Submission Summary:

• Submission details:
• Submission received: 25 November 2009, 15:00:12
• Processing time: 9 min 7 sec
• Submitted sample:
• File MD5: 0x1C436D1FFA4AEA8890EB613084834404
• File SHA-1: 0x9C2C39572DFB91BBE15FD466EBFA2AE0AA719D9B
• Filesize: 56,832 bytes
• Alias & packer info:
• Trojan.Vundo [Symantec]
• not-a-virus:AdWare.Win32.CashPlus.r [Kaspersky Lab]
• Generic PUP.x [McAfee]
• Mal/Generic-A [Sophos]
• not-a-virus:AdWare.Win32.CashPlus [Ikarus]
• Win-Trojan/Xema.variant [AhnLab]
• packed with: PE_Patch.UPX [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\026800_u.exe %Temp%\027143_u.exe [file and pathname of the sample #1]	56,832 bytes	MD5: 0x1C436D1FFA4AEA8890EB613084834404 SHA-1: 0x9C2C39572DFB91BBE15FD466EBFA2AE0AA719D9B	Trojan.Vundo [Symantec] not-a-virus:AdWare.Win32.CashPlus.r [Kaspersky Lab] Generic PUP.x [McAfee] Mal/Generic-A [Sophos] not-a-virus:AdWare.Win32.CashPlus [Ikarus] Win-Trojan/Xema.variant [AhnLab] packed with PE_Patch.UPX [Kaspersky Lab]
2	%System%\kbd101b.dll %Windir%\Temp\OLD10.tmp	6,144 bytes	MD5: 0x15CC5E30A8CFFFAC6056EC7CF2070187 SHA-1: 0x520BF2D27179B0FCC0CBD6C8A0070569AF8E84CF	(not available)
3	%System%\kbd101c.dll %Windir%\Temp\OLD14.tmp	6,144 bytes	MD5: 0xE1CB8EE6C0DC70E0DBCFA8D32C849E91 SHA-1: 0x85C76426A7D74B6D8216C9372355553AE0B3D41B	(not available)
4	%System%\kbd103.dll %Windir%\Temp\OLD18.tmp	5,632 bytes	MD5: 0x1AB5B6C627EBC61883EA311367F51130 SHA-1: 0x9C3B9EA1AA884B36EDDD588D7AE955F22709FB32	(not available)
5	%System%\kbd106.dll %Windir%\Temp\OLD1C.tmp	6,144 bytes	MD5: 0x5F5124D2FE8AE381E914C9147353D64C SHA-1: 0x5631295E512BDE2F18C8E0FD9DF9106F7B0C2E47	(not available)
6	%System%\kbdjpn.dll %Windir%\Temp\OLD20.tmp	8,704 bytes	MD5: 0x804B09FA1E3A86E729ABCCA7F30AE53C SHA-1: 0xFD7F04B8F2DDFF19C703FC852EF7701248C65159	(not available)
7	%System%\kbdkor.dll %Windir%\Temp\OLD24.tmp	8,192 bytes	MD5: 0x3244B59A0EB07E7B181F52D80D5E7385 SHA-1: 0x0E4A9EF72972142FA6211242C35CAADD131AF120	(not available)

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\International]
• W2KLpk = 0x00000001

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Republic of Korea

• There was registered attempt to establish connection with the remote host. The connection details are:

• The data identified by the following URL was then requested from the remote web server:
• http://www.smartpack.kr/sidebar/delnotice.php?pid=&uniq=&addresses=D