Technical Information
Modifies file system
Creates the following files
- %TEMP%\invoice_update.pdf
- %LOCALAPPDATA%\adobe\color\profiles\wscrgb.icc
- %LOCALAPPDATA%\adobe\color\profiles\wsrgb.icc
- %LOCALAPPDATA%\adobe\color\acecache11.lst
Sets the 'hidden' attribute to the following files
- <PATH_SAMPLE>.old_1780013020
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to <PATH_SAMPLE>.old_1780013020
Deletes itself.
Network activity
Connects to
- 'jo####list-ae.blog':443
TCP
Other
- 'jo####list-ae.blog':443
UDP
- DNS ASK jo####list-ae.blog
Miscellaneous
Executes the following
- '<SYSTEM32>\attrib.exe' +h +s <PATH_SAMPLE>.old_1780013020
- '%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe' "%TEMP%\Invoice_Update.pdf"
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
- '<SYSTEM32>\attrib.exe' +h +s <PATH_SAMPLE>.old_1780013084
