Home / malware

PDF

PUA:Win32/Niguide

First posted on 04 July 2016.
Source: Microsoft

Aliases :

There are no other names known for PUA:Win32/Niguide.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

• low.software.dn.naver.com
• high.software.dn.naver.com
• down.startools.co.kr
• file.ancamera.co.kr
• down.ancamera.co.kr

We have seen this application use the following file names:

• DTLite4491-0352_naver.exe
• starpdf_home.exe
• AnCamCorder_Setup_3.4.1_naver.exe
• DTLite4491-0352_naver (1).exe
• AnCamera_Setup_Lite.exe
• starzip_v2.070_naver.exe
• badakencoder_3.0.0.14.exe
• anrecorder_naver.exe
• AnCamera_Setup_5.3.8.exe

It can be digitally signed by the following vendors:

• EbizNetWorks
• (주)이비즈네트웍스
• ebiznetworks
• Disc Soft Ltd
• DT Soft Ltd

We have seen this application using product names such as:

• DAEMON TOOLS LITE
• ks Module
• ebiz ancamcorderupdate
• StarPDF ReaderII
• starpdfup 응용 프로그램

This application communicates with domains such as:

• www.daemon-tools.kr
• depot.mountspace.com
• daemon-tools.kr
• down.daemon-tools.kr
• res1.mountspace.com

For example:

• www.daemon-tools.kr/sec/checkpay_150728_free.php
• www.daemon-tools.kr/home/js/common.js
• www.daemon-tools.kr/home/js/ajax.js

Payload

Exhibits suspicious behaviors

We have observed this application exhibit the following potentially unwanted behavior on PCs:

• Installs programs that start automatically when your PC starts
• Injects into other processes on your system
• Installs a trusted root certificate authority on your PC - this is a dangerous behavior that can undermine the security of your PC and web browsing. Most commonly we see this being used by ad-injection applications that insert ads in your browser as you browse the web

Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:

• DAEMON Tools Lite
• 별툴즈 통합업데이트
• Antools
• AnCamCorder Uninstall
• Ancamera Uninstall
• Micro onoffpop secure softwear profile
• Microadpop
• AnRecorder Uninstall
• Kalydo Player 6.04.02

This description was published using automated analysis.

Last update 04 July 2016

 

TOP