Malware type: Trojan

Aliases: Trojan-Dropper.MSWord.1Table.dr (Kaspersky), Exploit-OleModule !! (McAfee), Trojan.Dropper (Symantec), EXP/MS03-37.Office.A (Avira), Exploit:Win32/Ponaml (Microsoft)

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 98, ME, NT, 2000, XP, Server 2003

Encrypted: No

Description: 

To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.

Malware Overview

This Trojan arrives on a system as a .DOC file dropped by other malware or downloaded by unsuspecting users when visiting malicious Web sites. It may also arrive as an attachment to a spammed email message.

When executed, it exploits the Windows Visual Basic vulnerability, which affects MS Office 2000 and XP. For more information regarding the said vulnerability, refer to the following Microsoft Web page:

Microsoft Security Bulletin MS06-047

Once it successfully exploits the mentioned vulnerability, this Trojan attempts to drop and execute a file which is detected by Trend Micro as BKDR_AGENT.DNX.

As a result, the routines of the dropped malware may also be exhibited on the affected machine.

For additional information about this threat, see:
Solution
Technical Details

Description created: Aug. 11, 2006 11:30:48 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.