Submission Summary:

• Submission details:
• Submission received: 23 October 2012, 01:02:42
• Processing time: 13 min 31 sec
• Submitted sample:
• File MD5: 0x1D848227FBC61ADC3A8FA686E5F73D02
• File SHA-1: 0xD05DDDB7F6CBC7CE2F6BC96458E9A244D371F906
• Filesize: 51,612 bytes
• Alias:
• Mal/PWS-AL [Sophos]
• Trojan-PWS.OnlineGames [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%ProgramFiles%\Common Files\00017FAAce.dll	10,240 bytes	MD5: 0xF1F49FB85AB029AD86C02EBECB892B12 SHA-1: 0x664A602F8E843218C1158571714CD0ADEE1DA939	Infostealer [Symantec] PWS-Mmorpg!yy [McAfee] Troj/WoW-KL [Sophos] Trojan.Win32.Genome [Ikarus]
2	%ProgramFiles%\Common Files\whh07020.ocx	60,828 bytes	MD5: 0x82AA68741D70B26CF428EF8B682CE583 SHA-1: 0xE519CA894A77D85D0F4492F2D48BA6BD0B78CBAB	Mal_OLGM-6 [Trend Micro] Trojan-PWS.Win32.Kykymber [Ikarus]
3	[file and pathname of the sample #1]	51,612 bytes	MD5: 0x1D848227FBC61ADC3A8FA686E5F73D02 SHA-1: 0xD05DDDB7F6CBC7CE2F6BC96458E9A244D371F906	Mal/PWS-AL [Sophos] Trojan-PWS.OnlineGames [Ikarus]
4	%System%\whhfd028.ocx	14,336 bytes	MD5: 0x90EB3AA19541B367388FD5F79AE5D36C SHA-1: 0x7B80F7EA7A2DFE4BAF43D1940E6F5F29AF544427	Trojan.Gen [Symantec] Troj/Monkif-Fam [Sophos] Trojan.Win32.Agent [Ikarus]

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

• Notes:
• [generic host process filename] is a full path filename of [generic host process].

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
00017FAAce.dll	%ProgramFiles%\Common Files\00017FAAce.dll	Process name: svchost.exe Process filename: %System%\svchost.exe Address space: 0xB50000 - 0xD56000

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E0200804
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\E0200804

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E0200804]
• Ime File = "WHHFD028.OCX"
• Layout Text = "US"
• Layout File = "kbdus.dll"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\E0200804]
• Ime File = "WHHFD028.OCX"
• Layout Text = "US"
• Layout File = "kbdus.dll"
• [HKEY_CURRENT_USER\Keyboard Layout\Preload]
• 2 = "00000409"

• The following Registry Value was modified:
• [HKEY_CURRENT_USER\Keyboard Layout\Preload]
• 1 =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China

• To mark the presence in the system, the following Mutex objects were created:
• jahWOWI07020_rel_regamle_00000200_
• jahWOWI07020_rel_regamle_00000212_
• jahWOWI07020_rel_regamle_00000220_