TROJ_MDROP.SW

This Trojan has two embedded .SWF files in its body that it uses to exploit CVE-2011-0611. The two .SWF files are detected as SWF_EXPLOIT.WS.

If exploit is successful, it drops files.

This Trojan arrives as an attachment to email messages spammed by other malware/grayware/spyware or malicious users. It may be unknowingly downloaded by a user while visiting malicious websites.

It exploits a vulnerability identified as in a zero-day attack.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware/spyware or malicious users.

It may be unknowingly downloaded by a user while visiting malicious websites.

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• hwp.exe

Other Details

This Trojan exploits a zero-day vulnerability. More information on the said vulnerability can be found in the following pages:

• CVE-2011-0611
• http://www.adobe.com/support/security/bulletins/apsb11-07.html

NOTES:

This .DOC file has two embedded .SWF files in its body that it uses to exploit CVE-2011-0611. The two .SWF files are detected as SWF_EXPLOIT.WS.

If exploit is successful, it drops the following files:

• %User Temp%\svchost.exe - TROJ_DLOADR.WSA
• %User Temp%\AAAA - non-malicious .DOC file that the malware opens to hide its malicious routines.

It overwrites itself with the non-malicious document file %User Temp%\AAAA and opens this to trick users into thinking that it is non-malicious.