To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.


Malware Overview

This Trojan arrives as attachment to email messages spammed by another malware or a malicious user.

It is a specially crafted .PDF file that exploits a known vulnerability in Acrobat Reader 8.1.2 or earlier versions. This vulnerability allows a remote attacker to execute arbitrary code on the affected system. More information about the said vulnerability can be found at the following links:

• CVE-2008-2641 from NVD
• CVE-2008-2641 from CVE

After successfully exploiting the vulnerability, this .PDF file then attempts to access an FTP site to download and execute a file. However, due to incorrect password, it fails to perform this routine.



More...