Technical Information
Malicious functions:
Executes the following:
- '%TEMP%\GLJ2.tmp' <SYSTEM32>\shdocvw.dll
- '%TEMP%\GLJ2.tmp' <SYSTEM32>\MSINET.OCX
- '%TEMP%\GLJ2.tmp' <SYSTEM32>\mscomctl.ocx
Modifies file system:
Creates the following files:
- <SYSTEM32>\~GLH0007.TMP
- <SYSTEM32>\~GLH0008.TMP
- C:\DH\PEL2003\~GLH0005.TMP
- C:\DH\PEL2003\~GLH0006.TMP
- %ALLUSERSPROFILE%\Desktop\PEL 2003.lnk
- %TEMP%\RGI6.tmp
- <SYSTEM32>\~GLH0009.TMP
- %ALLUSERSPROFILE%\Start Menu\Programs\PEL 2003\PEL 2003.lnk
- %TEMP%\GLG4.tmp
- %TEMP%\~GLH0000.TMP
- %TEMP%\GLC1.tmp
- %TEMP%\GLJ2.tmp
- C:\DH\PEL2003\~GLH0003.TMP
- C:\DH\PEL2003\~GLH0004.TMP
- C:\DH\PEL2003\~GLH0001.TMP
- C:\DH\PEL2003\~GLH0002.TMP
Deletes the following files:
- %TEMP%\RGI6.tmp
- <SYSTEM32>\shdocvw.dll
Moves the following files:
- from C:\DH\PEL2003\~GLH0006.TMP to C:\DH\PEL2003\haciendabanner.jpeg
- from C:\DH\PEL2003\~GLH0005.TMP to C:\DH\PEL2003\haciendabannerEn.jpeg
- from <SYSTEM32>\~GLH0008.TMP to <SYSTEM32>\MSINET.OCX
- from <SYSTEM32>\~GLH0007.TMP to <SYSTEM32>\mscomctl.ocx
- from C:\DH\PEL2003\~GLH0004.TMP to C:\DH\PEL2003\USER_PDF.ceg
- from C:\DH\PEL2003\~GLH0001.TMP to C:\DH\PEL2003\PEL_WEB_BROWSER.EXE
- from %TEMP%\~GLH0000.TMP to %TEMP%\GLF5.tmp
- from C:\DH\PEL2003\~GLH0003.TMP to C:\DH\PEL2003\PDF_UPDATE_LOCAL.ceg
- from C:\DH\PEL2003\~GLH0002.TMP to C:\DH\PEL2003\Start.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
