TrojanDropper:Win32/Malf.gen

TrojanDropper:Win32/Malf.gen is a generic detection of malware that drops additional malicious files.

 

While malicious files detected as TrojanDropper:Win32/Malf.gen may vary in their specific behavior, an example of the actions of one such 'variant' that was observed in the wild can be seen below:

When executed, this trojan drops the file <system folder>\netmlc.dll, and creates a service to load this DLL. This service has the following characteristics:

Display name (one of the following):

Image path: <system folder>\svchost.exe –k netsvcs
Parameter: <system folder>\netmlc.dll

Note - <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP and Vista is C:\Windows\System32.  

 

The file, <system folder>\netmlc.dll, is detected as Backdoor:Win32/Ponadr.A by Microsoft AV solutions.

In mid-January 2008, Microsoft received reports from the wild that this specific example of TrojanDropper:Win32/Malf.gen was being installed in targeted attacks via the distribution of a specially crafted, malformed Excel file. The exploit code contained in the file (detected as Exploit:Win32/Exrec.gen) attempts to exploit a vulnerability in Microsoft Office Excel. Please see 'Microsoft Security Advisory (947563)- Vulnerability in Microsoft Excel Could Allow Remote Code Execution' for more information.