PUA.Win32.FoxInstaller.A

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

プログラムは、ワーム活動の機能を備えていません。

プログラムは、バックドア活動の機能を備えていません。

プログラムは、特定のWebサイトにアクセスし、情報を送受信します。

侵入方法

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

プログラムは、以下のファイルを作成します。

• %User Temp%\{Random Characters}.tmp\FoxitReader941_enu_Setup_Prom.exe
• %User Temp%\{Random Characters}.tmp\up_cut.bmp
• %User Temp%\{Random Characters}.tmp\open_dialog.bmp
• %User Temp%\{Random Characters}.tmp\start_button.bmp
• %User Temp%\{Random Characters}.tmp\start_button_hover.bmp
• %User Temp%\{Random Characters}.tmp\welcome_page.bmp
• %User Temp%\{Random Characters}.tmp\Continue.bmp
• %User Temp%\{Random Characters}.tmp\Continue_hover.bmp
• %User Temp%\{Random Characters}.tmp\next_button.bmp
• %User Temp%\{Random Characters}.tmp\next_button_hover.bmp
• %User Temp%\{Random Characters}.tmp\Browse_button.bmp
• %User Temp%\{Random Characters}.tmp\Browse_button_hover.bmp
• %User Temp%\{Random Characters}.tmp\cancel_button.bmp
• %User Temp%\{Random Characters}.tmp\back_button.bmp
• %User Temp%\{Random Characters}.tmp\back_button_hover.bmp
• %User Temp%\{Random Characters}.tmp\Accept.bmp
• %User Temp%\{Random Characters}.tmp\Accept_hover.bmp
• %User Temp%\{Random Characters}.tmp\Decline_button.bmp
• %User Temp%\{Random Characters}.tmp\Decline_button_hover.bmp
• %User Temp%\{Random Characters}.tmp\i_agree_button.bmp
• %User Temp%\{Random Characters}.tmp\i_agree_button_hover.bmp
• %User Temp%\{Random Characters}.tmp\finish_page.bmp
• %User Temp%\{Random Characters}.tmp\install_button.bmp
• %User Temp%\{Random Characters}.tmp\finish_button.bmp
• %User Temp%\{Random Characters}.tmp\finish_button_hover.bmp
• %User Temp%\{Random Characters}.tmp\close.bmp
• %User Temp%\{Random Characters}.tmp\close_hover.bmp
• %User Temp%\{Random Characters}.tmp\installing_foxit_reader.bmp
• %User Temp%\{Random Characters}.tmp\check_empty.bmp
• %User Temp%\{Random Characters}.tmp\check_v.bmp
• %User Temp%\{Random Characters}.tmp\custom_installation.bmp
• %User Temp%\{Random Characters}.tmp\loader_page_pic.gif
• %User Temp%\{Random Characters}.tmp\launch_foxit_reader.bmp
• %User Temp%\{Random Characters}.tmp\NsisWindowSubClass.dll
• %User Temp%\{Random Characters}.tmp\LangDLL.dll
• %User Temp%\{Random Characters}.tmp\System.dll
• %User Temp%\{Random Characters}.tmp\nsDialogs.dll
• %User Temp%\{Random Characters}.tmp\Splash2.gif
• %User Temp%\{Random Characters}.tmp\newadvsplash.dll
• %User Temp%\~{Random Hex}.TMP
• %User Temp%\{Random Characters}.tmp\AnimGif.dll
• %User Temp%\{Random Characters}.tmp\INetC.dll
• %User Temp%\Prime\Prime.zip
• %User Temp%\{Random Characters}.tmp\nsisunz.dll
• %User Temp%\Prime\Prime.dll
• %User Temp%\Prime\Prime
• %User Temp%\{Random Characters}.tmp\ButtonEvent.dll
• %User Temp%\is-{Random Characters}.tmp\FoxitReader941_enu_Setup_Prom.tmp
• %User Temp%\is-{Random Characters}.tmp\FXCUSTOM.dll
• %User Temp%\is-{Random Characters}.tmp\error.bmp
• %User Temp%\is-{Random Characters}.tmp\cloudReading.bmp
• %Program Files%\Foxit Software\Foxit Reader\unins000.dat
• %Program Files%\Foxit Software\Foxit Reader\unins000.exe
• %Program Files%\Foxit Software\Foxit Reader\icudtl.dat
• %Program Files%\Foxit Software\Foxit Reader\plugins\EpubViewer.fpi
• %Program Files%\Foxit Software\Foxit Reader\plugins\Browser.fpi
• %Program Files%\Foxit Software\Foxit Reader\FPCSDK.dll
• %Program Files%\Foxit Software\Foxit Reader\FPCSDK64.dll
• %Program Files%\Foxit Software\Foxit Reader\ServiceMiniNotice.exe
• %Program Files%\Foxit Software\Foxit Reader\FoxitReaderConnectedPDFService.exe
• %Program Files%\Foxit Software\Foxit Reader\LocalService.dll
• %Program Files%\Foxit Software\Foxit Reader\CollectStrategy.host
• %Program Files%\Foxit Software\Foxit Reader\plugins\ConnectedPDFPlugin.fpi
• %Program Files%\Foxit Software\Foxit Reader\plugins\ConnectedPDFDRM.fpi
• %Program Files%\Foxit Software\Foxit Reader\plugins\CPDFOCLink.fpi
• %Program Files%\Foxit Software\Foxit Reader\plugins\ConnectedPDFLogin.dll
• %Program Files%\Foxit Software\Foxit Reader\plugins\ConnectedPDFLogin64.dll
• %Program Files%\Foxit Software\Foxit Reader\plugins\FoxitAccountManagement.fpi
• %Program Files%\Foxit Software\Foxit Reader\plugins\ServicePlugin\ConnectPDFService.dll
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\en-US\welcome\about.html
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\en-US\welcome\error.html
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\en-US\welcome\proceed.html
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\en-US\welcome\setting.html
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\img\1cloud-reading.gif
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\img\2cReview.gif
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\img\3Message-Board.gif
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\img\4DRM.gif
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\img\favicon.ico
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\img\left.png
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\img\logo-l.png
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\img\mouse-over-left.png
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\img\mouse-over-right.png
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\img\right.png
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\img\share-file.gif
• %Program Files%\Foxit Software\Foxit Reader\ConnectedPDF\img\web_error.png
• %Program Files%\Foxit Software\Foxit Reader\wrappers\en-US\RequestPermTmpl.pdf
• %Program Files%\Foxit Software\Foxit Reader\wrappers\en-US\Wrapper.pdf
• %Program Files%\Foxit Software\Foxit Reader\mfc140u.dll
• %Program Files%\Foxit Software\Foxit Reader\mfcm140u.dll
• %Program Files%\Foxit Software\Foxit Reader\msvcp140.dll
• %Program Files%\Foxit Software\Foxit Reader\vccorlib140.dll
• %Program Files%\Foxit Software\Foxit Reader\vcruntime140.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-console-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-datetime-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-debug-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-errorhandling-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-file-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-file-l1-2-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-file-l2-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-handle-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-heap-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-interlocked-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-libraryloader-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-localization-l1-2-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-memory-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-namedpipe-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-processenvironment-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-processthreads-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-processthreads-l1-1-1.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-profile-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-rtlsupport-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-string-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-synch-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-synch-l1-2-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-sysinfo-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-timezone-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-core-util-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\API-MS-Win-core-xstate-l2-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-conio-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-convert-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-environment-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-filesystem-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-heap-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-locale-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-math-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-multibyte-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-private-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-process-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-runtime-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-stdio-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-string-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-time-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\api-ms-win-crt-utility-l1-1-0.dll
• %Program Files%\Foxit Software\Foxit Reader\ucrtbase.dll
• %Program Files%\Foxit Software\Foxit Reader\plugins\OneDrivePlugin.fpi
• %Program Files%\Foxit Software\Foxit Reader\plugins\GoogleDrivePlugin.fpi
• %Program Files%\Foxit Software\Foxit Reader\plugins\DropboxPlugin.fpi
• %Program Files%\Foxit Software\Foxit Reader\plugins\BoxPlugin.fpi
• %Program Files%\Foxit Software\Foxit Reader\plugins\CommentsSummary.fpi
• %Program Files%\Foxit Software\Foxit Reader\plugins\HttpCallWebService.dll
• %Program Files%\Foxit Software\Foxit Reader\plugins\PlgDynLoader.fpi
• %Program Files%\Foxit Software\Foxit Reader\TrackReview.exe
• %Program Files%\Foxit Software\Foxit Reader\plugins\ShareReviewPlugin.fpi
• %Program Files%\Foxit Software\Foxit Reader\notice.txt
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\ActionWizard.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\BoxPlugin.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\browser.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\CommentsSummary.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\ConnectedPDFDRM.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\ConnectedPDFPlugin.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\CPDFOCLink.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\docusign_plugin.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\DropboxPlugin.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\EpubViewer.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\FileOpen.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\FoxitAccountManagement.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\FoxitDrive.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\FRMSPlg.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\FRMSPlgV2.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\GoogleDrivePlugin.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\IntegrateWithSP.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\LicenseManager.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\OneDrivePlugin.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\PlgPltfm.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\ShareReviewPlugin.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\Speech.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\U3DBrowser.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\Updater.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\logo\WIP.png
• %Program Files%\Foxit Software\Foxit Reader\plugins\PlgPltfm.fpi
• %Program Files%\Foxit Software\Foxit Reader\plugins\DefaultPluginsList.xml
• %Program Files%\Foxit Software\Foxit Reader\plugins\FoxitDrive.fpi
• %Program Files%\Foxit Software\Foxit Reader\plugins\no_connection.html
• %Program Files%\Foxit Software\Foxit Reader\plugins\jrsys\x86\jrsysCryptoDll.dll
• %Program Files%\Foxit Software\Foxit Reader\plugins\jrsys\x86\jrsysMSCryptoDll.dll
• %Program Files%\Foxit Software\Foxit Reader\lex\accent.tlx
• %Program Files%\Foxit Software\Foxit Reader\lex\correct.tlx
• %Program Files%\Foxit Software\Foxit Reader\lex\ssceam.tlx
• %Program Files%\Foxit Software\Foxit Reader\lex\ssceam2.clx
• %Program Files%\Foxit Software\Foxit Reader\lex\sscebr.tlx
• %Program Files%\Foxit Software\Foxit Reader\lex\sscebr2.clx
• %Program Files%\Foxit Software\Foxit Reader\lex\ssceca.tlx
• %Program Files%\Foxit Software\Foxit Reader\lex\ssceca2.clx
• %Program Files%\Foxit Software\Foxit Reader\lex\sscedu.tlx
• %Program Files%\Foxit Software\Foxit Reader\lex\sscedu2.clx
• %Program Files%\Foxit Software\Foxit Reader\lex\sscefr.tlx
• %Program Files%\Foxit Software\Foxit Reader\lex\sscefr2.clx
• %Program Files%\Foxit Software\Foxit Reader\lex\sscege.tlx
• %Program Files%\Foxit Software\Foxit Reader\lex\sscegn2.clx
• %Program Files%\Foxit Software\Foxit Reader\lex\ssceit.tlx
• %Program Files%\Foxit Software\Foxit Reader\lex\ssceit2.clx
• %Program Files%\Foxit Software\Foxit Reader\lex\sscepb.tlx
• %Program Files%\Foxit Software\Foxit Reader\lex\sscepb2.clx
• %Program Files%\Foxit Software\Foxit Reader\lex\sscesp.tlx
• %Program Files%\Foxit Software\Foxit Reader\lex\sscesp2.clx
• %Program Files%\Foxit Software\Foxit Reader\lex\tech.tlx
• %Program Files%\Foxit Software\Foxit Reader\lex\userdic.tlx
• %Program Files%\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\index.html
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\skin.css
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\version.xml
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\css\base.css
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\css\non-cpdf.css
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\Default\config.css
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\images\FPM_icon.png
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\images\icon_epub.png
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\images\icon_folder_open.png
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\images\icon_pdf.png
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\images\icon_remove.png
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\images\lastIco.png
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\images\microphone.png
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\images\search-btn.png
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\images\search-icon.png
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\images\upgrade_now.png
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\js\banner.js
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\js\jquery-1.9.1.min.js
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\js\nor.js
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\tpl\index.html
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\tpl\non-cpdf\index.html
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\tpl\non-net\index.html
• %Program Files%\Foxit Software\Foxit Reader\Start\en-US\tpl\non-net\non-cpdf\index.html
• %Program Files%\Foxit Software\Foxit Reader\skins\Classic\Thumbnail\en-US\CrashBanner.png
• %Program Files%\Foxit Software\Foxit Reader\skins\Classic\Thumbnail\en-US\CrashBanner_4K.png
• %Program Files%\Foxit Software\Foxit Reader\skins\Classic\Thumbnail\en-US\RibbonThumbnail.png
• %Program Files%\Foxit Software\Foxit Reader\skins\Classic\Thumbnail\en-US\updatebanner.bmp
• %Program Files%\Foxit Software\Foxit Reader\skins\Classic\Thumbnail\en-US\VerifyRegisKey.png
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Black\Black.xml
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Black\StartPage\body_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Black\StartPage\CONFIG.css
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Black\StartPage\content_showbg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Black\StartPage\history_winbg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Black\StartPage\line.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Black\StartPage\right_move_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Black\StartPage\right_over_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Black\StartPage\show_con_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Black\StartPage\tab.png
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Black\StartPage\top_tb_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Black\Thumbnail\en-US\Thumbnail.png
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Blue\Blue.xml
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Blue\StartPage\body_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Blue\StartPage\CONFIG.css
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Blue\StartPage\content_showbg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Blue\StartPage\history_winbg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Blue\StartPage\line.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Blue\StartPage\right_move_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Blue\StartPage\right_over_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Blue\StartPage\show_con_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Blue\StartPage\tab.png
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Blue\StartPage\top_tb_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Blue\Thumbnail\en-US\Thumbnail.png
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Orange\Orange.xml
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Orange\StartPage\body_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Orange\StartPage\CONFIG.css
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Orange\StartPage\content_showbg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Orange\StartPage\history_winbg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Orange\StartPage\line.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Orange\StartPage\right_move_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Orange\StartPage\right_over_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Orange\StartPage\show_con_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Orange\StartPage\tab.png
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Orange\StartPage\top_tb_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Orange\Thumbnail\en-US\Thumbnail.png
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Purple\Purple.xml
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Purple\StartPage\body_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Purple\StartPage\CONFIG.css
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Purple\StartPage\content_showbg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Purple\StartPage\history_winbg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Purple\StartPage\line.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Purple\StartPage\right_move_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Purple\StartPage\right_over_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Purple\StartPage\show_con_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Purple\StartPage\tab.png
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Purple\StartPage\top_tb_bg.jpg
• %Program Files%\Foxit Software\Foxit Reader\skins\Ribbon\Purple\Thumbnail\en-US\Thumbnail.png
• %Program Files%\Foxit Software\Foxit Reader\stamps\en-US\Dynamic Stamps.pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\en-US\Sign Here.pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\en-US\Standard Stamps.pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Arrow Stamp(Blue).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Arrow Stamp(Deep Blue).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Arrow Stamp(Deep Green).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Arrow Stamp(Green).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Arrow Stamp(Purple).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Circle Stamp(Blue).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Diamond Stamp(Blue).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Diamond Stamp(Green).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Ellipse Stamp(Green).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Ellipse Stamp(Purple).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Ellipse Stamp(Red).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Octagon Stamp(Blue).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Octagon Stamp(Purple).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Rectangle Stamp(Blue).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Rectangle Stamp(Deep Blue).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Square Stamp(Green).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Square Stamp(Purple).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Triangle Stamp(Blue).pdf
• %Program Files%\Foxit Software\Foxit Reader\stamps\Standard Templates\Triangle Stamp(Purple).pdf
• %Program Files%\Foxit Software\Foxit Reader\Tracker\add_reviewers.png
• %Program Files%\Foxit Software\Foxit Reader\Tracker\change_deadline.png
• %Program Files%\Foxit Software\Foxit Reader\Tracker\common.css
• %Program Files%\Foxit Software\Foxit Reader\Tracker\email_all.png
• %Program Files%\Foxit Software\Foxit Reader\Tracker\email_initiator.png
• %Program Files%\Foxit Software\Foxit Reader\Tracker\end_review.png
• %Program Files%\Foxit Software\Foxit Reader\Tracker\index.html
• %Program Files%\Foxit Software\Foxit Reader\Tracker\loading.gif
• %Program Files%\Foxit Software\Foxit Reader\Tracker\start_same_new_review.png
• %Program Files%\Foxit Software\Foxit Reader\Tracker\js\external.js
• %Program Files%\Foxit Software\Foxit Reader\Tracker\js\index.js
• %Program Files%\Foxit Software\Foxit Reader\Tracker\js\jquery.min.js
• %Program Files%\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x86.dll
• %Program Files%\Foxit Software\Foxit Reader\plugins\Creator\x86\ConvertToPDF_x86.dll
• %Program Files%\Foxit Software\Foxit Reader\plugins\Creator\FoxitProxyServer_Socket_RD.exe
• %Program Files%\Foxit Software\Foxit Reader\plugins\Creator\x86\FPC_WordAddin_x86.dll
• %Program Files%\Foxit Software\Foxit Reader\plugins\Creator\x86\FPC_PPTAddin_x86.dll
• %Program Files%\Foxit Software\Foxit Reader\FoxitReader.exe.man
• %Program Files%\Foxit Software\Foxit Reader\FoxitReader.exe
• %Program Files%\Foxit Software\Foxit Reader\FoxitUpdater.exe
• %Program Files%\Foxit Software\Foxit Reader\UpdaterInfo.xml
• %Application Data%\Foxit Software\Foxit Reader\SilentInstall\UpdaterInfo.xml
• %Program Files%\Foxit Software\Foxit Reader\plugins\Updater.fpi
• %Application Data%\Foxit Software\CertFile\PR\tsfile.foxitdata1
• %Program Files%\Foxit Software\Foxit Reader\plugins\FoxitReaderBrowserAx.dll
• %Program Files%\Foxit Software\Foxit Reader\SendCrashReport.exe
• %Program Files%\Foxit Software\Foxit Reader\plugins\FRMSPlgV2.fpi
• %Program Files%\Foxit Software\Foxit Reader\plugins\Speech.fpi
• %Program Files%\Foxit Software\Foxit Reader\Shell Extensions\FoxitThumbnailHndlr_x86.dll
• %Program Files%\Foxit Software\Foxit Reader\Shell Extensions\FoxitPrevHndlr.dll
• %Program Files%\Foxit Software\Foxit Reader\Shell Extensions\FoxitPreviewhost.exe
• %Program Files%\Foxit Software\Foxit Reader\FXCUSTOM.dll
• %Program Files%\Foxit Software\Foxit Reader\docusign\progress_bar.gif
• %Program Files%\Foxit Software\Foxit Reader\docusign\progress_circle.gif
• %Program Files%\Foxit Software\Foxit Reader\docusign\transfer1.html
• %Program Files%\Foxit Software\Foxit Reader\docusign\transfer.html
• %Program Files%\Foxit Software\Foxit Reader\plugins\docusign_plugin.fpi
• %Program Files%\Foxit Software\Foxit Reader\plugins\IntegrateWithSP.fpi
• %Common Programs%\Foxit Reader\Foxit Reader.lnk
• %Common Programs%\Foxit Reader\Uninstall Foxit Reader.lnk
• %Public%\Desktop\Foxit Reader.lnk
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
• %Program Files%\Foxit Software\Foxit Reader\unins000.msg
• %Program Files%\Foxit Software\Foxit Reader\unins000.dat
• %ProgramData%\Foxit ContentPlatform\Progress.ini
• %Application Data%\Foxit AgentInformation\Agent.txt
• %User Temp%\is-{Random Characters}.tmp\CountInstallation.exe
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\css\base.css
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\css\non-cpdf.css
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\Default\config.css
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\images\FPM_icon.png
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\images\icon_epub.png
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\images\icon_folder_open.png
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\images\icon_pdf.png
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\images\icon_remove.png
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\images\lastIco.png
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\images\microphone.png
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\images\search-btn.png
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\images\search-icon.png
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\images\upgrade_now.png
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\index.html
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\js\banner.js
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\js\jquery-1.9.1.min.js
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\js\nor.js
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\skin.css
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\tpl\index.html
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\tpl\non-cpdf\index.html
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\tpl\non-net\index.html
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\tpl\non-net\non-cpdf\index.html
• %Application Data%\Foxit Software\Foxit Reader\StartPage 9.4.1\Start\en-US\version.xml
• %User Temp%\is-{Random Characters}.tmp\frdvpr_drv_x64.dll
• %User Temp%\is-{Random Characters}.tmp\frdvpr_pnt.txt
• %User Temp%\is-{Random Characters}.tmp\frdvpr_ui_x64.dll
• %User Temp%\is-{Random Characters}.tmp\frdvpr_drv_x86.dll
• %User Temp%\is-{Random Characters}.tmp\frdvpr_ui_x86.dll
• %System%\spool\drivers\w32x86\frdvpr_pnt.txt
• %System%\spool\drivers\w32x86\frdvpr_ui.dll
• %System%\spool\drivers\w32x86\frdvpr_drv.dll
• %User Temp%\Foxit Reader\HasCountInstallation\20240109\9.4.1.16828.xml
• %User Temp%\fox{Random Hex}.tmp
• %Public%\Foxit Software\Foxit Reader\ConnectedPDF\DeviceModel.host
• %Application Data%\Foxit Software\Addon\Foxit Reader\FoxitReaderUpdater.exe
• %User Temp%\%%%{Random Hex}.tmp
• %User Temp%\Foxit Reader\reader_update_fail_req.xml

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。. %Application Data%フォルダは、現在ログオンしているユーザのアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming" です。. %Common Programs%フォルダは、共通プログラムグループが含まれるフォルダです。Windows 2000、XP、Server 2003の場合、通常 "C:\Documents and Settings\All Users\Start Menu\Programs" です。また、Windows Vista、7、8の場合、通常 "C:\ProgramData\Microsoft\Windows\Start Menu\Programs" です。. %Public%フォルダは、すべてのユーザ共通のファイルまたはフォルダのリポジトリとして機能するフォルダです。Windows Vista、7、8の場合、通常 "C:\Users\Public" です。. %ProgramData%フォルダは、マルチユーザーシステムにおいて任意のユーザがプログラムに変更を加えることができるプログラムファイルフォルダのバージョンです。これには、すべてのユーザのアプリケーションデータが含まれます。Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\ProgramData" です。Windows Server 2003(32-bit)、2000(32-bit)、XPの場合、通常 "C:\Documents and Settings\All Users" です。 . %System%フォルダは、システムフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows\System32" です。.)

プログラムは、以下のプロセスを追加します。

• "%User Temp%\{Random Characters}.tmp\FoxitReader941_enu_Setup_Prom.exe" /VERYSILENT /NORESTART /CustomSetup
• "%User Temp%\is-{Random Characters}.tmp\FoxitReader941_enu_Setup_Prom.tmp" /SL5="$1F034A,77716790,421376,%User Temp%\{Random Characters}.tmp\FoxitReader941_enu_Setup_Prom.exe" /VERYSILENT /NORESTART /CustomSetup
• "%System%\regsvr32.exe" /s "%Program Files%\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x86.dll"
• "%System%\regsvr32.exe" /s "%Program Files%\Foxit Software\Foxit Reader\plugins\Creator\x86\FPC_WordAddin_x86.dll"
• "%System%\regsvr32.exe" /s "%Program Files%\Foxit Software\Foxit Reader\plugins\Creator\x86\FPC_PPTAddin_x86.dll"
• "%System%\regsvr32.exe" /s "%Program Files%\Foxit Software\Foxit Reader\plugins\FoxitReaderBrowserAx.dll"
• "%System%\regsvr32.exe" /s "%Program Files%\Foxit Software\Foxit Reader\Shell Extensions\FoxitThumbnailHndlr_x86.dll"
• "%System%\regsvr32.exe" /s "%Program Files%\Foxit Software\Foxit Reader\Shell Extensions\FoxitPrevHndlr.dll"
• "%Program Files%\Foxit Software\Foxit Reader\Shell Extensions\FoxitPreviewhost.exe" /regserver
• "%Program Files%\Foxit Software\Foxit Reader\FoxitReader.exe" /displayinbrowser
• "%Program Files%\Foxit Software\Foxit Reader\FoxitReader.exe" /register
• "%System%\regsvr32.exe" -s "%Program Files%\Foxit Software\Foxit Reader\Shell Extensions\FoxitThumbnailHndlr_x86.dll"
• "%System%\regsvr32.exe" -s "%Program Files%\Foxit Software\Foxit Reader\Shell Extensions\FoxitPrevHndlr.dll"
• "%Program Files%\Foxit Software\Foxit Reader\FoxitReader.exe" /FirstRun
• "%User Temp%\is-OESPI.tmp\CountInstallation.exe" /version 9.4.1.16828 /green 0 /appname "Foxit Reader" /productid 1 /ReaderLang en_us /AgentName "Foxit Reader(bundle PhantomStd)" /AgencyID 90 /isPhantom 0 /newuser 1 /updaterinstall Website /uninstall 0
• "%Program Files%\Foxit Software\Foxit Reader\FoxitReader.exe"
• "%Application Data%\Foxit Software\Addon\Foxit Reader\FoxitReaderUpdater.exe" -updater -type "Auto Updater" -hwnd 2491760 -readerpath "%Program Files%\Foxit Software\Foxit Reader\" -regpath "HKEY_CURRENT_USER\Software\Foxit Software\Foxit Reader 9.0" -version "9.4.1.16828" -readerlang "en-US"

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。. %Application Data%フォルダは、現在ログオンしているユーザのアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming" です。)

他のシステム変更

プログラムは、以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities\FileAssociations
.pdf = FoxitReader.Document

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities\FileAssociations
.fdf = FoxitReader.FDFDoc

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities\FileAssociations
.xfdf = FoxitReader.XFDFDoc

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities\FileAssociations
.xdp = FoxitReader.XDPDoc

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities\FileAssociations
.ppdf = FoxitReader.PPDF

HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications
Foxit Reader = SOFTWARE\Foxit Software\Foxit Reader\Capabilities

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities
ApplicationName = Foxit Reader

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities\MIMEAssociations
application/pdf = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities\MIMEAssociations
application/vnd.fdf = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities\MIMEAssociations
application/vnd.xdp = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities\MIMEAssociations
application/vnd.xfdf = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities\UrlAssociations
foxitreader = foxitreader

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader
InstallPath = %Program Files%\Foxit Software\Foxit Reader

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader
InstallAppName = FoxitReader.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\App Paths\
foxitreader.exe
(Default) = %Program Files%\Foxit Software\Foxit Reader\FoxitReader.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\App Paths\
foxitreader.exe
Path = %Program Files%\Foxit Software\Foxit Reader\

感染活動

プログラムは、ワーム活動の機能を備えていません。

バックドア活動

プログラムは、バックドア活動の機能を備えていません。

ルートキット機能

プログラムは、ルートキット機能を備えていません。

その他

プログラムは、以下のレジストリキーを追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities\FileAssociations

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities\MIMEAssociations

HKEY_LOCAL_MACHINE\SOFTWARE\Foxit Software\
Foxit Reader\Capabilities\UrlAssociations

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\App Paths\
foxitreader.exe

プログラムは、以下のWebサイトにアクセスし、情報を送受信します。

• http://{BLOCKED}rod.com:443
• https://{BLOCKED}is.foxitservice.com/desktop/reader/r.php?do=first
• https://{BLOCKED}est.foxitservice.com/addons/get_addons.php?addon=Update%20List&product=Reader&version=9.4&build=1.16828&language=lang_en-US&major=6&minor=1&codepage=1252&EmbededLanguage=en-US&platform=&AgentID=0&PackageType=en-US
• https://{BLOCKED}p.foxitservice.com/go.php?do=redirect&title=register_reader&product=Foxit%20Reader&language=en-US&version=9.4&edition=Free
• https://{BLOCKED}ap.foxitservice.com/front/index/go?do=redirect&title=register_reader&product=Foxit%20Reader&language=en-US&version=9.4&edition=Free
• https://www.{BLOCKED}t.com/pdf-reader/register.html
• http://{BLOCKED}tsoftware.com/adserve.php
• http://{BLOCKED}tsoftware.com/banners_zz.b689d828983cdf62a8a1e96404404da0-9B0F387BEA6FC1825300A9C6EE8838752562CE90.zip

プログラムは、以下を実行します。

• It is used to install the following software:
  • Foxit PDF Reader v9.4.1.16828
• It displays the following GUI prompting for installation of the product:
  
• It shows a license agreement before installing the product:
  
• It displays a progress bar during the installation process:
  
• After installation, it executes the installed product showing its main GUI:
  

マルウェアは、脆弱性を利用した感染活動を行いません。