Submission Summary:

• Submission details:
• Submission received: 7 December 2011, 19:43:35
• Processing time: 11 min 58 sec
• Submitted sample:
• File MD5: 0x0950B1BBAD43981813E0060B92D705BB
• File SHA-1: 0x23088672C618A19992C5DE2109275E1E1EA14276
• Filesize: 1,093,922 bytes
• Alias:
• Packed.Protexor!gen1 [Symantec]
• Packed.Win32.Krap.ar [Kaspersky Lab]
• Trojan.Win32.FakeAV [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\bRLVaSmV.exe %Temp%\bSAUQRHw.exe %Temp%\buDOGqDh.exe %Temp%\ButoaUKA.exe %Temp%\bXaEpjZC.exe %Temp%\bZkMkFYE.exe %Temp%\cBAHcpKM.exe %Temp%\CBHrgDFT.exe %Temp%\cebSoWod.exe %Temp%\cisTvnNL.exe %Temp%\CkGIxIJT.exe %Temp%\clSnSINy.exe %Temp%\cOuCpbMm.exe %Temp%\cROtjsYK.exe %Temp%\CUVxPYyN.exe %Temp%\cVxMiSfc.exe %Temp%\cXJMVkch.exe %Temp%\CxmYtphU.exe %Temp%\CyecKmlG.exe %Temp%\DfBjYUap.exe %Programs%\Startup\maswtjoy.exe %ProgramFiles%\nrIqvPyK�[��maswtjoy.exe\maswtjoy.exe	66,574 bytes	MD5: 0x32B6D74310C5BA3AB9B219432C54E58B SHA-1: 0x5A00B970B9B9539A5CE62E1C5F9BAD405F465928	Packed.Protexor!gen1 [Symantec] Packed.Win32.Krap.ar [Kaspersky Lab] PWS-Zbot.gen.di [McAfee] Troj/Krap-U [Sophos] Trojan.Win32.FakeAV [Ikarus] Win-Trojan/Zbot.66574 [AhnLab]
2	%ProgramFiles%\Internet Explorer\dmlconf.dat	16 bytes	MD5: 0xE1DE9DE164271B0E9BA9DA5D31E0B0E7 SHA-1: 0xEDAE3E440046A43D59AF955A98D0C7E3227302F9	(not available)
3	[file and pathname of the sample #1]	1,093,922 bytes	MD5: 0x0950B1BBAD43981813E0060B92D705BB SHA-1: 0x23088672C618A19992C5DE2109275E1E1EA14276	Packed.Protexor!gen1 [Symantec] Packed.Win32.Krap.ar [Kaspersky Lab] Trojan.Win32.FakeAV [Ikarus]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

• The following directory was created:
• %ProgramFiles%\nrIqvPyK�[��maswtjoy.exe

Memory Modifications

• There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
services.exe	%System%\services.exe	36,864 bytes
lsass.exe	%System%\lsass.exe	36,864 bytes
svchost.exe	%System%\svchost.exe	36,864 bytes
svchost.exe	%System%\svchost.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	36,864 bytes

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Userinit =

Other details

• Analysis of the file resources indicate the following possible countries of origin:

	Hungary
	Brazil

• There were registered attempts to establish connection with the remote hosts. The connection details are:

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 443: