Technical Information
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %TEMP%\cce4-bb33bca31f4\ntcisr.exe
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_14.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_15.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_16.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_1.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_2.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_3.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_4.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_5.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_12.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_13.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_6.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_9.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_10.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_11.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_12.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_13.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510619_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510650_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510697_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510728_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_7.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_8.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_11.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_10.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_9.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509278_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509527_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509527_1.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509590_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_1.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_2.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_3.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_4.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_5.sft
- %TEMP%\cce4-bb33bca31f4\tlk.ds
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_6.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_8.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_1.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_2.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_3.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_4.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_5.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_6.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_7.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_8.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_7.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510775_0.sft
- %TEMP%\cce4-bb33bca31f4\qad.ds
Sets the 'hidden' attribute to the following files
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509278_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_13.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_14.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_15.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_16.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_1.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_2.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_3.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_4.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_5.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_6.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_7.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_8.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_9.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_10.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_11.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_12.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510432_13.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510619_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510650_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510697_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_12.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510728_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_11.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_9.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509527_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509527_1.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509590_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_1.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_2.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_3.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_4.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_5.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_6.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_7.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042509746_8.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_0.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_1.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_2.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_3.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_4.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_5.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_6.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_7.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_8.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510073_10.sft
- %TEMP%\cce4-bb33bca31f4\guid_app0_2930961276_0908042510775_0.sft
Network activity
Connects to
- 'sr######51-mx3-sec22.com':443
UDP
- DNS ASK sr######51-mx3-sec22.com
Miscellaneous
Creates and executes the following
- '%TEMP%\cce4-bb33bca31f4\ntcisr.exe'
