Submission Summary:

• Submission details:
• Submission received: 25 November 2009, 08:48:41
• Processing time: 7 min 28 sec
• Submitted sample:
• File MD5: 0x0B5A2E6227C9879FB21F62EEC3223EED
• File SHA-1: 0x1EBD1B5E744D3FD60DB68FAB2AD5D4608ABC66BF
• Filesize: 38,912 bytes
• Alias & packer info:
• Net-Worm.Koobface [PCTools]
• W32.Koobface.D [Symantec]
• Net-Worm.Win32.Koobface.cma [Kaspersky Lab]
• Mal/KoobHeur-A [Sophos]
• Win32/Koobface.worm.38912.DD [AhnLab]
• packed with: PE_Patch.UPX [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\bk23567.dat	1 bytes	MD5: 0xC81E728D9D4C2F636F067F89CC14862C SHA-1: 0xDA4B9237BACCCDF19C0760CAB7AEC4A8359010B0	(not available)
2	%Windir%\dxxdv34567.bat	173 bytes	MD5: 0x472E0C337DEC6707E44CA359AD2355C3 SHA-1: 0x49CBE52F26DAC9D20F7D59D9DC8C6847DC33430F	(not available)
3	%Windir%\freddy75.exe [file and pathname of the sample #1]	38,912 bytes	MD5: 0x0B5A2E6227C9879FB21F62EEC3223EED SHA-1: 0x1EBD1B5E744D3FD60DB68FAB2AD5D4608ABC66BF	Net-Worm.Koobface [PCTools] W32.Koobface.D [Symantec] Net-Worm.Win32.Koobface.cma [Kaspersky Lab] Mal/KoobHeur-A [Sophos] Win32/Koobface.worm.38912.DD [AhnLab] packed with PE_Patch.UPX [Kaspersky Lab]

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There was a new process created in the system:

Process Name	Process Filename	Main Module Size
freddy75.exe	%Windir%\freddy75.exe	110,592 bytes

Registry Modifications

• The following Registry Keys were deleted:
• HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating
• HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Current
• HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Default

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• sysfbtray = "%Windir%\freddy75.exe"

so that freddy75.exe runs every time Windows starts

• The following Registry Values were deleted:
• [HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Default]
• (Default) = "%SystemRoot%\media\Windows XP Start.wav"
• [HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Current]
• (Default) = "%SystemRoot%\media\Windows XP Start.wav"
• [HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating]
• (Default) = ""

Other details

• The following port was open in the system:

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URLs was then requested from the remote web server:
• http://static.ak.fbcdn.net/rsrc.php/z12E0/hash/8q2anwu7.gif
• http://static.ak.fbcdn.net/rsrc.php/z1FDV/hash/74xjbsos.png
• http://static.ak.fbcdn.net/rsrc.php/z1005/hash/d8boxssd.js
• http://static.ak.fbcdn.net/rsrc.php/z7UN6/hash/dat7wch7.js
• http://static.ak.fbcdn.net/rsrc.php/zBEPC/hash/8g4fmwbu.js
• http://static.ak.fbcdn.net/rsrc.php/z37DG/hash/e5d2uja2.css
• http://b.static.ak.fbcdn.net/rsrc.php/z2UHZ/hash/8ziq169y.js
• http://b.static.ak.fbcdn.net/rsrc.php/zBS5C/hash/7hwy7at6.gif
• http://b.static.ak.fbcdn.net/rsrc.php/z6XUT/hash/bqmhyox3.jpg
• http://b.static.ak.fbcdn.net/rsrc.php/z9P6V/hash/1icttijq.jpg
• http://b.static.ak.fbcdn.net/rsrc.php/z81XI/hash/5yqqx3il.gif
• http://b.static.ak.fbcdn.net/rsrc.php/zDCY7/hash/1rnzs7ff.js
• http://b.static.ak.fbcdn.net/rsrc.php/zAM9U/hash/99rfwwrm.css
• http://b.static.ak.fbcdn.net/rsrc.php/z1BKM/hash/4z5fcbp1.js
• http://b.static.ak.fbcdn.net/rsrc.php/zBICQ/hash/ryfrvghz.css
• http://b.static.ak.fbcdn.net/rsrc.php/z7ER3/hash/7csvcwig.css
• http://armadasound.com/.sys/?action=fbgen&v=75
• http://www.facebook.com/rsrc.php/z8OGI/hash/41j5eq4v.png
• http://www.facebook.com/rsrc.php/z1Q24/hash/1v8g26vu.png
• http://www.facebook.com/
• http://facebook.com/
• http://collegestationbootcamp.com/.sys/?action=fbgen&v=75
• http://collegestationbootcamp.com/.sys/?action=fbgen&mode=s&age=13&a=13441600&v=75&ie=6.0.2900.2180
• http://www.google.com/