W32/Sality.L

Analysis

W32/Sality.L - 06-08-09

General Info:

This threat is a "PE" executable file

Virus Classification:

• File Infector

More Info:

1. Drops the following file and loads it:

	undefinedSYSTEMundefined\wmimgr32.dll (Fortinet detects it as "W32/Sality.L")

   It is the infection component of the virus.

2. Infects executable files located in the compromised machine. It uses the
   entry point obscuring (EPO) infection method. Once infection, it modifies
   the structure of its target files by replacing the first 104 bytes from the
   entry point section. It saves them within its code, and then it attaches
   the virus code to the last section of the target file.

3. Injects the DLL file "wmimgr32.dll" into running processes.