Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'COMLOADER' = '\\.\D:\Program Files\FoxitReader\bin\COM7.EXE'
Creates or modifies the following files
- %HOMEPATH%\start menu\programs\startup\pdf foxitreader.exe
Creates the following files on removable media
- <Drive name for removable media>:\pdf reader 2012.exe.exe
- <Drive name for removable media>:\recycled\taskssvh.exe
- <Drive name for removable media>:\music.lnk
- <Drive name for removable media>:\recycled.lnk
Modifies file system
Creates the following files
- %TEMP%\rar$ex7.src777\achsv.exe
- %TEMP%\rar$ex7.src777\com7.exe
- %TEMP%\.bat
- %TEMP%\rar$ex7.src777\pipe.exc777.tmp
- D:\program files\foxitreader\bin\com7.exe
- D:\program files\foxitreader\foxitreader.exe
Substitutes the following files
- %TEMP%\.bat
Network activity
UDP
- DNS ASK ib###e.eb2a.com
Miscellaneous
Creates and executes the following
- '%TEMP%\rar$ex7.src777\achsv.exe'
- '%TEMP%\rar$ex7.src777\com7.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\.bat" "' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v COMLOADER /d "\\.\D:\Program Files\FoxitReader\bin\COM7.EXE"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\.bat" "
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v COMLOADER /d "\\.\D:\Program Files\FoxitReader\bin\COM7.EXE"
