Submission Summary:

• Submission details:
• Submission received: 4 August 2012, 13:46:53
• Processing time: 10 min 25 sec
• Submitted sample:
• File MD5: 0x21913122A595CFDC2A1F55FCC93AF2ED
• File SHA-1: 0x1BF14A10AC356250E3E89109565C5C6449924F16
• Filesize: 277,928 bytes
• Alias:
• Trojan.ADH [Symantec]
• Trojan-Spy.Win32.Zbot.ekus [Kaspersky Lab]
• Generic Downloader.pi [McAfee]
• Trojan:Win32/Reveton.C [Microsoft]
• Trojan-Spy.Win32.Zbot [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonAppData%\1_ELPMAS.pad	4,503,728 bytes	MD5: 0x9CC960A897660F55848A70E05639B208 SHA-1: 0xC7D294AF134302A23656AB1CE9882393C6E3992E	(not available)
2	%Programs%\Startup\ctfmon.lnk	1,586 bytes	MD5: 0x4058DCB7D6F5EA396C469A65DA8AEDBF SHA-1: 0x9419B13981FAA387A0704C375667CB4A72A55E88	(not available)
3	[file and pathname of the sample #1]	277,928 bytes	MD5: 0x21913122A595CFDC2A1F55FCC93AF2ED SHA-1: 0x1BF14A10AC356250E3E89109565C5C6449924F16	Trojan.ADH [Symantec] Trojan-Spy.Win32.Zbot.ekus [Kaspersky Lab] Generic Downloader.pi [McAfee] Trojan:Win32/Reveton.C [Microsoft] Trojan-Spy.Win32.Zbot [Ikarus]

• Notes:
• %CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.
• %Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.

Memory Modifications

• There was a new process created in the system:

• Notes:
• [generic host process filename] is a full path filename of [generic host process].

• There was a new memory page created in the address space of the system process(es):

• The following modules were loaded into the address space of other process(es):

Registry Modifications

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
• NoProtectedModeBanner = 0x00000001
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 2500 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 2500 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 2500 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 2500 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 2500 = 0x00000003

• The following Registry Values were modified:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1609 =

Other details

• The following Host Name was requested from a host database:
• whatwillber.com

• There were registered attempts to establish connection with the remote hosts. The connection details are: