EXPL_PIDIEF.D

To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.

Malware Overview

This is the Trend Micro detection for an exploit code that takes advantage of the PDF Mailto vulnerability in Adobe Acrobat and Adobe Reader 8.1. The said vulnerability allows an arbitrary code to execute on an affected system. More information on the said vulnerability can be found on the following Web page:

• Adobe Security Advisory APSB07-18

This exploit code arrives as an attachment to email messages spammed by another malware or a malicious user. Once it successfully takes advantage of the abovementioned vulnerability, it connects to a certain FTP site to download and execute a malicious file. As a result, routines of the downloaded file are exhibited on the affected system.

However, as of this writing, the said FTP site is inaccessible.

This exploit code also executes a command line instruction to disable the Windows Firewall.

Related Items