Threat Description

Icabdi.A

Details

Aliases:Icabdi.A, Trojan-Dropper.Win32.Agent.akc
Category:Malware
Type:Trojan
Platform:W32, JS

Summary



Icabdi.A is a proof-of-concept virus that infects Microsoft InfoPath 2003 .xsn files. When run the virus executable searches for local .xsn files, modifies them by attempting to inject malicious script, and then attempts to rebuild the .xsn file so that its tracks are covered. The .xsn file then sits in wait for a user to access the file and launch the malicious script.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.



Technical Details



The virus arrives as an executable (.exe) file.When the W32.Icabdi.A file is executed it first searches for .xsn files within the same directory.

For each .xsn file that it finds the virus will then extract the file contents into a temporarily created directory named "iCab". The .xsn file type is a kind of cabinet (cab) file that contains additional parts and files.

The virus then searches the extracted files for "script.js" and attempts to insert its own script into the file. Once the script is inserted, the virus then attempts to rebuild the cabinet files as a .xsn and puts it back into place where it was found, replacing the original file.

When the inserted script is run:It uses ActiveX to create an file named "iCab.txt". This file is used to rebuild the iCab.exe file.It next creates a random number the result of which will generate one of ten messages that will apear on the user's screen. See the image below for an example:

The messages include:

"Fighting for peace is like f**king for virginity!"
"Freedom is just another word for nothing left to lose! 
- (Me And Bobby McGee by Janis Joplin)"
"I do not know with what weapons World War III will be fought, 
but World War IV will be fought with sticks and stones. (by Albert Einstein)"
"I'm not a prisoner - I'm a FREE man! - (The Prisoner by Iron Maiden)"
"No Gods, No Masters - Against all Authority: ANARCHISM!"
"Our Word is Our Weapon. - (by Subcomandante Marcos)"
"Sometime they will give a war and nobody will come! - (by Carl Sandberg)"
"The easiest way to gain control of the population is to carry out acts of terror 
the public will clamor for such laws if the personal security is threatened. - (by Joseph Stalin)"
"This proof-of-concept Infopath virus has been done by [Second Part To Hell]"

and includes links to the virus writer's web page(s)

Inside of the script used there is also an additional message that will not be shown:

"Imagine all the people living life in PEACE! 
- (Imagine by John Lennon)"

The rebuilt "iCab.exe" file is located to the C: drive and the script then checks for itself so as to avoid a loop of reinfection.



Detection


Icabdi.A is detected with the following F-Secure Anti-Virus updates:
Detection Type: PC
Database: 2006-03-06_01



Description Created: Sean Sullivan
Technical Details: Jarkko Turkulainen, Katrin Tocheva, March 6, 2006
Description Last Modified: Sean Sullivan, March 9, 2006


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Learn More

Disinfect your PC

F-Secure Anti-Virus will disinfect your PC and remove all harmful files

Learn More