TROJ_PIDIEF.EZC

This Trojan may arrive bundled with malware packages as a malware component. It may be downloaded by other malware/grayware/spyware from remote sites.

It is a specially crafted PDF file which when viewed or executed, may allow a malicious user to take control over an affected system.

It executes the files it drops, prompting the affected system to exhibit the malicious routines they contain.

It takes advantage of certain vulnerabilities.

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

It may be downloaded by other malware/grayware/spyware from remote sites.

Installation

This Trojan drops and executes the following files:

• %User Profile%\Application Data\Microsoft\ico.exe - detected by Trend Micro as BKDR_TIDSERV.DM

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Backdoor Routine

This Trojan is a specially crafted PDF file which when viewed or executed, may allow a malicious user to take control over an affected system.

Dropping Routine

This Trojan executes the files it drops, prompting the affected system to exhibit the malicious routines they contain.

Other Details

More information on this vulnerability can be found below:

• APSA09-07

It does the following:

• It also drops the following normal .PDF file and opens it to trick users into thinking that the initially opened .PDF file is non-malicious:
  
  • %User Temp%\{non-english characters}.pdf

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It takes advantage of the following vulnerabilities:

• Vulnerability in the Doc.media.newPlayer method in Adobe Reader and Acrobat 9.2