TROJ_MDROP.EV

This Trojan exploit targets a known vulnerability in <i>Microsoft Office Word</i> with the way it handles specially crafted .RTF document files. In addition, it also uses social engineering techniques. Specifically, it drops a non-malicious document file containing information about the recent crisis in Japan. With this, it lures users into thinking that they are viewing a normal file while this Trojan runs in the background.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

Once this Trojan successfully exploits the vulnerability, it then drops and execute the malicious file detected as BKDR_LAPUK.D.

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This Trojan drops the following non-malicious files:

• C:\word.doc

Dropping Routine

This Trojan takes advantage of the following software vulnerabilities to drop malicious files:

• Microsoft Security Bulletin MS10-087

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

NOTES:

Other Details

Once this Trojan successfully exploits the said vulnerability, it attempts to drop and execute the following malicious file:

• %User Temp%\WINWORD.EXE - detected as BKDR_LAPUK.D

However, due to errors in its code, it fails to perform this intended routine.

The said .DOC file contains the following text:

This Trojan opens the normal .DOC file to hide its execution routine.