Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\$$Aud\inner.exe'
Executes the following:
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen <Current directory>\img3.jpg
Modifies file system :
Creates the following files:
- C:\$$Aud\inner.exe
- %HOMEPATH%\Recent\img3.lnk
- %HOMEPATH%\Recent\bf32d3b0.lnk
- C:\$$Aud\~svchost.tmp
- C:\$$Aud\~path.tmp
- <Current directory>\img3.jpg
Deletes itself.
Network activity:
Connects to:
- 'www.vd##nky.com':44440
UDP:
- DNS ASK www.vd##nky.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
