TROJ_ARTIEF.HAL

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Dropping Routine

This Trojan takes advantage of the following software vulnerabilities to drop malicious files:

• Microsoft Security Bulletin MS12-027

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Other Details

More information on this vulnerability can be found below:

• MS12-027

NOTES:
Once this Trojan successfully exploits the said vulnerability, it attempts to drop and execute the following malicious file:

• %User temp%\paw.exe - detected as TSPY_ZBOT.PI

It also drops and opens a decoy document %User Temp%\vc.doc to trick users into thinking that this Trojan is a normal document.