Threat behavior
Virus:Win32/Patchload.gen!A is a generic detection for a dynamic link library (DLL) file that is infected, or modified by other malware, to load other files that may already be present on the affected system. This malware may be associated with the trojan
PWS:Win32/OnLineGames.
Installation
Virus:Win32/Patchload.gen!A may be installed by other malware and may be present as a modified system DLL component such as "dsound.dll". The malicious code is appended to the last section of the modified file.
Payload
Loads other components
Upon execution of the infected file, the malware runs first and checks if it is running in a DLL process. If it is not, the malware returns control and continues execution of the host file.
Otherwise, the malware proceeds to look for the kernel base gets the address of another API ("LoadLibraryA") to load an arbitrary number of files whose names are hardcoded in the body of the virus. The following are examples of file names requested by the malware:
- TIM5560.DRV
- TIM49.DRV
- kb633.dat
- kb6E.dat
- kb62CB.dat
- mfc1.lOG
- mfc2F.log
- mfcD.lOG
- mfc12.lOG
- mfcDA.loG
Analysis by Gilou Tenebro
Prevention
