I'm a little confused. He says that it's a phishing attack and not a virus, but isn't the eventual payload an executable that does lots of dark win32 magic? I kept expecting him to describe how it launches your browser to a fake bank login site. Just curious... did I miss something?
He thinks it's for replacing a bit of your browser and doing phishing that way, based entirely on the symbols the executable imports. So it's a guess, but a semi-educated one.
I'd be interested to know which steps of the packaging process were done automatically. Presumably these two could be automated in a straightforward fashion:
Embedding a script in a command via cmd /C ... & ... & ... (twice)
Generating a script and then running it (four times)
The call to isDebuggerPresent in the final payload executable would be about zero inconvenience to a malware analyst. The sophistication of the packing makes me think there are probably other antidebug techniques present.
