Analysis by: Anthony Joe Melgarejo
ALIASES:

Virus:ALisp/Passdoc.gen!A (Microsoft), ALS.Bursted.B (Symantec), Win32.ACAD.Bursted.A (FSecure), Virus.Alisp.Passdoc.a (v) (Sunbelt), ACAD/Bursted.B.1 (Antivir), ALS/Bursted.E (F-Prot), Win32.ACAD.Bursted.A (Bitdefender), Worm.ACAD.Bursted-2 (ClamAV), ACM/Pasdoc.A (Fortinet), ALS/Pasdoc.NAA virus (ESET), W32/Bursted.L (Panda), Virus.Acad.Pasdoc.i (VBA32)

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: File infector

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size: Varies
Memory Resident: No
Initial Samples Received Date: 12 Jan 2012

Arrival Details

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

File Infection

This is the Trend Micro detection for files infected by:

  • ALS_PASSDOC.SM

NOTES:

It searches for the file ACAD.MNL. It then searches for *.mnl files from where the ACAD.MNL file is located. It then copies itself to all .MNL files found. It also searches for the file ACAD.EXE. It then copies itself to all .LSP files found in the subfolder "support" where the file ACAD.EXE is found.