Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%APPDATA%\audiodges.exe'
Modifies file system
Creates the following files
- %APPDATA%\audiodges.exe
- <Current directory>\27451000
Network activity
Connects to
- '23.#5.106.3':80
TCP
HTTP GET requests
- http://23.#5.106.3/200/po/ioooi0ooioi0oo0oioioioi00i0oiooio00oioioioi0oi0io0o00%23%23%23%23%23%23%23%23%23%23%23%23%23%230000%23%23%23%23%23%23%23%23%23%23%23%23%23%2300000000.dOC
- http://23.#5.106.3/200/Lopbf.exe
Miscellaneous
Executes the following
- '%ProgramFiles%\microsoft office\office14\winword.exe' -Embedding
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
