Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c del <Full path to file> > nul
- '<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\fonts\kjsjdvbn.dll"
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %WINDIR%\fonts\kjsjdvbn.dll
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG' WindowName: ''
Modifies file system:
Creates the following files:
- %WINDIR%\Fonts\gzgbxiazai.dat
- %WINDIR%\Fonts\kjsjdvbn.tmp
- %WINDIR%\xxxxxx.dll
Moves the following files:
- from %WINDIR%\Fonts\kjsjdvbn.tmp to %WINDIR%\Fonts\kjsjdvbn.dll
Deletes itself.
