Submission Summary:

• Submission details:
• Submission received: 11 January 2009, 20:58:38
• Processing time: 7 min 22 sec
• Submitted sample:
• File MD5: 0x01AEFD7CD0168B1589C4E567D9CFEB36
• File SHA-1: 0x602D343F0E483E42E573DD116A1B9AAD9201EEAF
• Filesize: 49,152 bytes
• Alias:
• Email-Worm.Rays [PCTools]
• W32.Wullik@mm [Symantec]
• Email-Worm.Win32.Rays.c [Kaspersky Lab]
• W32/Wukill.worm.gen [McAfee]
• WORM_WUKILL.GEN [Trend Micro]
• W32/Wukill-B [Sophos]
• Worm:Win32/Wukill.F@mm [Microsoft]
• Email-Worm.Win32.Rays [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Email-Worm.Rays	Email-Worm.Rays is an Internet worm that attempts email itself to contacts found in the Microsoft Outlook address book.
Worm.Wukill	Worm.Wukill is a mass mailing worm which attempts to send emails to contacts found in the address book of Microsoft Outlook.

• Attention! The following threat categories were identified:

Threat Category	Description
	An exploit code that takes advantage of an existing software vulnerability
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\comment.htt	697 bytes	MD5: 0xCFB9C3851AD603B65EBF42A4E3A50C70 SHA-1: 0x9B52E1E4DD1E4FDC1E4A2A1A1282C29C97302706	VBS.Traxg.A [PCTools] JS.Exception.Exploit [Symantec] Trojan.VBS.Starter.a [Kaspersky Lab] JS/Exploit-ActXComp [McAfee] VBS_STARTER.AT [Trend Micro] Troj/Starer-A [Sophos] Trojan.VBS.Starter.A [Ikarus]
2	c:\desktop.ini	72 bytes	MD5: 0x05A6B809A36F9D058A8E025967754F99 SHA-1: 0x015429C372F3D9417A12F3E489ADF4A07A02E2AE	(not available)
3	%Windir%\Mstray.exe [file and pathname of the sample #1]	49,152 bytes	MD5: 0x01AEFD7CD0168B1589C4E567D9CFEB36 SHA-1: 0x602D343F0E483E42E573DD116A1B9AAD9201EEAF	Email-Worm.Rays [PCTools] W32.Wullik@mm [Symantec] Email-Worm.Win32.Rays.c [Kaspersky Lab] W32/Wukill.worm.gen [McAfee] WORM_WUKILL.GEN [Trend Micro] W32/Wukill-B [Sophos] Worm:Win32/Wukill.F@mm [Microsoft] Email-Worm.Win32.Rays [Ikarus]

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
Mstray.exe	%Windir%\mstray.exe	53,248 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	53,248 bytes

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• RavTimeXP = "%Windir%\Mstray.exe"

so that Mstray.exe runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China