Analysis by: John Rey Canon
ALIASES:

WebToolbar.Win32.Asparnet.dnq (Kaspersky); Win32/Bundled.Toolbar.Ask.G (NOD32)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Potentially Unwanted Application

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.

  TECHNICAL DETAILS

File Size: 5,243,904 bytes
File Type: Other
Memory Resident: No
Initial Samples Received Date: 27 Jun 2018

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be manually installed by a user.

Installation

This Potentially Unwanted Application drops the following files:

  • %User Temp%\WZSE0.TMP\Setup.exe
  • %User Temp%\APN-Stub\St{Random Name}.log
  • %User Temp%\APNLogs\ic.log
  • %User Temp%\AskSLib.dll
  • %Common Programs%\CutePDF\PDF Writer\Readme.lnk
  • %Program Files%\Acro Software\CutePDF Writer\CPWSave.exe.manifest
  • %Program Files%\Acro Software\CutePDF Writer\CPWSave.exe
  • %Program Files%\Acro Software\CutePDF Writer\PDFWrite.rsp
  • %Program Files%\Acro Software\CutePDF Writer\README.HTM
  • %Program Files%\Acro Software\CutePDF Writer\uninscpw.exe
  • %System%\cpwmon2k.dll
  • %System%\spool\drivers\w32x86\CUTEPDFW.PPD
  • %System%\spool\drivers\w32x86\PS5UI.DLL
  • %System%\spool\drivers\w32x86\PSCRIPT.HLP
  • %System%\spool\drivers\w32x86\PSCRIPT.NTF
  • %System%\spool\drivers\w32x86\PSCRIPT5.DLL
  • %User Temp%\converter.exe
  • %User Temp%\is-{Random Name}.tmp\ApnIC.dll
  • %User Temp%\is-{Random Name}.tmp\ApnStub.exe
  • %User Temp%\is-{Random Name}.tmp\Ask_Logo.bmp
  • %User Temp%\is-{Random Name}.tmp\Ask_Toolbar.bmp
  • %User Temp%\is-{Random Name}.tmp\cpwmon2k.dll
  • %User Temp%\is-{Random Name}.tmp\Driver\is-{Random Name}.tmp
  • %User Temp%\is-{Random Name}.tmp\Driver\x64\is-{Random Name}.tmp
  • %User Temp%\is-{Random Name}.tmp\is-{Random Name}.tmp
  • %User Temp%\is-{Random Name}.tmp\UNINSCPW.exe
  • %User Temp%\is-{Random Name}.tmp\WizModernSmallImage-IS.bmp
  • %User Temp%\is-{Random Name}.tmp\_isetup\_RegDLL.tmp
  • %User Temp%\is-{Random Name}.tmp\_isetup\_shfoldr.dll

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.. %Common Programs% is the folder that contains common program groups for all users, which is usually C:\Documents and Settings\All Users\Start Menu\Programs on Windows 2000, XP, and Server 2003, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs on Windows Vista, 7, and 8.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), 7 (32-bit), and 8 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), 7 (64-bit), and 8 (64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It creates the following folders:

  • %User Temp%\APNLogs
  • %User Temp%\WZSE0.TMP
  • %User Temp%\APN-Stub
  • %User Temp%\is-{Random Name}.tmp
  • %Common Programs%\CutePDF
  • %Program Files%\Acro Software

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.. %Common Programs% is the folder that contains common program groups for all users, which is usually C:\Documents and Settings\All Users\Start Menu\Programs on Windows 2000, XP, and Server 2003, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs on Windows Vista, 7, and 8.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), 7 (32-bit), and 8 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), 7 (64-bit), and 8 (64-bit).)

Other System Modifications

This Potentially Unwanted Application adds the following registry keys:

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Installer

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Macro

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CutePDF Writer Installation

HKEY_LOCAL_MACHINE\SOFTWARE\Acro Software Inc

HKEY_LOCAL_MACHINE\SOFTWARE\Acro Software Inc\
CutePDF Writer

It adds the following registry entries:

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
dot = {Random Numbers}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
dt = {Random Numbers}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
dtid = ^YYYYYY^YY^PH

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
ff-max-version = 13.*

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
fflu = -2

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
fv = 3.5.7 (en-US)

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
guid = {Users GUID}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
harch = {Random Numbers}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
hloc = en-US

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
homepageurl = http://www.search.ask.com/?l=dis&o=15087

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
hos = {Random Numbers}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
iedis = 0

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
ielu = -2

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
iev = {Random Numbers}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
inst = 200

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
iv = {Random Numbers}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
1 = dis

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
locale = en_US

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
location = {Users Location}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
make-offer = 1

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
nthp = 0

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
o = {Random Numbers}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
oi = nop

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
qsrc = {Random Numbers}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
repurl = http://img.apnanalytics.com/images/nocache/apn/tr.gif?ev=eichk&p2=^AG^YYYYYY^YY^PH&encb={incbid}&chk={ic_chk}&ts={random}&guid=

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
saguid = {Users GUID}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
same-partner = 0

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
slwo = 0

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
tb = ARS

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
tb-installer-path = http://apnmedia.ask.com/media/toolbar/supertoolbar/profile-ask/wrapper/2.3.0/EverestWrapper.exe

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
tb-version = {Random Numbers}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
to =

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
wft = remote

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Installer
cr-homepageurl = http://www.search.ask.com/?l=dis&o=15087cr

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Installer
crif = 1

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Installer
ff-max-version = 13.*

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Installer
guid = {Users GUID}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Installer
homepageurl = http://www.search.ask.com/?l=dis&o=15087

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Installer
make-offer = 1

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Installer
nthp = 0

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Installer
oi = nop

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Installer
repurl = http://img.apnanalytics.com/images/nocache/apn/tr.gif?ev=eichk&p2=^AG^YYYYYY^YY^PH&encb={incbid}&chk={ic_chk}&ts={random}&guid=

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Macro
cbid = ^AG

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Macro
cr-o = {Random Numbers}cr

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Macro
crumb = {Date}+{Time}-{Random Text}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Macro
dtid = ^YYYYYY^YY^PH

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Macro
1 = dis

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Macro
locale = en_US

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Macro
location = {Users Location}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Macro
o = {Random Numbers}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Macro
qsrc = {Random Numbers}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Macro
slwo = 0

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\Macro
to =

HKEY_CURRENT_USER\.DEFAULT\Printers\
DevModes2
CutePDF Writer = {Hex Values}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CutePDF Writer Installation
DisplayName = CutePDF Writer 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
CutePDF Writer Installation
UninstallString = C:\Program Files\Acro Software\CutePDF Writer\uninscpw.exe

HKEY_CURRENT_USER\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings
ProxyEnable = 0

HKEY_CURRENT_USER\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings\Connections
SavedLegacySettings = {Hex Values}

HKEY_LOCAL_MACHINE\SOFTWARE\Acro Software Inc\
CutePDF Writer
Destination Folder = C:\Program Files\Acro Software\CutePDF Writer

HKEY_LOCAL_MACHINE\SOFTWARE\Acro Software Inc\
CutePDF Writer
"" = C:\Program Files\GNUGS

HKEY_CURRENT_USER\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings
ProxyEnable = 0

HKEY_CURRENT_USER\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings\Connections
SavedLegacySettings = {Hex Values}

HKEY_CURRENT_USER\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings\Connections
DefaultConnectionSettings = {Hex Values}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
apn_dbr = ie_{Random Numbers}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
cbid = ^AG

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
client = ic

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
clientv = 9.9.9.9

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
cr = 1

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
cr-homepageurl = http://www.search.ask.com/?l=dis&o=15087cr

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
cr-o = {Random Numbers}cr

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
crif = 1

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
crumb = {Date}+{Time}-{Random Text}

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
crx-path = http://apnmedia.ask.com/media/toolbar/supertoolbar/chrome/ARS/1.17.7.0/aaaappmhgaaggeoepicjahnbofmjacog_7.17.7.0.crx

HKEY_CURRENT_USER\.DEFAULT\Software\
Ask.com.tmp\General
dbr = {Random Numbers}

Other Details

This Potentially Unwanted Application connects to the following possibly malicious URL:

  • http://apnmedia.{BLOCKED}k.com/media/toolbar/stub/1.0.0.0/ApnIC.dll?tb=ARS&version=1.0.0.0
  • http://websearch.{BLOCKED}k.com/installed?client=ic&tb=ARS&dtid=&id=4afcb82e-a41d-4e59-9f92-e117768a0d02&ipid=&iev=8.0.7601.17514&iedis=0&ielu=-2&fflu=-2&iv=&nv=&clientv=9.9.9.9&said=6c268d7c-11c4-4968-bb72-cf587d3d5bd7&browser-lang=en&apn_dbr=ie_8.0.7601.17514&cr=1
  • http://img.{BLOCKED}lytics.com/images/nocache/apn/tr.gif?ev=eichk&p2=^AG^YYYYYY^YY^PH&encb=&chk=sucof&ts=syhAI&guid=4afcb82e-a41d-4e59-9f92-e117768a0d02&dt=14913&wft=remote&inst=200&tb=ARS&hos=6.1.1.sp1.x86&harch=32&hloc=en-US&iv=8.0.7601.17514&fv=3.5.7%20(en-US)&dbr=132&vb=&msi=&dot=6
  • http://download.{BLOCKED}ftware.com/download/converter.asp?V=W3
  • http://download.{BLOCKED}ftware.com/download/gplgs.exe

  SOLUTION

Minimum Scan Engine: 9.850
SSAPI PATTERN File: 1.995.00
SSAPI PATTERN Date: 06 Sep 2018

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\.DEFAULT\Software
    • Ask.com.tmp
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
    • CutePDF Writer Installation
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • Acro Software Inc

Step 4

Search and delete these folders

[ Learn More ]
Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.
  • %User Temp%\WZSE0.TMP
  • %User Temp%\APN-Stub
  • %User Temp%\is-{Random Name}.tmp
  • %Common Programs%\CutePDF
  • %Program Files%\Acro Software
  • %User Temp%\APNLogs

Step 5

Search and delete files detected as PUA_BUNDLER.GB

[ Learn More ]
Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.
  • %User Temp%\AskSLib.dll
  • %Temporary Internet Files%\Content.IE5\NVUI4L47\gplgs[1].exe
  • %System%\cpwmon2k.dll
  • %System%\spool\drivers\w32x86\CUTEPDFW.PPD
  • %System%\spool\drivers\w32x86\PS5UI.DLL
  • %System%\spool\drivers\w32x86\PSCRIPT.HLP
  • %System%\spool\drivers\w32x86\PSCRIPT.NTF
  • %System%\spool\drivers\w32x86\PSCRIPT5.DLL
  • %User Temp%\converter.exe

Step 6

Scan your computer with your Trend Micro product to delete files detected as PUA_BUNDLER.GB. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:


Did this description help? Tell us how we did.