Technical Information
Malicious functions
Creates and loads libraries (exploit)
- %APPDATA%\microsoft\windows\templates\libintel2.dll
Modifies file system
Creates the following files
- %HOMEPATH%\application data\microsoft\forms\excel.box
- %TEMP%\vb350f.tmp
- %TEMP%\vb358f.tmp
- %TEMP%\vb35a1.tmp
- %TEMP%\d5301000
- %TEMP%\manufact.xlsx.zip
- %TEMP%\oleobject1.bin
- %APPDATA%\microsoft\windows\templates\libintel2.dll
Deletes the following files
- %TEMP%\vb350e.tmp
- %TEMP%\vb358e.tmp
- %TEMP%\vb35a0.tmp
Moves the following files
- from %TEMP%\vb350f.tmp to %TEMP%\vb350e.tmp
- from %TEMP%\vb358f.tmp to %TEMP%\vb358e.tmp
- from %TEMP%\vb35a1.tmp to %TEMP%\vb35a0.tmp
- from %TEMP%\d5301000 to %TEMP%\manufact.xlsx
Network activity
Connects to
- 'ge###links.com':443
UDP
- DNS ASK ge###links.com
