PDF_BLUERID.G

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops and executes the following files:

• %Temp%\x.vbs

(Note: %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}tem.{BLOCKED}m.my/img/wpsys.exe

As of this writing, the said sites are inaccessible.

Other Details

This Trojan does the following:

• It lures the user to click "Open" of the Launch File dialog since it displays the ff:
  
     "PDF Encrypted. Please click 'Open'.
  
  Once the user clicks open, it will execute a script that exhibits malicious activity.