Case 3:17-cv-05659-WHA Document 96-20 Filed 06/07/18 Page 1 of 2
`Case 3:17-cv-05659-WHA Document 96-20 Filed 06/07/18 Page 1 of 2
`
`EXHIBIT 16
`EXHIBIT 16
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`

`

`Case 3:17-cv-05659-WHA Document 96-20 Filed 06/07/18 Page 2 of 2
`
`
`
`
`
`Trojan.Dropper
`
`Discovered: February 02, 2002
`Updated: April 26, 2012 10:26:24 PM
`Type: Trojan
`Infection Length: Varies
`Systems Affected: Windows
`
`
`SUMMARY
`Trojan.Dropper is a detection name used by Symantec to identify malicious software programs that drop other
`malware files onto the compromised computer.
`
` Trojan.Dropper is a type of Trojan whose purpose is to deliver an enclosed payload onto a destination host
`computer. A dropper is a means to an end rather than the end itself. In other words, the dropper is usually used
`at the start or in the early stages of a malware attack.
`
`Once a dropper is executed, its own code is simply to load itself into memory and then extract the malware
`payload and write it to the file system. It may perform any installation procedures and execute the newly dropped
`malware. The dropper usually ceases to execute at this point as its primary function has been accomplished.
`
`Droppers are used by malware creators to disguise their malware. They create confusion amongst users by
`making them look like legitimate applications or well known and trusted files.
`
`
` A
`
`
`
`
`They may also perform actions that mislead the user into thinking that nothing untoward is happening on the
`computer when in fact the Trojan may have already dropped and executed other malicious software.
`
`If a Symantec antivirus product displays a detection alert for this threat, it means the computer is already
`protected against this threat and the Symantec product will effectively remove this threat from the computer.
`Antivirus Protection Dates
`Initial Rapid Release version February 02, 2000
`Latest Rapid Release version June 06, 2018 revision 016
`Initial Daily Certified version February 02, 2000
`Latest Daily Certified version June 06, 2018 revision 008
`Initial Weekly Certified release date February 02, 2000
`
`Writeup By: Hon Lau
`
`
`TECHNICAL DESCRIPTION
`Trojan.Dropper is a detection name used by Symantec to identify malicious software programs that drop other
`malware files onto the compromised computer.
`
`
`Background information
`A Trojan.Dropper is a type of Trojan whose purpose is to deliver an enclosed payload onto a destination host
`computer. A dropper is a means to an end rather than the end itself. In other words, the dropper is usually used
`at the start or in the early stages of a malware attack.
`
`Throughout the history of malicious software, the creators of malware have always looked for ways to bypass
`
`1/4
`
`