Technical Information
Malicious functions
Executes the following (exploit)
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1924
Modifies file system
Creates the following files
- %HOMEPATH%\application data\microsoft\forms\winword.box
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\config14[1].txt
- %TEMP%\yfuyidsf.exe
- %TEMP%\1099838.cvr
Network activity
Connects to
- '83.##0.171.223':80
TCP
HTTP POST requests
- http://83.##0.171.223/wikipedia/upload.php
