Technical Information
To ensure autorun and distribution
Infects the following executable files
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe
- %CommonProgramFiles(x86)%\microsoft shared\help\dexplore.exe
- %ProgramFiles(x86)%\winamp\winamp.exe
Creates the following files on removable media
- <Drive name for removable media>:\1.taz
- <Drive name for removable media>:\zpharaoh.exe
- <Drive name for removable media>:\rcxa20e.tmp
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- D:\1.taz
- D:\zpharaoh.exe
- D:\rcxa23e.tmp
- C:\1.taz
- C:\zpharaoh.exe
- C:\rcxa25e.tmp
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\zpharaoh.exe
- <Drive name for removable media>:\autorun.inf
- D:\zpharaoh.exe
- D:\autorun.inf
- C:\zpharaoh.exe
- C:\autorun.inf
Moves the following files
- from D:\rcxa23e.tmp to D:\zpharaoh.exe
- from D:\1.taz to D:\autorun.inf
- from C:\rcxa25e.tmp to C:\zpharaoh.exe
- from C:\1.taz to C:\autorun.inf
