TROJ_ARTIEF

This description is based on a compiled analysis of several variants of TROJ_ARTIEF. Note that specific data such as file names and registry values may vary for each variant.

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may be unknowingly downloaded by a user while visiting malicious websites.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following non-malicious file:

• %User Temp%\{random}.doc - opened by the malware to trick users into thinking that the document is non-malicious

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Dropping Routine

This Trojan drops the following files:

• %User Temp%\{random}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It takes advantage of the following software vulnerabilities to drop malicious files:

• (MS10-087) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2423930)
• RTF Stack Buffer Overflow Vulnerability (CVE-2010-3333)

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

NOTES:
This description is based on a compiled analysis of several variants of TROJ_ARTIEF. Note that specific data such as file names and registry values may vary for each variant.