Trojan:Win32/Pirpi.A

Trojan:Win32/Pirpi.A may be downloaded by other malware such as Exploit:JS/CVE-2011-1345. It drops another malware, which is detected as Trojan:Win32/Pirpi.gen!A.

Payload

Drops other malware
Upon execution, it drops the following files:

• <startup folder>\ctfmon.exe - detected as Trojan:Win32/Pirpi.gen!A
• <system folder>\<DLL file>.dll (for example, irmonsrv.dll) - also detected as Trojan:Win32/Pirpi.gen!A

Note: <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.

Note: <startup folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the Startup folder for Windows 9x, Me, NT, 2000, XP and 2003 is '%USERPROFILE%\Start Menu\Programs\Startup'. For Windows Vista and 7, the default location is '%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'.

It registers the dropped DLL file as a service by creating the following registry keys and entries:

In subkey: HKLM\System\CurrentControlSet\Services\<DLL service> (for example, HKLM\System\CurrentControlSet\Services\Irmon
Sets value: "Description"
With data: "Supports infrared devices installed on the computer and detects other devices that are in range. If this service is stopped, protected content might not be down loaded to the device."

In subkey: HKLM\System\CurrentControlSet\Services\<DLL service>\Parameters (for example, HKLM\System\CurrentControlSet\Services\Irmon\Parameters
Sets value: "ServiceDll"
With data: "<system folder>\<DLL file>.dll" (for example, "<system folder>\irmonsrv.dll)

Analysis by Tim Liu