Trojan.Encoder.32928

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\nwfieldnotes1966.docx
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\adadsi.html
<Drive name for removable media>:\tunpersonalca1.pem
<Drive name for removable media>:\hhhlcert.pem
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\adhd_and_obesity.docx
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\4f0bf7ff71f28.jpeg
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
<Drive name for removable media>:\parnas_01.jpeg
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\writingcompletesarnarrative_1103.ppt

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\ituneshelpunavailable.htm
%HOMEPATH%\desktop\iisstart.htm
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\64bit_notes.htm
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\tree_view.html

Modifies file system

Creates the following files

D:\b7d5cc-readme.txt
C:\far2\b7d5cc-readme.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\b7d5cc-readme.txt
%HOMEPATH%\desktop\b7d5cc-readme.txt
C:\users\public\libraries\b7d5cc-readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\b7d5cc-readme.txt
%HOMEPATH%\contacts\b7d5cc-readme.txt
%ProgramFiles%\foxit\b7d5cc-readme.txt
%ProgramFiles(x86)%\k-lite codec pack\icaros\b7d5cc-readme.txt
%ProgramFiles(x86)%\winamp\b7d5cc-readme.txt
%HOMEPATH%\favorites\links\b7d5cc-readme.txt
%ProgramFiles(x86)%\opera\b7d5cc-readme.txt
%ProgramFiles(x86)%\microsoft office\office14\1033\b7d5cc-readme.txt
C:\far2\addons\shell\b7d5cc-readme.txt
%ProgramFiles(x86)%\mirc\b7d5cc-readme.txt

Moves the following files

from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\96cade712d812106de6ec68.b7d5cc
from %ProgramFiles%\microsoft office\office14\thocr.psp to %ProgramFiles%\microsoft office\office14\9d1dc269c.b7d5cc
from %ProgramFiles%\microsoft office\office14\wordirm.xml to %ProgramFiles%\microsoft office\office14\0e9cbea7bbb.b7d5cc
from %ProgramFiles%\microsoft office\office14\xlcprtid.xml to %ProgramFiles%\microsoft office\office14\47511331dba0.b7d5cc
from %ProgramFiles%\microsoft office\office14\custom.propdesc to %ProgramFiles%\microsoft office\office14\c6039cbfd1ad812.b7d5cc
from %ProgramFiles%\microsoft office\office14\engidx.dat to %ProgramFiles%\microsoft office\office14\89c4ecee94.b7d5cc
from %ProgramFiles%\microsoft office\office14\english.lng to %ProgramFiles%\microsoft office\office14\d5ae0b53a84.b7d5cc
from %ProgramFiles%\microsoft office\office14\exlirm.xml to %ProgramFiles%\microsoft office\office14\bf9ba2a066.b7d5cc
from %ProgramFiles%\microsoft office\office14\graph.exe.manifest to %ProgramFiles%\microsoft office\office14\6e94d304efdae4df99.b7d5cc
from %ProgramFiles%\microsoft office\office14\ipirm.xml to %ProgramFiles%\microsoft office\office14\24471c32e.b7d5cc
from %ProgramFiles%\microsoft office\office14\ipirmv.xml to %ProgramFiles%\microsoft office\office14\300f962751.b7d5cc
from %ProgramFiles%\microsoft office\office14\jfont.dat to %ProgramFiles%\microsoft office\office14\66d8d6eb3.b7d5cc
from %ProgramFiles%\microsoft office\office14\latin1.shp to %ProgramFiles%\microsoft office\office14\f16e158876.b7d5cc
from %ProgramFiles%\microsoft office\office14\msacc.olb to %ProgramFiles%\microsoft office\office14\a6e855d60.b7d5cc
from %ProgramFiles%\microsoft office\office14\microsoft.businessdata.xml to %ProgramFiles%\microsoft office\office14\f43f073770a5105c5b3bb86a47.b7d5cc
from %ProgramFiles%\microsoft office\office14\mml2omml.xsl to %ProgramFiles%\microsoft office\office14\2020bc0853c3.b7d5cc
from %ProgramFiles%\microsoft office\office14\mscol11.ppd to %ProgramFiles%\microsoft office\office14\269a7542f30.b7d5cc
from %ProgramFiles%\microsoft office\office14\mscss7cm_es.dub to %ProgramFiles%\microsoft office\office14\d3f5644d23fdb2b.b7d5cc
from %ProgramFiles%\microsoft office\office14\mscol11.inf to %ProgramFiles%\microsoft office\office14\0d6af6b4d18.b7d5cc
from %ProgramFiles%\microsoft office\office14\msaccess.exe.manifest to %ProgramFiles%\microsoft office\office14\ca66c8b9c1b22e448f29f.b7d5cc
from %ProgramFiles%\microsoft office\office14\microsoft.office.businessapplications.runtimeui.xml to %ProgramFiles%\microsoft office\office14\781afa111aae34ce3db5d355bc7f9aff7ca804e7275ddf58bdb.b7d5cc
from %ProgramFiles%\microsoft office\office14\msoutl.olb to %ProgramFiles%\microsoft office\office14\84eb469d1c.b7d5cc
from %ProgramFiles%\microsoft office\office14\mset7jp.kic to %ProgramFiles%\microsoft office\office14\519d3df555a.b7d5cc
from %ProgramFiles%\microsoft office\office14\mset7ge.kic to %ProgramFiles%\microsoft office\office14\5642503d730.b7d5cc
from %ProgramFiles%\microsoft office\office14\mset7es.kic to %ProgramFiles%\microsoft office\office14\b8ca23331b1.b7d5cc
from %ProgramFiles%\microsoft office\office14\mset7fr.kic to %ProgramFiles%\microsoft office\office14\8075ad4d904.b7d5cc
from %ProgramFiles%\microsoft office\office14\splashscreen.bmp to %ProgramFiles%\microsoft office\office14\splashscreen.bmp.b7d5cc
from %ProgramFiles%\microsoft office\office14\slerror.xml to %ProgramFiles%\microsoft office\office14\be5683a7740.b7d5cc
from %ProgramFiles%\microsoft office\office14\omml2mml.xsl to %ProgramFiles%\microsoft office\office14\3807fb4ab135.b7d5cc
from %ProgramFiles%\microsoft office\office14\samples\solvsamp.xls to %ProgramFiles%\microsoft office\office14\samples\7cfe6fd46b6f.b7d5cc
from %ProgramFiles%\microsoft office\office14\spanish.lng to %ProgramFiles%\microsoft office\office14\34b83afcfa5.b7d5cc
from %ProgramFiles%\microsoft office\office14\accessweb\rpt2htm4.xsl to %ProgramFiles%\microsoft office\office14\accessweb\912fd64f47fd.b7d5cc
from %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf to %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\c396bdd16cdc83ba727a1b9.b7d5cc
from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\c01c69b624d05.b7d5cc
from %ProgramFiles%\microsoft office\office14\3082\mso.acl to %ProgramFiles%\microsoft office\office14\3082\15d7f75.b7d5cc
from %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\icarosdescriptions.propdesc to %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\e62e55f342e600e4c612c61e5fa.b7d5cc
from %ProgramFiles%\microsoft office\office14\segoechess.ttf to %ProgramFiles%\microsoft office\office14\c12645620d2e5c.b7d5cc
from %ProgramFiles%\microsoft office\office14\ospp.vbs to %ProgramFiles%\microsoft office\office14\3520dc70.b7d5cc
from %ProgramFiles%\microsoft office\office14\oemprint.cat to %ProgramFiles%\microsoft office\office14\966c3934b4da.b7d5cc
from %ProgramFiles%\microsoft office\office14\ocrvc.dat to %ProgramFiles%\microsoft office\office14\257d441e6.b7d5cc
from %ProgramFiles%\microsoft office\office14\engdic.dat to %ProgramFiles%\microsoft office\office14\816228b53d.b7d5cc
from %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets to %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\d248ceac59781b30.b7d5cc
from %ProgramFiles%\microsoft office\office14\accessweb\servwrap.asp to %ProgramFiles%\microsoft office\office14\accessweb\b89d41055dc1.b7d5cc
from %ProgramFiles%\microsoft office\office14\accessweb\clntwrap.htm to %ProgramFiles%\microsoft office\office14\accessweb\c99df8d9239f.b7d5cc
from %ProgramFiles%\microsoft office\office14\1036\mso.acl to %ProgramFiles%\microsoft office\office14\1036\15128ac.b7d5cc
from %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll to %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\6657f96b4d7.b7d5cc
from %ProgramFiles(x86)%\winamp\lang\winamp-fr-fr.wlz to %ProgramFiles(x86)%\winamp\lang\cc382788713ab51a.b7d5cc
from %ProgramFiles(x86)%\winamp\lang\winamp-es-us.wlz to %ProgramFiles(x86)%\winamp\lang\c180d3ed179cbe5b.b7d5cc
from %ProgramFiles(x86)%\microsoft.net\redistlist\assemblylist_4_extended.xml to %ProgramFiles(x86)%\microsoft.net\redistlist\7001cdcce2fdf3f716149ae90a6.b7d5cc
from %ProgramFiles(x86)%\winamp\lang\winamp-de-de.wlz to %ProgramFiles(x86)%\winamp\lang\40f70af848a70128.b7d5cc
from %ProgramFiles(x86)%\google\chrome\application\visualelementsmanifest.xml to %ProgramFiles(x86)%\google\chrome\application\e26fc59ed3caa9319a9d1d9227.b7d5cc
from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\7d11f9b3b5dd7960abbb5f0e8b4cdabbc.b7d5cc
from %ProgramFiles%\microsoft office\office14\mset7en.kic to %ProgramFiles%\microsoft office\office14\a67326c670f.b7d5cc
from %ProgramFiles%\microsoft office\office14\mset7db.kic to %ProgramFiles%\microsoft office\office14\975171e7504.b7d5cc
from %ProgramFiles%\microsoft office\office14\mso0127.acl to %ProgramFiles%\microsoft office\office14\d4fad575a48.b7d5cc
from %ProgramFiles%\microsoft office\office14\pptirm.xml to %ProgramFiles%\microsoft office\office14\c9c15deff4.b7d5cc
from %ProgramFiles%\microsoft office\office14\outlfltr.dat to %ProgramFiles%\microsoft office\office14\e2f7226cbdbe.b7d5cc
from %ProgramFiles%\microsoft office\office14\olkirmv.xml to %ProgramFiles%\microsoft office\office14\d3401aad84b.b7d5cc
from %ProgramFiles%\microsoft office\office14\mspub.tlb to %ProgramFiles%\microsoft office\office14\3c216bb07.b7d5cc
from %ProgramFiles%\microsoft office\office14\rswop.icm to %ProgramFiles%\microsoft office\office14\1b301004a.b7d5cc
from %ProgramFiles%\microsoft office\office14\onenoteirm.xml to %ProgramFiles%\microsoft office\office14\13f72e7de7c6e8.b7d5cc
from %ProgramFiles%\microsoft office\office14\reminder.wav to %ProgramFiles%\microsoft office\office14\43d9198280f5.b7d5cc
from %ProgramFiles%\microsoft office\office14\pptirmv.xml to %ProgramFiles%\microsoft office\office14\dbf8939b7d5.b7d5cc
from %ProgramFiles%\microsoft office\office14\powerpnt.exe.manifest to %ProgramFiles%\microsoft office\office14\76af7ec5a92c9eb3c0b15.b7d5cc
from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\7999d90a256584ccae94.b7d5cc
from %ProgramFiles(x86)%\k-lite codec pack\unins000.dat to %ProgramFiles(x86)%\k-lite codec pack\b99af3f7e783.b7d5cc
from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\5207fbef06bb.b7d5cc
from %ProgramFiles(x86)%\mirc\readme.txt to %ProgramFiles(x86)%\mirc\c1ad7b8656.b7d5cc
from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\d3ebf95e.b7d5cc
from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\0ba18203b80a.b7d5cc
from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\3e994920b11.b7d5cc
from %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm to %ProgramFiles(x86)%\microsoft office\office14\1033\afa723faf083.b7d5cc
from %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\c20c06503a5d4a5a00.b7d5cc
from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\61d56430c0.b7d5cc
from %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\b380dc1ad70076d8db.b7d5cc
from %ProgramFiles%\foxit\foxit to %ProgramFiles%\foxit\8631f.b7d5cc
from %ProgramFiles(x86)%\winamp\whatsnew.txt to %ProgramFiles(x86)%\winamp\e6ac2d1b47cb.b7d5cc
from %ProgramFiles%\microsoft office\office14\mspub.exe.manifest to %ProgramFiles%\microsoft office\office14\c80a8ae5ef34fc29b7.b7d5cc
from %ProgramFiles%\microsoft office\office14\msppt.olb to %ProgramFiles%\microsoft office\office14\ff6f0da4b.b7d5cc
from %ProgramFiles%\microsoft office\office14\mscss7wre_fr.dub to %ProgramFiles%\microsoft office\office14\917ebe708251f824.b7d5cc
from %ProgramFiles%\microsoft office\office14\mscss7cm_en.dub to %ProgramFiles%\microsoft office\office14\57d8d57c8021a4f.b7d5cc
from %ProgramFiles%\microsoft office\office14\mscss7wre_es.dub to %ProgramFiles%\microsoft office\office14\9a5ba6933647edfc.b7d5cc
from %ProgramFiles%\microsoft office\office14\microsoft.office.businessdata.xml to %ProgramFiles%\microsoft office\office14\f436b4709202759c63e21e6189780d632.b7d5cc
from %ProgramFiles%\microsoft office\office14\mscss7cm_fr.dub to %ProgramFiles%\microsoft office\office14\fcf2f0920029d64.b7d5cc
from %ProgramFiles%\microsoft office\office14\msword.olb to %ProgramFiles%\microsoft office\office14\c98b2f5d75.b7d5cc
from %ProgramFiles%\microsoft office\office14\xocr3.psp to %ProgramFiles%\microsoft office\office14\7eb061992.b7d5cc
from %ProgramFiles%\microsoft office\office14\wordirmv.xml to %ProgramFiles%\microsoft office\office14\e33435a44f65.b7d5cc
from %ProgramFiles%\microsoft office\office14\subscription.xsd to %ProgramFiles%\microsoft office\office14\c16719478e60b2f3.b7d5cc
from %ProgramFiles%\microsoft office\office14\wordcnvpxy.cnv to %ProgramFiles%\microsoft office\office14\081e8d909e43c0.b7d5cc
from %ProgramFiles%\microsoft office\office14\exlirmv.xml to %ProgramFiles%\microsoft office\office14\f767994a652.b7d5cc
from %ProgramFiles%\microsoft office\office14\ospp.htm to %ProgramFiles%\microsoft office\office14\16de694b.b7d5cc
from %ProgramFiles%\microsoft office\office14\ocrhc.dat to %ProgramFiles%\microsoft office\office14\353605510.b7d5cc
from %ProgramFiles%\microsoft office\office14\french.lng to %ProgramFiles%\microsoft office\office14\22d85964ec.b7d5cc
from %ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.0\redistlist\frameworklist.xml to %ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.0\redistlist\35caafc1dea73c141.b7d5cc
from %ProgramFiles%\microsoft office\office14\olkirm.xml to %ProgramFiles%\microsoft office\office14\03a81b5303.b7d5cc
from %ProgramFiles%\microsoft office\office14\excel.exe.manifest to %ProgramFiles%\microsoft office\office14\c2ea7d455809e299c2.b7d5cc
from %ProgramFiles%\microsoft office\office14\bdcmetadataresource.xsd to %ProgramFiles%\microsoft office\office14\f26211ad6f91ca9475a0225.b7d5cc
from %ProgramFiles%\microsoft office\office14\bcsclientmanifest.man to %ProgramFiles%\microsoft office\office14\ffa329f20e8e7d4042ec6.b7d5cc
from %ProgramFiles%\microsoft office\office14\installed_schemas14.xss to %ProgramFiles%\microsoft office\office14\8497b26581239f15c3a4d52.b7d5cc
from %ProgramFiles%\microsoft office\office14\installed_resources14.xss to %ProgramFiles%\microsoft office\office14\7c45c8ab015de5c10e56bcd5c.b7d5cc
from %ProgramFiles%\microsoft office\office14\microsoft.office.businessapplications.runtime.xml to %ProgramFiles%\microsoft office\office14\af29e79425e1bd5f1680b40225e4e492ca63c4b2a92a14124.b7d5cc
from %ProgramFiles%\microsoft office\office14\lookup.dat to %ProgramFiles%\microsoft office\office14\6245dadee2.b7d5cc
from %ProgramFiles%\microsoft office\office14\microsoft.sharepoint.businessdata.administration.client.xml to %ProgramFiles%\microsoft office\office14\f67303826b1ac267362cde0e2780fd737f1bb5293956f57a1eac161e603.b7d5cc
from %ProgramFiles%\microsoft office\office14\microsoft.office.interop.infopath.semitrust.xml to %ProgramFiles%\microsoft office\office14\c2be62ce889e9de9e62febde1d4a5f751630040f638925f.b7d5cc
from %ProgramFiles%\microsoft office\office14\microsoft.office.interop.infopath.xml.xml to %ProgramFiles%\microsoft office\office14\9be616743f7354ba31ac6c8f6c135dd25f66ae56c.b7d5cc
from %ProgramFiles%\microsoft office\office14\mscss7wre_en.dub to %ProgramFiles%\microsoft office\office14\4c337e9be7f03799.b7d5cc
from %ProgramFiles%\microsoft office\office14\outlook.exe.manifest to %ProgramFiles%\microsoft office\office14\ac92c1a88d8d49e8531c.b7d5cc
from %ProgramFiles%\microsoft office\media\office14\1033\office10.mml to %ProgramFiles%\microsoft office\media\office14\1033\4026dd92436f.b7d5cc

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial