Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\lisp_success.doc
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\trivial-merge.htm
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\iisstart.html
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\contosoroot.cer
Modifies file system
Creates the following files
- C:\far2\8d35ee-readme.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\8d35ee-readme.txt
- %HOMEPATH%\favorites\microsoft websites\8d35ee-readme.txt
- C:\far2\addons\colors\default_highlighting\8d35ee-readme.txt
- %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\8d35ee-readme.txt
- %ProgramFiles(x86)%\microsoft office\office10\8d35ee-readme.txt
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\8d35ee-readme.txt
- %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\shaders\8d35ee-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\8d35ee-readme.txt
- C:\far2\fexcept\8d35ee-readme.txt
- %ProgramFiles(x86)%\k-lite codec pack\info\8d35ee-readme.txt
- %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\bin\8d35ee-readme.txt
- %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\debugger\8d35ee-readme.txt
- %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\8d35ee-readme.txt
- %HOMEPATH%\favorites\windows live\8d35ee-readme.txt
- %HOMEPATH%\favorites\msn websites\8d35ee-readme.txt
- %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\8d35ee-readme.txt
- C:\far2\documentation\eng\8d35ee-readme.txt
- %HOMEPATH%\desktop\8d35ee-readme.txt
- %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\8d35ee-readme.txt
- C:\far2\pluginsdk\headers.c\8d35ee-readme.txt
Moves the following files
- from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest.8d35ee
- from %ProgramFiles(x86)%\k-lite codec pack\info\faq.css to %ProgramFiles(x86)%\k-lite codec pack\info\faq.css.8d35ee
- from %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\shaders\0-255 to 16-235.hlsl to %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\shaders\0-255 to 16-235.hlsl.8d35ee
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\certificates_r.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\certificates_r.aapp.8d35ee
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\collectsignatures.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\collectsignatures.aapp.8d35ee
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\combine_r_rhp.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\combine_r_rhp.aapp.8d35ee
- from %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\shaders\16-235 to 0-255 [sd].hlsl to %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\shaders\16-235 to 0-255 [sd].hlsl.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\limits.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\limits.h.8d35ee
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\comments.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\comments.aapp.8d35ee
- from %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\shaders\16-235 to 0-255 [sd][hd].hlsl to %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\shaders\16-235 to 0-255 [sd][hd].hlsl.8d35ee
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\cpdf_full.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\cpdf_full.aapp.8d35ee
- from %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\shaders\bt.601 to bt.709.hlsl to %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\shaders\bt.601 to bt.709.hlsl.8d35ee
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\cpdf_rhp.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\cpdf_rhp.aapp.8d35ee
- from %ProgramFiles(x86)%\microsoft office\office10\thdic.lex to %ProgramFiles(x86)%\microsoft office\office10\thdic.lex.8d35ee
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\edit_r_full.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\edit_r_full.aapp.8d35ee
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as90.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as90.xsl.8d35ee
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\edit_r_rhp.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\edit_r_rhp.aapp.8d35ee
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\informix.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\informix.xsl.8d35ee
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\epdf_full.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\epdf_full.aapp.8d35ee
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\msjet.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\msjet.xsl.8d35ee
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\appcenter_r.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\appcenter_r.aapp.8d35ee
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\epdf_rhp.aapp to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\epdf_rhp.aapp.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\io.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\io.h.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\fpieee.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\fpieee.h.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\blank.sln to %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\blank.sln.8d35ee
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as80.xsl to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\as80.xsl.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\blank.vsdir to %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\solutiontemplates\blank.vsdir.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\visualui.ttf to %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\ide\visualui.ttf.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\debugger\manageddbgca.exe.config to %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\debugger\manageddbgca.exe.config.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\debugger\mcee_cs.dat to %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\debugger\mcee_cs.dat.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\debugger\mcee_mc.dat to %ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\debugger\mcee_mc.dat.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\bin\cl.exe.config to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\bin\cl.exe.config.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\bin\link.exe.config to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\bin\link.exe.config.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\assert.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\assert.h.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\conio.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\conio.h.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\ctype.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\ctype.h.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\direct.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\direct.h.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\dos.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\dos.h.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\eh.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\eh.h.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\errno.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\errno.h.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\excpt.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\excpt.h.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\fcntl.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\fcntl.h.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\float.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\float.h.8d35ee
- from %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\gcroot.h to %ProgramFiles(x86)%\microsoft visual studio .net 2003\vc7\include\gcroot.h.8d35ee
- from %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\shaders\contour.hlsl to %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\shaders\contour.hlsl.8d35ee
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
