Submission Summary:

• Submission details:
• Submission received: 25 November 2008, 09:42:41
• Processing time: 6 min 47 sec
• Submitted sample:
• File MD5: 0x23E4CB553355ED7B7F7D17E9F2B7621D
• File SHA-1: 0x0F4F6434CF1AD49EE5CD47D390D4336F9881E515
• Filesize: 19,710 bytes

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Installs a default debugger that is injected into the execution sequence of a target application. If a threat is installed as a default debugger, it will be run every time a target application is attempted to be launched - either to mimic it and hide its own presence (e.g. an open port or a running process), or simply to be activated as often as possible.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-Dropper.Agent	Trojan-Dropper.Agent attempts to drop a malicious file and run it on the compromised computer.

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%Temp%\abrechnung.lnk	1,611 bytes	MD5: 0xEF6A096CDC56E7EB897630E56A634F78 SHA-1: 0x29E64D48296117407EB0A00C39A2042237C7CAB2
2	%ProgramFiles%\Microsoft Common\svchost.exe	26,112 bytes	MD5: 0xB2F27D1B598D46998EDA3A12DDFE140E SHA-1: 0xEE18628238725D3938C8810B8D019CFC8401ACA7
3	[file and pathname of the sample #1]	19,710 bytes	MD5: 0x23E4CB553355ED7B7F7D17E9F2B7621D SHA-1: 0x0F4F6434CF1AD49EE5CD47D390D4336F9881E515

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

• The following directories were created:
• %Temp%\scann
• %ProgramFiles%\Microsoft Common

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe]
• Debugger = "%ProgramFiles%\Microsoft Common\svchost.exe"

so that svchost.exe is injected into the execution sequence of explorer.exe by being installed as its default debugger

• [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
• ProxyEnable = 0x00000000

• The following Registry Value was modified:
• [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
• Cookies = "%System%\config\systemprofile\Cookies"
• Cache = "%System%\config\systemprofile\Local Settings\Temporary Internet Files"
• History = "%System%\config\systemprofile\Local Settings\History"

Other details

• The following Host Name was requested from a host database:
• www.microsoft.com

• The data identified by the following URLs was then requested from the remote web server:
• http://univnext.cn/ld.php?v=1&rs=13441600&n=1&uid=1
• http://cjusbciw123.com/ld.php?v=1&rs=13441600&n=1&uid=1