Trojan:W32/FakePDF

Trojan:W32/FakePDF is distributed via a PDF file attached to fraudulent spam email messages. The email is designed to appear to be from the DHL courier company, and contains authentic-looking delivery information:

Trojan:PDF/Agent.T spam email message

The email claims that the attached file is a notification for a failed delivery, a classic social engineering trick often used to lure users into downloading and running the attachment.

The PDF file attached to the email comes with an embedded, clickable link. If the user opens the PDF file and clicks the link, a webpage is opened, offering a ZIP file for download:

Trojan:PDF/Agent.T's malicious file offered for download

The ZIP file contains the malware; If the user downloads and opens the ZIP file, Trojan:W32/FakePDF infects the system.

On infection, the malware first injects code into the explorer.exe process to hide its own running process, then changes the registry to ensure it runs itself automatically at each system startup by modifying the following registry key:

• HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN

While the malware is running on the infected machine, it downloads other malicious files from a remote server into the following folder:

• C:\Documents and Settings\Administrator\Local Settings\Application Data

More

DHL itself has published an article on Fraud Awareness and Prevention related to misuse of the DHL brand in spam emails:

• DHL Global: Fraud Awareness and Prevention

Note

The details above were previously published using the detection name, Trojan.PDF.Agent.T. Following subsequent changes to the detection logic for this malware, the detection was issued a new name and this description was updated and renamed for greater clarity.