll
• %Application Data%\AppSync\MSI97997.LOG
• %Application Data%\AppSync\ToUnzip\AppMaster.exe.config
• %Application Data%\AppSync\dd_vcredistMSI0FD5.txt
• %Application Data%\AppSync\chrome_BITS_3756_19263\9.1_all_easylist.crx3
• %Application Data%\AppSync\chrome_installer.log
• %Application Data%\AppSync\Guest.bmp
• %User Temp%\All.log
• %Application Data%\AppSync\Administrator.bmp
• %Application Data%\AppSync\MSIaaade.LOG
• %Application Data%\AppSync\vmmsi.log_20170124_112725.log
• %Application Data%\AppSync\MSI20ab9.LOG
• %Application Data%\AppSync\MSIbee93.LOG
• %Application Data%\AppSync\acrord32_sbx\BroadcastMsg_1557285428.txt
• %Application Data%\AppSync\FXSAPIDebugLogFile.txt
• %Application Data%\AppSync\MSI733bc.LOG
• %Application Data%\AppSync\JavaDeployReg.log
• %Application Data%\AppSync\CR_E83EE.tmp\setup.exe
• %Application Data%\AppSync\MSIcaa33.LOG

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

This report is generated via an automated analysis system.