W32/Pidief.AC Trojan

 Information about the W32/Pidief.AC Trojan:

W32/Pidief.AC is a trojan. The trojan will infect Windows systems.

The trojan may be downloaded from the following remote site;

http://( BLOCKED) e-actions.com/secure.cgi?a452da750100f0700145c2a221060000000002ec1c684600010409000002c317

It is a specially crafted .PDF file that exploits a known vulnerability in Acrobat Reader 8.1.2 (DOS) or earlier versions. This vulnerability causes the application to crash and could potentially allow an attacker to take control of the affected system.

More information about the said vulnerability can be found at the following links:

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2641
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2641
http://www.auscert.org.au/render.html?it=9501

The trojan tries to access the following URL to download a file:

http://(BLOCKED)e-actions.com/secure.cgi?50d358ac0100f0600245c2a2210600000000021888b23300010409000002c31700 -

The downloaded file is saved as EYAL.EXE in the %Temp% folder.

It then executes the downloaded file. As a result, malicious routines of the downloaded files are exhibited on the affected system.

This trojan first appeared on June 26, 2008.

 Other names of W32/Pidief.AC Trojan:

This trojan is also known as TROJ_PIDIEF.AC.