Technical Information
Malicious functions
Downloads
- http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/office/data/v32.cab as %temp%\over6720459\v32.cab
- http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/office/data/v32.cab as %temp%\over7829524\v32.cab
- http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/office/data/v32.cab as %temp%\over8732799\v32.cab
- http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/office/data/v32.cab as %temp%\over3254353\v32.cab
- http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/office/data/v32.cab as %temp%\over1011794\v32.cab
- http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/office/data/v32.cab as %temp%\over8776563\v32.cab
- http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/office/data/v32.cab as %temp%\over2232106\v32.cab
- http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/office/data/v32.cab as %temp%\over1553236\v32.cab
- http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/office/data/v32.cab as %temp%\over3334461\v32.cab
- http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/office/data/v32.cab as %temp%\over2364420\v32.cab
- http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/office/data/v32.cab as %temp%\over8355848\v32.cab
- http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/office/data/v32.cab as %temp%\over4593723\v32.cab
Modifies file system
Creates the following files
- <Current directory>\files\setup.exe
- %TEMP%\over3254353\$dpx$.tmp\e95202a547e3cc44b0d44f0b4e482fcc.tmp
- %TEMP%\over3254353\v32.cab
- %TEMP%\over8732799\v32.txt
- %TEMP%\over8732799\$dpx$.tmp\0c34fc93a28b3543aba02c4b92e5df50.tmp
- %TEMP%\over8732799\v32.cab
- %TEMP%\over7829524\v32.txt
- %TEMP%\over7829524\$dpx$.tmp\354fd903c4d6f94fa7711c58f0568fe8.tmp
- %TEMP%\over7829524\v32.cab
- %TEMP%\over3254353\v32.txt
- %TEMP%\over6720459\v32.txt
- %TEMP%\over6720459\v32.cab
- <Current directory>\files\configure.xml
- <Current directory>\files\x86\msvcr100.dll
- <Current directory>\files\x86\cleanospp.exe
- <Current directory>\files\x64\msvcr100.dll
- <Current directory>\files\x64\cleanospp.exe
- <Current directory>\files\uninstall.xml
- <Current directory>\files\files.dat
- %TEMP%\over6720459\$dpx$.tmp\9ea71544dd2f314c93d28aa27144d683.tmp
- %TEMP%\over1011794\v32.cab
Deletes the following files
- <Current directory>\files\files.dat
- <Current directory>\files\configure.xml
- <Current directory>\files\setup.exe
- %TEMP%\over6720459\v32.cab
- %TEMP%\over6720459\v32.txt
- %TEMP%\over6720459\versiondescriptor.xml
- %TEMP%\over7829524\v32.cab
- %TEMP%\over7829524\v32.txt
- %TEMP%\over7829524\versiondescriptor.xml
- %TEMP%\over8732799\v32.cab
- %TEMP%\over8732799\v32.txt
- %TEMP%\over8732799\versiondescriptor.xml
- %TEMP%\over3254353\v32.cab
- %TEMP%\over3254353\v32.txt
- %TEMP%\over3254353\versiondescriptor.xml
- %TEMP%\over1011794\v32.cab
Moves the following files
- from %TEMP%\over6720459\$dpx$.tmp\9ea71544dd2f314c93d28aa27144d683.tmp to %TEMP%\over6720459\versiondescriptor.xml
- from %TEMP%\over7829524\$dpx$.tmp\354fd903c4d6f94fa7711c58f0568fe8.tmp to %TEMP%\over7829524\versiondescriptor.xml
- from %TEMP%\over8732799\$dpx$.tmp\0c34fc93a28b3543aba02c4b92e5df50.tmp to %TEMP%\over8732799\versiondescriptor.xml
- from %TEMP%\over3254353\$dpx$.tmp\e95202a547e3cc44b0d44f0b4e482fcc.tmp to %TEMP%\over3254353\versiondescriptor.xml
Substitutes the following files
- <Current directory>\files\configure.xml
- <Current directory>\files\setup.exe
Network activity
Connects to
- 'officecdn.microsoft.com':80
TCP
HTTP GET requests
- http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab
UDP
- DNS ASK officecdn.microsoft.com
Miscellaneous
Creates and executes the following
- '<Current directory>\files\files.dat' -y -pkmsauto
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over3254353\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over6720459\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over7829524\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over8732799\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', '%TEMP%\over2232106\v32.cab') }"' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over2232106' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over2232106\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', '%TEMP%\over1553236\v32.cab') }"' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over1553236' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over1553236\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over3334461\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over8776563\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', '%TEMP%\over8776563\v32.cab') }"' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', '%TEMP%\over2364420\v32.cab') }"' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over2364420' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over2364420\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', '%TEMP%\over8355848\v32.cab') }"' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over8355848' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over3334461' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', '%TEMP%\over3334461\v32.cab') }"' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', '%TEMP%\over8732799\v32.cab') }"' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over8776563' (with hidden window)
- '<SYSTEM32>\cmd.exe' /D /c files.dat -y -pkmsauto' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', '%TEMP%\over6720459\v32.cab') }"' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over6720459' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over6720459\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', '%TEMP%\over7829524\v32.cab') }"' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over7829524' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over7829524\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over8732799\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over8732799' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over1011794\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', '%TEMP%\over3254353\v32.cab') }"' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over3254353' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over3254353\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', '%TEMP%\over1011794\v32.cab') }"' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over8355848\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over1011794' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', '%TEMP%\over4593723\v32.cab') }"' (with hidden window)
Executes the following
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over2364420\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over2364420
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over3334461\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over3334461
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over1553236\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over1553236
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over2232106\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over2232106
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over8776563\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over8776563
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over1011794\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over1011794
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over3254353
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over8732799
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over7829524
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over6720459
- '<SYSTEM32>\cmd.exe' /D /c files.dat -y -pkmsauto
- '%WINDIR%\syswow64\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\over8355848
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\over8355848\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
