Trojan.MulDrop9.31626

Technical Information

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im "iexplore.exe" /t
'%WINDIR%\syswow64\taskkill.exe' /f /im "firefox.exe" /t

Terminates or attempts to terminate

the following user processes:

iexplore.exe
firefox.exe

Modifies file system

Creates the following files

%TEMP%\aut1a12.tmp
%TEMP%\aut6229.tmp
%ProgramFiles(x86)%\pdf shaper professional\unins000.dat
C:\users\public\desktop\pdf viewer.lnk
C:\users\public\desktop\pdf shaper professional.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\pdf shaper professional\uninstall pdf shaper professional.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\pdf shaper professional\pdf shaper professional on the web.url
%PROGRAMDATA%\microsoft\windows\start menu\programs\pdf shaper professional\help.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\pdf shaper professional\pdf viewer.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\pdf shaper professional\pdf shaper professional.lnk
%ProgramFiles(x86)%\pdf shaper professional\is-sbld6.tmp
%ProgramFiles(x86)%\pdf shaper professional\is-p5aar.tmp
%ProgramFiles(x86)%\pdf shaper professional\is-dijok.tmp
%ProgramFiles(x86)%\pdf shaper professional\is-loihe.tmp
%ProgramFiles(x86)%\pdf shaper professional\is-ppno8.tmp
%ProgramFiles(x86)%\pdf shaper professional\is-so182.tmp
%ProgramFiles(x86)%\pdf shaper professional\is-epnn2.tmp
%ProgramFiles(x86)%\pdf shaper professional\is-uo544.tmp
%ProgramFiles(x86)%\pdf shaper professional\is-dtkpc.tmp
%ProgramFiles(x86)%\pdf shaper professional\is-jh0j9.tmp
%ProgramFiles(x86)%\pdf shaper professional\is-00ien.tmp
%ProgramFiles(x86)%\pdf shaper professional\is-9285f.tmp
%ProgramFiles(x86)%\pdf shaper professional\is-mqsjr.tmp
%ProgramFiles(x86)%\pdf shaper professional\is-vmt6p.tmp
%ProgramFiles(x86)%\pdf shaper professional\is-3p04q.tmp
%TEMP%\is-tkp9m.tmp\_isetup\_setup64.tmp
%TEMP%\is-mft5g.tmp\~bqxoyvg.tmp
%TEMP%\~bqxoyvg.tmp
%TEMP%\aut1f43.tmp
%TEMP%\guzglkj
%ProgramFiles(x86)%\pdf shaper professional\shfolder.dll
%APPDATA%\burnaware\pdf shaper\pdfshaper.ini

Sets the 'hidden' attribute to the following files

%TEMP%\~bqxoyvg.tmp

Deletes the following files

%TEMP%\aut1a12.tmp
%TEMP%\guzglkj
%TEMP%\aut1f43.tmp
%TEMP%\is-tkp9m.tmp\_isetup\_setup64.tmp
%TEMP%\is-mft5g.tmp\~bqxoyvg.tmp
%TEMP%\aut6229.tmp
%TEMP%\~bqxoyvg.tmp

Moves the following files

from %ProgramFiles(x86)%\pdf shaper professional\is-3p04q.tmp to %ProgramFiles(x86)%\pdf shaper professional\unins000.exe
from %ProgramFiles(x86)%\pdf shaper professional\is-vmt6p.tmp to %ProgramFiles(x86)%\pdf shaper professional\pdc32.dll
from %ProgramFiles(x86)%\pdf shaper professional\is-mqsjr.tmp to %ProgramFiles(x86)%\pdf shaper professional\pdfview.dll
from %ProgramFiles(x86)%\pdf shaper professional\is-9285f.tmp to %ProgramFiles(x86)%\pdf shaper professional\ssgp.dll
from %ProgramFiles(x86)%\pdf shaper professional\is-00ien.tmp to %ProgramFiles(x86)%\pdf shaper professional\ter24.dll
from %ProgramFiles(x86)%\pdf shaper professional\is-jh0j9.tmp to %ProgramFiles(x86)%\pdf shaper professional\txml2.dll
from %ProgramFiles(x86)%\pdf shaper professional\is-dtkpc.tmp to %ProgramFiles(x86)%\pdf shaper professional\wpcc.dll
from %ProgramFiles(x86)%\pdf shaper professional\is-uo544.tmp to %ProgramFiles(x86)%\pdf shaper professional\wps32.dll
from %ProgramFiles(x86)%\pdf shaper professional\is-epnn2.tmp to %ProgramFiles(x86)%\pdf shaper professional\wrs8.dll
from %ProgramFiles(x86)%\pdf shaper professional\is-so182.tmp to %ProgramFiles(x86)%\pdf shaper professional\pdfshaper.exe
from %ProgramFiles(x86)%\pdf shaper professional\is-ppno8.tmp to %ProgramFiles(x86)%\pdf shaper professional\wordtopdf.exe
from %ProgramFiles(x86)%\pdf shaper professional\is-loihe.tmp to %ProgramFiles(x86)%\pdf shaper professional\pdftools.exe
from %ProgramFiles(x86)%\pdf shaper professional\is-dijok.tmp to %ProgramFiles(x86)%\pdf shaper professional\pdfviewer.exe
from %ProgramFiles(x86)%\pdf shaper professional\is-p5aar.tmp to %ProgramFiles(x86)%\pdf shaper professional\pdfshaper.dll
from %ProgramFiles(x86)%\pdf shaper professional\is-sbld6.tmp to %ProgramFiles(x86)%\pdf shaper professional\pdfshaper.chm

Network activity

UDP

DNS ASK pd###aper.com

Miscellaneous

Searches for the following windows

ClassName: 'DDEMLMom' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: 'Static' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\~bqxoyvg.tmp' /verysilent /suppressmsgboxes /norestart /sp-
'%TEMP%\is-mft5g.tmp\~bqxoyvg.tmp' /SL5="$80216,8110053,189952,%TEMP%\~bqxoyvg.tmp" /verysilent /suppressmsgboxes /norestart /sp-
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im "iexplore.exe" /t' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im "firefox.exe" /t' (with hidden window)

Executes the following