Technical Information
Malicious functions
Creates and loads libraries (exploit)
- %APPDATA%\microsoft\windows\templates\libconfig2.dll
Modifies file system
Creates the following files
- %HOMEPATH%\application data\microsoft\forms\excel.box
- %TEMP%\vba64c.tmp
- %TEMP%\vba6fb.tmp
- %TEMP%\vba70d.tmp
- %TEMP%\vba720.tmp
- %TEMP%\a7af0000
- %TEMP%\mannual.xlsx.zip
- %TEMP%\oleobject1.bin
- %APPDATA%\microsoft\windows\templates\libconfig2.dll
Deletes the following files
- %TEMP%\vba64b.tmp
- %TEMP%\vba6fa.tmp
- %TEMP%\vba70c.tmp
- %TEMP%\vba71f.tmp
Moves the following files
- from %TEMP%\vba64c.tmp to %TEMP%\vba64b.tmp
- from %TEMP%\vba6fb.tmp to %TEMP%\vba6fa.tmp
- from %TEMP%\vba70d.tmp to %TEMP%\vba70c.tmp
- from %TEMP%\vba720.tmp to %TEMP%\vba71f.tmp
- from %TEMP%\a7af0000 to %TEMP%\mannual.xlsx
Network activity
Connects to
- 'mi###store.com':443
UDP
- DNS ASK mi###store.com
