Technical Information
Malicious functions
Creates and loads libraries (exploit)
- %APPDATA%\microsoft\windows\templates\libconfig2.dll
Modifies file system
Creates the following files
- %HOMEPATH%\application data\microsoft\forms\excel.box
- %TEMP%\vbbf71.tmp
- %TEMP%\vbc030.tmp
- %TEMP%\vbc043.tmp
- %TEMP%\vbc065.tmp
- %TEMP%\61cf0000
- %TEMP%\mannual.xlsx.zip
- %TEMP%\oleobject1.bin
- %APPDATA%\microsoft\windows\templates\libconfig2.dll
Deletes the following files
- %TEMP%\vbbf70.tmp
- %TEMP%\vbc02f.tmp
- %TEMP%\vbc042.tmp
- %TEMP%\vbc045.tmp
Moves the following files
- from %TEMP%\vbbf71.tmp to %TEMP%\vbbf70.tmp
- from %TEMP%\vbc030.tmp to %TEMP%\vbc02f.tmp
- from %TEMP%\vbc043.tmp to %TEMP%\vbc042.tmp
- from %TEMP%\vbc065.tmp to %TEMP%\vbc045.tmp
- from %TEMP%\61cf0000 to %TEMP%\mannual.xlsx
Network activity
Connects to
- 'mi###store.com':443
UDP
- DNS ASK mi###store.com
