TROJ_PIDIEF

This description is based is a compiled analysis of several variants of TROJ_PIDIEF. Note that specific data such as file names and registry values may vary for each variant.

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following non-malicious files:

• %User Temp%\{malware file name}.pdf
• {malware path}\{random characters}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

NOTES:

This malware family is known to take advantage of software vulnerabilities, particularly vulnerabilities found in certain versions of Adobe programs. Once a variant successfully exploits a vulnerability, the variant usually drops another malware onto the affected system.

The dropped malware are then executed on the affected system. This routine ensures that the behavior of the dropped malware is exhibited on the affected system.

This description is based is a compiled analysis of several variants of TROJ_PIDIEF. Note that specific data such as file names and registry values may vary for each variant.