Technical Information
Malicious functions
Creates and loads libraries (exploit)
- %APPDATA%\microsoft\windows\templates\srt_join1.dll
Modifies file system
Creates the following files
- %HOMEPATH%\application data\microsoft\forms\excel.box
- %TEMP%\vbedc5.tmp
- %TEMP%\vbeea3.tmp
- %TEMP%\vbeeb5.tmp
- %TEMP%\vbeec8.tmp
- %TEMP%\30ff0000
- %TEMP%\academl.xlsx.zip
- %TEMP%\oleobject1.bin
- %APPDATA%\microsoft\windows\templates\srt_join1.dll
Deletes the following files
- %TEMP%\vbedb4.tmp
- %TEMP%\vbeea2.tmp
- %TEMP%\vbeeb4.tmp
- %TEMP%\vbeec7.tmp
Moves the following files
- from %TEMP%\vbedc5.tmp to %TEMP%\vbedb4.tmp
- from %TEMP%\vbeea3.tmp to %TEMP%\vbeea2.tmp
- from %TEMP%\vbeeb5.tmp to %TEMP%\vbeeb4.tmp
- from %TEMP%\vbeec8.tmp to %TEMP%\vbeec7.tmp
- from %TEMP%\30ff0000 to %TEMP%\academl.xlsx
