TROJ_CVE20170263.GQA

This Trojan arrives as an attachment to email messages mass-mailed by other malware/grayware or malicious users.

It takes advantage of software vulnerabilities in certain software to drop malicious files.

Arrival Details

This Trojan arrives as an attachment to email messages mass-mailed by other malware/grayware or malicious users.

Dropping Routine

This Trojan drops the following files:

• %User Temp%\{random numbers}.cvr
• %User Temp%\{random numbers}.od
• %Temporary Internet Files%\Content.MSO\{random value}.eps

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.. %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista and 7, or C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8.)

It takes advantage of unknown vulnerabilities in the following software to drop malicious files:

• CVE-2017-0263

Other Details

This Trojan does the following:

• It displays information while it executes an embedded Encapsulated PostScript Object that exhibits malicious activities.