TR/Dldr.Small.aafh - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Dldr.Small.aafh
Date discovered:	06/08/2008
Type:	Trojan
Subtype:	Downloader
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	139.776 Bytes
MD5 checksum:	6b50dc99f2ca5e90ef6ecef9a25c6157
IVDF version:	7.00.05.218 - Wed, 06 Aug 2008 08:23 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Symantec: Trojan.Dropper
   • Kaspersky: Trojan-Downloader.Win32.Small.aafh
   • TrendMicro: TROJ_RENOS.ADX
   • F-Secure: Trojan-Downloader.Win32.Small.aafh
   • Sophos: Troj/FakeAle-EF
   • Panda: Adware/Antivirus2008XP
   • VirusBuster: Trojan.FakeAlert.FV
   • Eset: Win32/TrojanDownloader.FakeAlert.DJ trojan
   • Bitdefender: Trojan.FakeAlert.YK

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads a malicious file
   • Drops a file
   • Drops malicious files
   • Registry modification

It displays the content of a created pictorial file:

Files It copies itself to the following location:
   • %SYSDIR%\lphc1boj0e39c.exe

The following files are created:

– Non malicious file:
   • %SYSDIR%\phc1boj0e39c.bmp

– %SYSDIR%\blphc1boj0e39c.scr Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: JOKE/BSOD.C

– %TEMPDIR%\.tt1.tmp.vbs Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: VBS/Agent.1002

It tries to download a file:

– The location is the following:
   • http://antivirusxp-08.com/images/1190**********.gif
It is saved on the local hard drive under: %TEMPDIR%\.tt4.tmp Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too.

Registry One of the following values is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • lphc1boj0e39c="%SYSDIR%\lphc1boj0e39c.exe"

The following registry keys are added:

– [HKLM\SOFTWARE\Microsoft\Software Notifier]
   • InstallationID="9528fec3-f3c9-4201-91c6-ff859a0641b2"

– [HKCU\Software\Sysinternals\Bluescreen Screen Saver]
   • EulaAccepted=dword:00000001

The following registry keys are changed:

Various Explorer settings:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
   New value:
   • NoDispBackgroundPage=dword:00000001
   • NoDispScrSavPage=dword:00000001

– [HKCU\Control Panel\Colors]
   New value:
   • Background="0 0 255"

– [HKCU\Control Panel\Desktop]
   New value:
   • WallpaperStyle="0"
     TileWallpaper="0"
     Wallpaper="%SYSDIR%\phc1boj0e39c.bmp"
     OriginalWallpaper="%SYSDIR%\phc1boj0e39c.bmp"
     SCRNSAVE.EXE="%SYSDIR%\blphc1boj0e39c.scr"
     ScreenSaveActive="1"
     ScreenSaveTimeOut="600"

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

See a brief description here.

Description inserted by Thomas Wegele on Mon, 11 Aug 2008 13:07 (GMT+1)
Description updated by Philipp Wolf on Mon, 11 Aug 2008 13:22 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back