WORM_PIZZER.SM

This malware propagates by creating copies of itself in password-protected archives. It also downloads other malware onto the systems it infects, causing malicious routines to be exhibited.

To get a one-glance comprehensive view of the behavior of this Worm, refer to the Threat Diagram shown below.

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Download Routine

This worm accesses the following websites to download files:

• http://tazbox.{BLOCKED}o.org/downloader/kl/AppLauncher.exe
• http://tazbox.{BLOCKED}o.org/downloader/miner/dwm.exe

It saves the files it downloads using the following names:

• %Application Data%\Microsoft\Internet Explorer\AppLauncher.exe
• %Application Data%\Microsoft\windows\dwm.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This worm opens the following applications:

• Winrar.exe

NOTES:
This worm drops copies of itself in archives (.ZIP, .RAR, and .RAR SFX) in %System Root% and subfolders as follows:

• {malware folder}\{malware filename}

• a {archive path} {malware path}