Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\FoxitReader.Document\shell\open\command] '' = '"%ProgramFiles%\Foxit Software\Foxit Reader\Foxit Reader.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\FoxitReader.FDFDoc\shell\open\command] '' = '"%ProgramFiles%\Foxit Software\Foxit Reader\Foxit Reader.exe" "%1"'
Modifies file system:
Creates the following files:
- %TEMP%\7ZipSfx.000\setup.msi
- %WINDIR%\Installer\MSI11.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Foxit Reader\Uninstall.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Foxit Reader\Foxit Reader.lnk
- %ALLUSERSPROFILE%\Desktop\Foxit Reader.lnk
- %ProgramFiles%\Foxit Software\Foxit Reader\Uninstall.exe
- %ProgramFiles%\Foxit Software\Foxit Reader\Readme.txt
- %ProgramFiles%\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
- %ProgramFiles%\Foxit Software\Foxit Reader\plugins\FoxitReaderOCX.ocx
- %ProgramFiles%\Foxit Software\Foxit Reader\Foxit Reader.exe
- %TEMP%\CabF.tmp
- %TEMP%\CabD.tmp
- %TEMP%\CabB.tmp
- %TEMP%\Cab9.tmp
- C:\Config.Msi\1f134.rbs
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\1f133.ipi
- %TEMP%\Cab5.tmp
- %TEMP%\Cab3.tmp
- %TEMP%\Cab1.tmp
- %WINDIR%\Installer\1f131.msi
- %TEMP%\7ZipSfx.000\msistub.exe
- %WINDIR%\Installer\1f135.msi
- %WINDIR%\Installer\{0C441730-85C7-4667-895B-6F7327D278EF}\IconName.exe
Deletes the following files:
- %TEMP%\Cab1.tmp
- %TEMP%\Cab3.tmp
- %TEMP%\Cab5.tmp
- %TEMP%\Cab9.tmp
- %TEMP%\CabB.tmp
- %TEMP%\CabD.tmp
- %TEMP%\CabF.tmp
- %WINDIR%\Installer\MSI11.tmp
- %WINDIR%\Installer\MSI7.tmp
- C:\Config.Msi\1f134.rbs
- %WINDIR%\Installer\1f131.msi
- %WINDIR%\Installer\1f133.ipi
- %TEMP%\7ZipSfx.000\msistub.exe
- %TEMP%\7ZipSfx.000\setup.msi
Network activity:
Connects to:
- 'wp#d':80
- 'download.windowsupdate.com':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt via download.windowsupdate.com
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab via download.windowsupdate.com
UDP:
- DNS ASK wp#d
Miscellaneous:
Creates and executes the following:
- '%TEMP%\7ZipSfx.000\msistub.exe' setup.msi /qn
- '%ProgramFiles%\Foxit Software\Foxit Reader\Foxit Reader.exe' /displayinbrowser
Executes the following:
- '<SYSTEM32>\msiexec.exe' /i setup.msi /qn
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 4647F5B2173C43B6F6EC24B1598CAD03 M Global\MSI0000
