Trojan.MulDrop24.41809

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\Movie Archive] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\Movie Archive] 'ImagePath' = '%ALLUSERSPROFILE%\Movie Archive\Movie Archive.exe'

Creates the following services

'Movie Archive' %ALLUSERSPROFILE%\Movie Archive\Movie Archive.exe

Modifies file system

Creates the following files

%TEMP%\is-3ridq.tmp\is-uf9gi.tmp
%ProgramFiles(x86)%\vresource\lang\is-eips7.tmp
%ProgramFiles(x86)%\vresource\lang\is-b5lv8.tmp
%ProgramFiles(x86)%\vresource\lang\is-et0vn.tmp
%ProgramFiles(x86)%\vresource\lang\is-d7oo7.tmp
%ProgramFiles(x86)%\vresource\lang\is-q9r20.tmp
%ProgramFiles(x86)%\vresource\online\is-l97v6.tmp
%ProgramFiles(x86)%\vresource\help\is-40nc8.tmp
%ProgramFiles(x86)%\vresource\vresource.exe
%ProgramFiles(x86)%\vresource\plugins\is-r6rt4.tmp
%ProgramFiles(x86)%\vresource\plugins\is-jiipo.tmp
%ProgramFiles(x86)%\vresource\plugins\is-fuei4.tmp
%ProgramFiles(x86)%\vresource\plugins\is-h1fq9.tmp
%ProgramFiles(x86)%\vresource\is-vdeaa.tmp
%ProgramFiles(x86)%\vresource\unins000.dat
%ProgramFiles(x86)%\vresource\lang\is-hleof.tmp
%ProgramFiles(x86)%\vresource\online\is-e3nea.tmp
%ProgramFiles(x86)%\vresource\lang\is-5qlbi.tmp
%ProgramFiles(x86)%\vresource\lang\is-tmcnb.tmp
%TEMP%\is-np5qv.tmp\_isetup\_setup64.tmp
%TEMP%\is-np5qv.tmp\_isetup\_shfoldr.dll
%TEMP%\is-np5qv.tmp\_isdecmp.dll
%TEMP%\is-np5qv.tmp\_iscrypt.dll
%ProgramFiles(x86)%\vresource\is-53bea.tmp
%ProgramFiles(x86)%\vresource\lang\is-f3kl9.tmp
%ProgramFiles(x86)%\vresource\lang\is-ihutr.tmp
%ProgramFiles(x86)%\vresource\lang\is-8r130.tmp
%ProgramFiles(x86)%\vresource\lang\is-gl3bk.tmp
%ProgramFiles(x86)%\vresource\lang\is-uogio.tmp
%ProgramFiles(x86)%\vresource\lang\is-ome1k.tmp
%ProgramFiles(x86)%\vresource\lang\is-lvi4b.tmp
%ProgramFiles(x86)%\vresource\lang\is-vf2b3.tmp
%ProgramFiles(x86)%\vresource\lang\is-b76b7.tmp
%ProgramFiles(x86)%\vresource\lang\is-t5ge7.tmp
%ALLUSERSPROFILE%\movie archive\movie archive.exe

Moves the following files

from %ProgramFiles(x86)%\vresource\is-53bea.tmp to %ProgramFiles(x86)%\vresource\unins000.exe
from %ProgramFiles(x86)%\vresource\plugins\is-fuei4.tmp to %ProgramFiles(x86)%\vresource\plugins\vob.rules
from %ProgramFiles(x86)%\vresource\plugins\is-jiipo.tmp to %ProgramFiles(x86)%\vresource\plugins\various.rules
from %ProgramFiles(x86)%\vresource\plugins\is-r6rt4.tmp to %ProgramFiles(x86)%\vresource\plugins\libwim-15.dll
from %ProgramFiles(x86)%\vresource\help\is-40nc8.tmp to %ProgramFiles(x86)%\vresource\help\isobuster.chm
from %ProgramFiles(x86)%\vresource\online\is-e3nea.tmp to %ProgramFiles(x86)%\vresource\online\order now.html
from %ProgramFiles(x86)%\vresource\online\is-l97v6.tmp to %ProgramFiles(x86)%\vresource\online\isobuster online.html
from %ProgramFiles(x86)%\vresource\lang\is-q9r20.tmp to %ProgramFiles(x86)%\vresource\lang\vietnamese.dll
from %ProgramFiles(x86)%\vresource\lang\is-d7oo7.tmp to %ProgramFiles(x86)%\vresource\lang\turkish.dll
from %ProgramFiles(x86)%\vresource\lang\is-et0vn.tmp to %ProgramFiles(x86)%\vresource\lang\suomi_finnish.dll
from %ProgramFiles(x86)%\vresource\lang\is-b5lv8.tmp to %ProgramFiles(x86)%\vresource\lang\slovenian.dll
from %ProgramFiles(x86)%\vresource\lang\is-eips7.tmp to %ProgramFiles(x86)%\vresource\lang\romana.dll
from %ProgramFiles(x86)%\vresource\plugins\is-h1fq9.tmp to %ProgramFiles(x86)%\vresource\plugins\pfctoc.dll
from %ProgramFiles(x86)%\vresource\lang\is-hleof.tmp to %ProgramFiles(x86)%\vresource\lang\portugues.dll
from %ProgramFiles(x86)%\vresource\lang\is-t5ge7.tmp to %ProgramFiles(x86)%\vresource\lang\nederlands.dll
from %ProgramFiles(x86)%\vresource\lang\is-8r130.tmp to %ProgramFiles(x86)%\vresource\lang\magyar.dll
from %ProgramFiles(x86)%\vresource\lang\is-b76b7.tmp to %ProgramFiles(x86)%\vresource\lang\italiano.dll
from %ProgramFiles(x86)%\vresource\lang\is-vf2b3.tmp to %ProgramFiles(x86)%\vresource\lang\hindi.dll
from %ProgramFiles(x86)%\vresource\lang\is-lvi4b.tmp to %ProgramFiles(x86)%\vresource\lang\greek.dll
from %ProgramFiles(x86)%\vresource\lang\is-ome1k.tmp to %ProgramFiles(x86)%\vresource\lang\francais.dll
from %ProgramFiles(x86)%\vresource\lang\is-uogio.tmp to %ProgramFiles(x86)%\vresource\lang\espanol.dll
from %ProgramFiles(x86)%\vresource\lang\is-gl3bk.tmp to %ProgramFiles(x86)%\vresource\lang\deutsch.dll
from %ProgramFiles(x86)%\vresource\lang\is-ihutr.tmp to %ProgramFiles(x86)%\vresource\lang\dansk.dll
from %ProgramFiles(x86)%\vresource\lang\is-tmcnb.tmp to %ProgramFiles(x86)%\vresource\lang\chinese_simp.dll
from %ProgramFiles(x86)%\vresource\lang\is-f3kl9.tmp to %ProgramFiles(x86)%\vresource\lang\cesky.dll
from %ProgramFiles(x86)%\vresource\lang\is-5qlbi.tmp to %ProgramFiles(x86)%\vresource\lang\polski.dll
from %ProgramFiles(x86)%\vresource\is-vdeaa.tmp to %ProgramFiles(x86)%\vresource\vresource.exe

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'X534f1_VR1163_FlashFixClass_X534f1'

Creates and executes the following

'%TEMP%\is-3ridq.tmp\is-uf9gi.tmp' /SL4 $B024A "<Full path to file>" 3846675 146432
'%ProgramFiles(x86)%\vresource\vresource.exe' -i
'%ProgramFiles(x86)%\vresource\vresource.exe' -s

Executes the following