TROJ_PIDIEF.EIJ

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It does not have any propagation routine.

It takes advantage of software vulnerabilities in certain software to drop malicious files. It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

It does not have any downloading capability.

It does not have any information-stealing capability.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This Trojan drops the following non-malicious file:

• {malware path}\iso88591
• %User Temp%\Adobe.pdf

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Propagation

This Trojan does not have any propagation routine.

Dropping Routine

This Trojan drops the following files:

• %User Temp%\Winword.exe - TROJ_WIMMIE.C

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It takes advantage of unknown vulnerabilities in the following software to drop malicious files:

• Adobe Flash Player 'SWF' File Remote Memory Corruption Vulnerability
• Adobe Reader and Acrobat .PDF Vulnerability
• Adobe Flash Player Unspecified Code Execution Vulnerability

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Download Routine

This Trojan does not have any downloading capability.

Information Theft

This Trojan does not have any information-stealing capability.

NOTES:

This Trojan takes advantage of the aforementioned Adobe vulnerabilities. It does this to execute its malicious routines on the affected system.

It does not have rootkit capabilities.