Trojan.Inject3.9513

Technical Information

Malicious functions:

Executes the following:

'<SYSTEM32>\net.exe' stop "Printer Control"

Modifies file system:

Creates the following files:

%TEMP%\ext2.tmp
<SYSTEM32>\wordpad.exe
%TEMP%\is-268TD.tmp\PrtSetupX.exe
%WINDIR%\Wireless Printer\PrtSetupX.exe
%TEMP%\is-268TD.tmp\DefForms.exe
%TEMP%\is-K16TE.tmp\DefForms.tmp
%TEMP%\is-H1PGM.tmp\_isetup\_shfoldr.dll
%TEMP%\is-E85N5.tmp\PrtSetupX.tmp
%TEMP%\is-SOHN3.tmp\_isetup\_shfoldr.dll
%TEMP%\is-SOHN3.tmp\_isetup\_iscrypt.dll
%CommonProgramFiles%\ActPrint\is-BSJJT.tmp
<SYSTEM32>\is-6FD3S.tmp
%WINDIR%\Wireless Printer\unins000.dat
%CommonProgramFiles%\ActPrint\is-C8TE7.tmp
%CommonProgramFiles%\ActPrint\is-T69LS.tmp
%CommonProgramFiles%\ActPrint\is-67LJ2.tmp
%CommonProgramFiles%\ActPrint\is-CD246.tmp
%CommonProgramFiles%\ActPrint\is-C7TM5.tmp
%CommonProgramFiles%\ActPrint\is-DHVT9.tmp
%CommonProgramFiles%\ActPrint\is-OCD34.tmp
%CommonProgramFiles%\ActPrint\is-C31BK.tmp
%CommonProgramFiles%\ActPrint\is-K4AE9.tmp
%CommonProgramFiles%\ActPrint\is-NRIKT.tmp
%CommonProgramFiles%\ActPrint\is-S59K8.tmp
%CommonProgramFiles%\ActPrint\is-4GO53.tmp
%CommonProgramFiles%\ActPrint\is-U6LNM.tmp
<SYSTEM32>\is-TQ1L8.tmp
<SYSTEM32>\is-H99T5.tmp
<SYSTEM32>\is-U7IF0.tmp
%TEMP%\pft3.tmp\pftw1.pkg
%ProgramFiles%\Sam\clntinfo.ini
%ProgramFiles%\Sam\Driver\virtualprinter.exe
%ProgramFiles%\Sam\Extract.exe
%ProgramFiles%\Sam\FTPDriverDownload.exe
%ProgramFiles%\Sam\PrintControl.exe
%ProgramFiles%\Sam\UnInstall.exe
C:\Sam\clntinfo.ini
C:\Sam\Extract.exe
C:\Sam\FTPDriverDownload.exe
C:\Sam\PrintControl.exe
%TEMP%\plf1.tmp
C:\Sam\UnInstall.exe
%TEMP%\is-350UC.tmp\virtualprinter.tmp
%TEMP%\is-268TD.tmp\_isetup\_shfoldr.dll
%TEMP%\is-268TD.tmp\_isetup\_iscrypt.dll
%TEMP%\is-268TD.tmp\gdiplus.dll
%WINDIR%\Wireless Printer\is-OJHF8.tmp
<SYSTEM32>\is-5AS1K.tmp
<SYSTEM32>\is-19NRS.tmp
<SYSTEM32>\is-3TDM9.tmp
%WINDIR%\Wireless Printer\is-OTOEK.tmp
%WINDIR%\Wireless Printer\is-VHADJ.tmp
%WINDIR%\Wireless Printer\is-9PP2K.tmp
C:\Sam\Driver\virtualprinter.exe
%CommonProgramFiles%\ActPrint\is-Q7A84.tmp
%CommonProgramFiles%\ActPrint\is-K7PVQ.tmp

Deletes the following files:

%TEMP%\ext2.tmp
%TEMP%\pft3.tmp\pftw1.pkg
%ProgramFiles%\Sam\Driver\virtualprinter.exe
%TEMP%\is-268TD.tmp\gdiplus.dll
%TEMP%\is-H1PGM.tmp\_isetup\_shfoldr.dll
%TEMP%\is-K16TE.tmp\DefForms.tmp

Moves the following files:

from %WINDIR%\Wireless Printer\is-OJHF8.tmp to %WINDIR%\Wireless Printer\unins000.exe
from %CommonProgramFiles%\ActPrint\is-S59K8.tmp to %CommonProgramFiles%\ActPrint\unidrv.dll
from %CommonProgramFiles%\ActPrint\is-NRIKT.tmp to %CommonProgramFiles%\ActPrint\ActPrintUI.dll
from %CommonProgramFiles%\ActPrint\is-K4AE9.tmp to %CommonProgramFiles%\ActPrint\ActPrintRES.dll
from %CommonProgramFiles%\ActPrint\is-C31BK.tmp to %CommonProgramFiles%\ActPrint\ActPrint.dll
from %CommonProgramFiles%\ActPrint\is-OCD34.tmp to %CommonProgramFiles%\ActPrint\PrintCtrl.exe
from %CommonProgramFiles%\ActPrint\is-DHVT9.tmp to %CommonProgramFiles%\ActPrint\PrintDisp.exe
from %CommonProgramFiles%\ActPrint\is-C7TM5.tmp to %CommonProgramFiles%\ActPrint\ActPrintUI.ini
from %CommonProgramFiles%\ActPrint\is-CD246.tmp to %CommonProgramFiles%\ActPrint\StdNames.gpd
from %CommonProgramFiles%\ActPrint\is-67LJ2.tmp to %CommonProgramFiles%\ActPrint\ActMask_DPI300_LitePS.GPD
from %CommonProgramFiles%\ActPrint\is-T69LS.tmp to %CommonProgramFiles%\ActPrint\ActMask_DPI204-196.GPD
from %CommonProgramFiles%\ActPrint\is-U6LNM.tmp to %CommonProgramFiles%\ActPrint\ActMask_DPI360.GPD
from %CommonProgramFiles%\ActPrint\is-Q7A84.tmp to %CommonProgramFiles%\ActPrint\unidrvui.dll
from %CommonProgramFiles%\ActPrint\is-4GO53.tmp to %CommonProgramFiles%\ActPrint\ActMask_DPI180.GPD
from %CommonProgramFiles%\ActPrint\is-BSJJT.tmp to %CommonProgramFiles%\ActPrint\ActMask_DPI72.GPD
from <SYSTEM32>\is-6FD3S.tmp to <SYSTEM32>\PrtTools.exe
from <SYSTEM32>\is-TQ1L8.tmp to <SYSTEM32>\PrtPass.exe
from <SYSTEM32>\is-H99T5.tmp to <SYSTEM32>\SetPrinter.exe
from <SYSTEM32>\is-U7IF0.tmp to <SYSTEM32>\PrtClient.exe
from %WINDIR%\Wireless Printer\is-9PP2K.tmp to %WINDIR%\Wireless Printer\Cancel.wav
from %WINDIR%\Wireless Printer\is-VHADJ.tmp to %WINDIR%\Wireless Printer\FINISH.WAV
from %WINDIR%\Wireless Printer\is-OTOEK.tmp to %WINDIR%\Wireless Printer\START.WAV
from <SYSTEM32>\is-3TDM9.tmp to <SYSTEM32>\msvcm80.dll
from <SYSTEM32>\is-19NRS.tmp to <SYSTEM32>\msvcr80.dll
from <SYSTEM32>\is-5AS1K.tmp to <SYSTEM32>\SaveToEx.dll
from %CommonProgramFiles%\ActPrint\is-C8TE7.tmp to %CommonProgramFiles%\ActPrint\ActMask_DPI300.GPD
from %CommonProgramFiles%\ActPrint\is-K7PVQ.tmp to %CommonProgramFiles%\ActPrint\unires.dll

Miscellaneous:

Searches for the following windows:

ClassName: '#32770' WindowName: 'Setup'
ClassName: 'Button' WindowName: 'OK'

Creates and executes the following:

'%ProgramFiles%\Sam\Extract.exe'
'C:\Sam\Driver\virtualprinter.exe' /VERYSILENT /PASSWORD=452193106-tric@comprisetechnologies.com
'%TEMP%\is-350UC.tmp\virtualprinter.tmp' /SL5="$200EA,10917761,135168,C:\Sam\Driver\virtualprinter.exe" /VERYSILENT /PASSWORD=452193106-tric@comprisetechnologies.com
'%TEMP%\is-268TD.tmp\DefForms.exe' /VERYSILENT All Init
'%TEMP%\is-K16TE.tmp\DefForms.tmp' /SL5="$10114,166149,162816,%TEMP%\is-268TD.tmp\DefForms.exe" /VERYSILENT All Init
'%WINDIR%\Wireless Printer\PrtSetupX.exe' /VERYSILENT /PASSWORD=ActMask_PrtSetupX452193106-tric@comprisetechnologies.com Install ActPrint1234 "ActMask Universe Virtual Printer SDK" ActMask_DPI300 http://www.al##pdf.com disupdate
'%TEMP%\is-E85N5.tmp\PrtSetupX.tmp' /SL5="$20114,4268744,117248,%WINDIR%\Wireless Printer\PrtSetupX.exe" /VERYSILENT /PASSWORD=ActMask_PrtSetupX452193106-tric@comprisetechnologies.com Install ActPrint1234 "ActMask Universe Virtua...
'%CommonProgramFiles%\ActPrint\PrintDisp.exe' /uninstall

Executes the following: