Home / malware

PDF

PUA:Win32/CnDownloader

First posted on 07 July 2016.
Source: Microsoft

Aliases :

There are no other names known for PUA:Win32/CnDownloader.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

• dxdown.wannianli365.com
• down.dxias.com
• down.sdzhili.com
• dl.kuaibo.com
• dxdown.nonglirili.net

We have seen this application use the following file names:

• QvodSetup5.exe
• bdupdate.exe
• QvodSetup5_lite.exe
• QvodSetup.exe
• QvodSetupPlus5.exe
• QvodSetup3.exe
• QvodSetup5 (1).exe
• setup@900_1.exe
• QvodSetup4.exe

It can be digitally signed by the following vendors:

• SHANGHAI FENGHAN NETWORK INFORMATION TECHNOLOGY STUDIO
• Shenzhen QVOD Technology Co.,Ltd
• Shanghai Yishen Network Technology Co., Ltd.
• BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.,LTD.
• Li Xin

We have seen this application using product names such as:

• 青枫日历
• 美人历
• 女神历
• 洛神历
• Downloader

This application communicates with domains such as:

• update.kuaibo.com
• confignew.3lsoft.com
• down.xiald.com
• dl.kuaibo.com
• xiazai.rilibiao.com.cn

For example:

• update.kuaibo.com/agent.cfg
• down.xiald.com/api.php?
• down.xiald.com/tongji.php?

Payload

Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:

• 青枫日历 1.2.3.0;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
• Funshion
• QQ浏览器
• USB宝盒
• 腾讯视频
• 传奇盛世
• 快压
• 爱奇艺PPS
• 百度输入法

This description was published using automated analysis.

Last update 07 July 2016

 

TOP