W32/BabyBear

Analysis

• Virus is 32bit with a size of 204,802 bytes, and was coded using Visual Basic 6 with a reliance on MSVBVM60.DLL
  
• If the virus is run, it may display a fake error message like this one -

  Program Error
  Application Error! Missing .Dll File
  [OK]
  

• Next the virus may display a grayscale artistic image of a mask and a title beneath of "Bugbear.B" and the text "From the Creators of BugBear"
  
• The virus may alter the registry to run at Windows startup from the path and file name that it was run -

  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
  CurrentVersion\Run\
  Microsoft Corporation = (path and file name)
  Msgmgr = (path and file name)
  

• The virus may create an icon in the system tray with the related name "Microsoft Corporation" - if user right-clicks on the icon it may cause the virus to run it's Windows shut down routine
  
• Virus creates over 200 folders and numerous files on the infected system -

  Folders added:
  c:\2Coding7
  c:\3Coding51
  c:\C2oding1
  c:\C4oding67
  c:\Cchoding74
  c:\cCoding55
  c:\cCoding67
  c:\Ccoding74
  c:\Ccodinllg74
  c:\cCodlling67
  c:\cCoduuing55
  c:\Cczhoding74
  c:\chCoding67
  c:\Cjroding466
  c:\Cnoding1
  c:\Co2ding2
  c:\Co4ding74
  c:\Cod2ing3
  c:\Codi2ng4
  c:\Codi3ng11
  c:\Codin2g5
  c:\Codin3g23
  c:\Codincg11
  c:\Codincg23
  c:\Codincgkk23
  c:\Codincguu11
  c:\Codinchg11
  c:\Codincyg23
  c:\Codinczyg23
  c:\Coding1
  c:\Coding11
  c:\Coding12
  c:\Coding142
  c:\Coding17
  c:\Coding2
  c:\Coding23
  c:\Coding23j
  c:\Coding26
  c:\Coding2c3
  c:\Coding2ch3
  c:\Coding3
  c:\Coding31
  c:\Coding331
  c:\Coding4
  c:\Coding411
  c:\Coding42
  c:\Coding432
  c:\Coding44
  c:\Coding44c
  c:\Coding44j
  c:\Coding466
  c:\Coding4c2
  c:\Coding4cy2
  c:\Coding4czy2
  c:\Coding4t4
  c:\Coding5
  c:\Coding51
  c:\Coding51c
  c:\Coding55
  c:\Coding55t
  c:\Coding5r1
  c:\Coding6
  c:\Coding67
  c:\Coding67r
  c:\Coding7
  c:\Coding74
  c:\Coding7n
  c:\Coding7xn
  c:\Codingc12
  c:\Codingc12uu
  c:\Codingc31
  c:\Codingc31kk
  c:\Codingch12
  c:\Codingcy31
  c:\Codingczy31
  c:\Codingd2
  c:\Codingd2yy
  c:\Codingf1
  c:\Codingn6
  c:\Codingr42
  c:\Codings3
  c:\Codings4
  c:\Codingsy4
  c:\Codingt23
  c:\Codingxn6
  c:\Codingys3
  c:\Codingyyf1
  c:\Codinkkcg11
  c:\Codinng4
  c:\Codinng5
  c:\Codinrg31
  c:\Codintg12
  c:\Codinxng5
  c:\Codinycg11
  c:\Codinygd2
  c:\Codinzg466
  c:\Codinzycg11
  c:\Codinzzg67r
  c:\Codirng23
  c:\Codirng2xx3
  c:\Coditng11
  c:\Codixnng4
  c:\Codiyngf1
  c:\Codiyyng17
  c:\Codizng55t
  c:\Codizngsy4
  c:\Codning3
  c:\Codring11
  c:\Codrinxxg11
  c:\Codsing5
  c:\Codsing5y
  c:\Codsing6
  c:\Codsinjjg6
  c:\Codsizng5y
  c:\Codsjjing5
  c:\Codxning3
  c:\Codzing4t4
  c:\Codzingys3
  c:\Codzzing5r1
  c:\Cojjdings4
  c:\Cojrding17
  c:\Collding51c
  c:\Conding2
  c:\Cording17
  c:\Cording1uu7
  c:\Couuding44c
  c:\Coxnding2
  c:\Coyyding466
  c:\Cozdingt23
  c:\Cozdinygd2
  c:\Croding466
  c:\Crodinuug466
  c:\Csoding7
  c:\Csoding7jj
  c:\Cysoding7
  c:\Cysodinzg7
  c:\czhCoding67
  c:\Czodintg12
  c:\Czodiyngf1
  c:\Czzodingr42
  c:\H2elp
  c:\hCoding51cy
  c:\hCoding51zcy
  c:\Hechlp8
  c:\Heclp8
  c:\Heczhlp8
  c:\Hel4p8
  c:\Heljrp1
  c:\Help
  c:\Help1
  c:\Help8
  c:\Helrp1
  c:\Helrp1uf
  c:\Heslp
  c:\Heyslp
  c:\Hezyslp
  c:\Hlueclp8
  c:\Htelp8
  c:\Htelpz8
  c:\Hyelp1
  c:\jcCoding55
  c:\jjCodings3
  c:\kkHeslp
  c:\llCoding4c2
  c:\Program Files\System
  c:\Program Files\System1
  c:\rHelp
  c:\tCoding17
  c:\tCoding74
  c:\tCodinzg17
  c:\tCodizngzz74
  c:\Th3e Sims
  c:\The 2Sims
  c:\The 4S1ims
  c:\The jr2Sims
  c:\The r2Sims
  c:\The rddaljflajflkjorjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj2Sims
  c:\The S1ims
  c:\The Sims
  c:\Thec S1ims
  c:\Thech S1ims
  c:\Theczzh S1ims
  c:\Thes Sims
  c:\Theuuc S1ims
  c:\Theys Sims
  c:\Thezys Sims
  c:\Thkes Sims
  c:\Thte S1ims
  c:\Thte Sz1ims
  c:\Thye 2Sims
  c:\Thye 2Szims
  c:\Thyye 2Sims
  c:\Trhe Sims
  c:\Trxxhe Sims
  c:\uuCoding2c3
  c:\WINDOWS\wudnld20.tmp
  c:\xxrHelp
  c:\yCodsing6
  c:\yCodsizng6
  c:\yyCoding55
  c:\yyHelp1
  c:\zCodinrg31
  c:\zCoditng1z1

  Files added:
  c:\Attachment.exe
  c:\Wscript.exe
  c:\WINDOWS\Start Menu\Programs\StartUp\Microsoft® Corporation.exe
  c:\jNotepad.exe
  c:\kNotepad.exe
  c:\lNotepad.exe
  c:\Njotepad.exe
  c:\Nkotepad.exe
  c:\Nlotepad.exe
  c:\Nojtepad.exe
  c:\Noktepad.exe
  c:\Noltepad.exe
  c:\Noqtepad.exe
  c:\Nortepad.exe
  c:\Notejpad.exe
  c:\Notekpad.exe
  c:\Notelpad.exe
  c:\Notepad.exe
  c:\Notepadj.exe
  c:\Notepadk.exe
  c:\Notepadl.exe
  c:\NotepadQ.exe
  c:\NotepadW.exe
  c:\Notepajd.exe
  c:\Notepakd.exe
  c:\Notepald.exe
  c:\NotepaQd.exe
  c:\NotepaWd.exe
  c:\Notepjad.exe
  c:\Notepkad.exe
  c:\Noteplad.exe
  c:\NotepQad.exe
  c:\NotepWad.exe
  c:\NoteQpad.exe
  c:\NoteWpad.exe
  c:\Notjepad.exe
  c:\Notkepad.exe
  c:\Notlepad.exe
  c:\NotQepad.exe
  c:\Notrepad.exe
  c:\NotWepad.exe
  c:\NoWtepad.exe
  c:\Nqotepad.exe
  c:\Nrotepad.exe
  c:\NWotepad.exe
  c:\qNotepad.exe
  c:\rNotepad.exe
  c:\WNotepad.exe
  c:\WINDOWS\fNotrepad.exe
  c:\WINDOWS\Notrefpad.exe
  c:\WINDOWS\Notrepad.erxe
  c:\WINDOWS\Notrepad.exe
  c:\WINDOWS\Notrepad.exef
  c:\WINDOWS\Notrepadg.exe
  c:\WINDOWS\Notrepadr.exe
  c:\WINDOWS\Notrepagd.exe
  c:\WINDOWS\Notrepajd.exe
  c:\WINDOWS\Notrepard.exe
  c:\WINDOWS\Notrepatd.exe
  c:\WINDOWS\Notrerpad.exe
  c:\WINDOWS\Notretpad.exe
  c:\WINDOWS\SYSTEM\Microsoft.ini
  c:\WINDOWS\SYSTEM\Ngotrepad.exe
  c:\WINDOWS\SYSTEM\Nhotrepad.exe
  c:\WINDOWS\SYSTEM\Nodtrepad.exe
  c:\WINDOWS\SYSTEM\Nogtrepad.exe
  c:\WINDOWS\SYSTEM\Notrepad.exe
  c:\WINDOWS\SYSTEM\Notrepdad.exe
  c:\WINDOWS\SYSTEM\Notrtepad.exe
  c:\WINDOWS\SYSTEM\Noturepad.exe
  c:\WINDOWS\SYSTEM\Nrotrepad.exe
  c:\WINDOWS\SYSTEM\Ntotrepad.exe
  

• Virus replaces existing files with a copy of itself -

  c:\WINDOWS\DEFRAG.EXE
  c:\WINDOWS\WELCOME.EXE
  

• Virus may send itself via the MAPI application Outlook in this format -

  Subject: Please Confirm
  Body:
  Dear Sir or Madame, We have detected that you have placed a Order for Msn8. Before we start your Service please confirm your order. To confirm your order please check the attachement. Thanks, Microsoft Corporation Support
  Attachment: (infected binary)