Home > Threat descriptions >

Trojan-Dropper:W97M/Kukudro.A

Classification

Category: Malware

Type: Trojan-Dropper

Platform: W97M

Aliases: W97M/Kukudro, W97M.Kukudro, Trojan-Dropper:W97M/Kukudro.A

Summary


Trojan-Dropper:W97M/Kukudro is a trojan-dropper embedded in the macro code of a Microsoft Word document.

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


This malware was first spammed to various emails addresses, as zip archive file named my_Notebook.doc. Once a user opens the document, it drops and runs a binary executable. Later distributions runs may use varying names for the infected document.

The trojan-dropper is written in Visual Basic for Applications (VBA).

Execution

When the infected Word document is opened, the macro code inside of it will be executed. It will decode a binary file from its code and drop it as 666inse_1.exe to the root of the C: drive. The macro will then execute the dropped 666inse_1.exe file and end.

The binary executable is a trojan-downloader called Small.DCU.

Note

In Office 2003 or later, the macro will only execute if macros have been enabled from Word's security settings.Otherwise, the trojan uses a vulnerability in MS Word 97, 2000 and XP; in this case, the macro will be able to execute even though macros are supposed to be disabled.

More information on this vulnerability is available at: https://www.microsoft.com/technet/security/Bulletin/MS01-034.mspx.