Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\vbc.exe'
Executes the following (exploit)
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "%TEMP%\A9Rbols17_x20woe_11s.tmp\has been verified. However PDF, JPG, xlsx, .docx"
Modifies file system
Creates the following files
- %TEMP%\a9rbols17_x20woe_11s.tmp\has been verified. however pdf, jpg, xlsx, .docx
- C:\users\public\vbc.exe
- %APPDATA%\qegguvsmrojcly.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\qegguvsmrojcly.exe
Network activity
Connects to
- '10#.#68.32.38':80
TCP
HTTP GET requests
- http://10#.#68.32.38/doc_office/70.doc?&c###################################################################################################
- http://10#.#68.32.38/70/vbc.exe
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
