TROJ_PIDIEF.YNLO
Exploit:Win32/CVE-2010-0188 (Microsoft), PDF/Blacole-FHJ!C74EE46602AD (McAfee), JS/Exploit.Pdfka.QJQ (ESET)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
Varies
06 Aug 2014
Arrival Details
This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Other Details
This Trojan connects to the following possibly malicious URL:
- http://www.{BLOCKED}ge.bz:5555/{BLOCKED}nsport/{BLOCKED}65sad.php?nvon=31:1k:1g:1l:1i&oewyqjx=1m:2v:1f:1o:1g:1o:2w:1h:33:1j&abax=1i&jac=oekltzkb&gxyqtf=pee