Trojan-Dropper:W97M/Kukudro is a trojan-dropper embedded in the macro code of a Microsoft Word document.
Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.
Find the latest advice in our Community Knowledge Base.
See the manual for your F-Secure product on the Help Center.
Submit a file or URL for further analysis.
This malware was first spammed to various emails addresses, as zip archive file named my_Notebook.doc. Once a user opens the document, it drops and runs a binary executable. Later distributions runs may use varying names for the infected document.
The trojan-dropper is written in Visual Basic for Applications (VBA).
When the infected Word document is opened, the macro code inside of it will be executed. It will decode a binary file from its code and drop it as 666inse_1.exe to the root of the C: drive. The macro will then execute the dropped 666inse_1.exe file and end.
The binary executable is a trojan-downloader called Small.DCU.
In Office 2003 or later, the macro will only execute if macros have been enabled from Word's security settings.Otherwise, the trojan uses a vulnerability in MS Word 97, 2000 and XP; in this case, the macro will be able to execute even though macros are supposed to be disabled.
More information on this vulnerability is available at: https://www.microsoft.com/technet/security/Bulletin/MS01-034.mspx.