Technical Information
Malicious functions
Executes the following (exploit)
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1160
- '%CommonProgramFiles%\microsoft shared\office12\offdiag.exe' 1 /LCID 1033 /WAITPID 2044
Modifies file system
Creates the following files
- C:\Documents\user\locals~1\temp\~df6dcc.tmp
- C:\Documents\user\locals~1\temp\excel8.0\mscomctllib.exd
- C:\Documents\user\locals~1\temp\1292531.cvr
- C:\Documents\user\locals~1\temp\1292562.od
- C:\Documents\user\locals~1\temp\dw.log
- C:\Documents\user\locals~1\temp\13bd0a.dmp
- C:\Documents\user\locals~1\temp\~dfa8da.tmp
Deletes the following files
- C:\Documents\user\locals~1\temp\13bd0a.dmp
- C:\Documents\user\locals~1\temp\1292531.cvr
- C:\Documents\user\locals~1\temp\1292562.od
Miscellaneous
Executes the following
- '%ProgramFiles%\microsoft office\office12\excel.exe'
