Technical Information
Malicious functions:
Executes the following:
- <SYSTEM32>\wscript.exe "%PROGRAM_FILES%\soft220503\b_2203.vbs"
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.17##g.com/lianjie/10608.htm
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://ta##rl.com/6jb4v
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\soft220503\0320110305030316050322030303.txt
- %PROGRAM_FILES%\soft220503\a
- %TEMP%\nsy2.tmp\FindProcDLL.dll
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
