TROJ_PIDIEF.WKQ

This Trojan may be downloaded by other malware/grayware/spyware from remote sites. However, as of this writing, the said sites are inaccessible.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This Trojan may be downloaded by other malware/grayware/spyware from remote sites.

However, as of this writing, the said sites are inaccessible.

Dropping Routine

This Trojan takes advantage of the following software vulnerabilities to drop malicious files:

• Adobe Reader 'util.printf()' JavaScript Function Stack Overflow Vulnerability

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Download Routine

After successfully exploiting the said vulnerability, this malware connects to the following URLs to possibly download other malicious files:

• hxxp://{BLOCKED}.{BLOCKED}.44.90/d/l.php?i=5

Other Details

Based on analysis of the codes, it has the following capabilities:

• Downloads the file, %User Temp%\dfupd.exe
• Takes advantage of the software vulnerability(ies), Adobe Reader 'util.printf()' Javascript Function Stack Buffer Overflow Vulnerability to drop possibly malicious files

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)