TROJ_PDFKA.DQ

This Trojan opens the non-malicious .PDF document so that the user does not suspect of any malicious activity in the system.

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may be unknowingly downloaded by a user while visiting malicious websites.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following files:

• %User Temp%\Winword.exe - TROJ_SYSWRT.DVD

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following non-malicious file:

• %User Temp%\Adobe.pdf
• %Current Folder%\iso88591

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Dropping Routine

This Trojan takes advantage of the following software vulnerabilities to drop malicious files:

• Adobe Reader and Acrobat .PDF Vulnerability

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Other Details

More information on this vulnerability can be found below:

• CVE-2010-2883

NOTES:
It then opens the non-malicious .PDF document so that the user does not suspect of any malicious activity in the system. The PDF has the following subject:

• "Summer Davos" in Asia Annual Meeting of the New Champions 2011