Technical Information
Malicious functions
Creates and loads libraries (exploit)
- %APPDATA%\microsoft\windows\templates\srt_join1.dll
Modifies file system
Creates the following files
- %HOMEPATH%\application data\microsoft\forms\excel.box
- %TEMP%\vbf192.tmp
- %TEMP%\vbf221.tmp
- %TEMP%\vbf234.tmp
- %TEMP%\vbf237.tmp
- %TEMP%\a2f01000
- %TEMP%\academl.xlsx.zip
- %TEMP%\oleobject1.bin
- %APPDATA%\microsoft\windows\templates\srt_join1.dll
Deletes the following files
- %TEMP%\vbf191.tmp
- %TEMP%\vbf220.tmp
- %TEMP%\vbf223.tmp
- %TEMP%\vbf236.tmp
Moves the following files
- from %TEMP%\vbf192.tmp to %TEMP%\vbf191.tmp
- from %TEMP%\vbf221.tmp to %TEMP%\vbf220.tmp
- from %TEMP%\vbf234.tmp to %TEMP%\vbf223.tmp
- from %TEMP%\vbf237.tmp to %TEMP%\vbf236.tmp
- from %TEMP%\a2f01000 to %TEMP%\academl.xlsx
