Exploit.Siggen3.35835

Technical Information

Malicious functions

Executes the following (exploit)

'%ProgramFiles%\microsoft office\office14\clview.exe' "EXCEL" "Microsoft Excel"

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mvalidator.lck
%TEMP%\imt51e1.tmp
%TEMP%\imt51d1.tmp
%TEMP%\imt51b1.tmp
%TEMP%\imt50c6.tmp
%TEMP%\imt5019.tmp
%TEMP%\imt4fe9.tmp
%TEMP%\imt4f7b.tmp
%TEMP%\imt4f7a.tmp
%TEMP%\imt4f79.tmp
%TEMP%\imt4f59.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_f.hxw
%TEMP%\imt5202.tmp
%TEMP%\imt4f48.tmp
%TEMP%\imt4f08.tmp
%TEMP%\imt4ed8.tmp
%TEMP%\imt4eb8.tmp
%TEMP%\imt4e98.tmp
%TEMP%\imt4e87.tmp
%TEMP%\imt4e76.tmp
%TEMP%\imt4e56.tmp
%TEMP%\imt4e17.tmp
%TEMP%\imt4e06.tmp
%TEMP%\imt4e05.tmp
%TEMP%\imt4de5.tmp
%TEMP%\imt4f18.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_k.hxw
%TEMP%\imt5212.tmp
%TEMP%\imt5223.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\office12[1].js
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022080120220802\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\hv10384307[1].htm
%TEMP%\imt53cd.tmp
%TEMP%\imt53bd.tmp
%TEMP%\imt537d.tmp
%TEMP%\imt537c.tmp
%TEMP%\imt537b.tmp
%TEMP%\imt537a.tmp
%TEMP%\imt5379.tmp
%TEMP%\imt5359.tmp
%TEMP%\imt5329.tmp
%TEMP%\imt5328.tmp
%TEMP%\imt5308.tmp
%TEMP%\imt5307.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mvalidator.hxd
%TEMP%\imt52e7.tmp
%TEMP%\imt52a8.tmp
%TEMP%\imt5297.tmp
%TEMP%\imt5277.tmp
%TEMP%\imt5276.tmp
%TEMP%\imt5275.tmp
%TEMP%\imt5255.tmp
%TEMP%\imt5234.tmp
%TEMP%\imt5224.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mtoc_excel.dev_col.hxh
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\ont[1].css
%TEMP%\imt4dd4.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\msofficehelp14\moh4913.tmp\clientviewersettings.xml
%TEMP%\imt45fb.tmp
%TEMP%\imt45db.tmp
%TEMP%\imt45bb.tmp
%TEMP%\imt459b.tmp
%TEMP%\imt457a.tmp
%TEMP%\imt4579.tmp
%TEMP%\imt4569.tmp
%TEMP%\imt4558.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_f.hxw
%TEMP%\imt4538.tmp
%TEMP%\imt4518.tmp
%TEMP%\imt464a.tmp
%TEMP%\imt44d8.tmp
%TEMP%\imt4498.tmp
%TEMP%\imt4487.tmp
%TEMP%\imt4477.tmp
%TEMP%\imt4466.tmp
%TEMP%\imt4456.tmp
%TEMP%\imt4416.tmp
%TEMP%\imt4415.tmp
%TEMP%\imt43e5.tmp
%TEMP%\imt43c5.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mtoc_excel_col.hxh
%TEMP%\imt4338.tmp
%TEMP%\imt44a9.tmp
%TEMP%\imt468a.tmp
%TEMP%\imt469a.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_k.hxw
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\clientviewersettings[1].xml
%TEMP%\imt48e3.tmp
%TEMP%\imt48d2.tmp
%TEMP%\imt48a2.tmp
%TEMP%\imt48a1.tmp
%TEMP%\imt48a0.tmp
%TEMP%\imt489f.tmp
%TEMP%\imt488f.tmp
%TEMP%\imt487e.tmp
%TEMP%\imt4820.tmp
%TEMP%\imt481f.tmp
%TEMP%\imt481e.tmp
%TEMP%\imt480d.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mvalidator.hxd
%TEMP%\imt47fc.tmp
%TEMP%\imt47cd.tmp
%TEMP%\imt47cc.tmp
%TEMP%\imt475d.tmp
%TEMP%\imt474d.tmp
%TEMP%\imt473c.tmp
%TEMP%\imt473b.tmp
%TEMP%\imt46ec.tmp
%TEMP%\imt46dc.tmp
%TEMP%\imt46cb.tmp
%TEMP%\imt46ba.tmp
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mvalidator.lck
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\contenthxs[1].css

Sets the 'hidden' attribute to the following files

%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mtoc_excel_col.hxh
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_f.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033_1033_mvalidator.hxd
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mtoc_excel.dev_col.hxh
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_f.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033_1033_mvalidator.hxd

Miscellaneous

Searches for the following windows