Trojan.Encoder.31692

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\508softwareandos.doc

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Reads files which store third party applications passwords

%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\weeklysheet1215.doc
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\hanni_umami_chapter.doc

Modifies file system

Creates the following files

C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dd56bf-readme.txt
%PROGRAMDATA%\microsoft\mf\dd56bf-readme.txt
%ProgramFiles(x86)%\pidgin\pixmaps\pidgin\dd56bf-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\dd56bf-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\dd56bf-readme.txt
C:\far2\dd56bf-readme.txt
C:\totalcmd\dd56bf-readme.txt
%PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\dd56bf-readme.txt
C:\users\public\videos\sample videos\dd56bf-readme.txt
C:\users\public\recorded tv\sample media\dd56bf-readme.txt
C:\far2\documentation\eng\dd56bf-readme.txt
%ProgramFiles(x86)%\pidgin\sounds\purple\dd56bf-readme.txt
C:\far2\encyclopedia\dd56bf-readme.txt
%LOCALAPPDATA%\msfree inc\dd56bf-readme.txt
C:\users\public\pictures\sample pictures\dd56bf-readme.txt
C:\far2\fexcept\dd56bf-readme.txt
%CommonProgramFiles(x86)%\java\java update\dd56bf-readme.txt
C:\far2\addons\colors\dd56bf-readme.txt
C:\far2\addons\shell\dd56bf-readme.txt
C:\far2\addons\dd56bf-readme.txt
%HOMEPATH%\favorites\links\dd56bf-readme.txt
%HOMEPATH%\contacts\dd56bf-readme.txt
C:\users\public\libraries\dd56bf-readme.txt
%HOMEPATH%\dd56bf-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\dd56bf-readme.txt
D:\dd56bf-readme.txt
%PROGRAMDATA%\microsoft\user account pictures\dd56bf-readme.txt
%HOMEPATH%\favorites\links for united states\dd56bf-readme.txt

Moves the following files

from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.dd56bf
from %ProgramFiles(x86)%\pidgin\sounds\purple\alert.wav to %ProgramFiles(x86)%\pidgin\sounds\purple\alert.wav.dd56bf
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest.dd56bf
from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp.dd56bf
from %ProgramFiles(x86)%\pidgin\sounds\purple\login.wav to %ProgramFiles(x86)%\pidgin\sounds\purple\login.wav.dd56bf
from %ProgramFiles(x86)%\pidgin\plugins\.dll to %ProgramFiles(x86)%\pidgin\plugins\.dll.dd56bf
from %ProgramFiles(x86)%\pidgin\sounds\purple\logout.wav to %ProgramFiles(x86)%\pidgin\sounds\purple\logout.wav.dd56bf
from %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-down.xpm to %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-down.xpm.dd56bf
from %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-up.xpm to %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-up.xpm.dd56bf
from %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-right.xpm to %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-right.xpm.dd56bf
from %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-left.xpm to %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-left.xpm.dd56bf
from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin.dd56bf
from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-1.bin to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-1.bin.dd56bf
from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.dd56bf
from %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml to %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml.dd56bf
from %ProgramFiles(x86)%\pidgin\sounds\purple\receive.wav to %ProgramFiles(x86)%\pidgin\sounds\purple\receive.wav.dd56bf