Submission Summary:

• Submission details:
• Submission received: 8 August 2009, 05:37:47
• Processing time: 11 min 20 sec
• Submitted sample:
• File MD5: 0x241C3F46C68E373B00B957F7329E4692
• File SHA-1: 0xD075453CA0FFF16A6F1E6EBD53CC936EA65E21D3
• Filesize: 16,384 bytes
• Alias & packer info:
• Net-Worm.Win32.Koobface.bgr [Kaspersky Lab]
• Mal/KoobHeur-A [Sophos]
• Worm.Win32.Koobface [Ikarus]
• packed with: PE_Patch.UPX [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\ld12.exe [file and pathname of the sample #1]	16,384 bytes	MD5: 0x241C3F46C68E373B00B957F7329E4692 SHA-1: 0xD075453CA0FFF16A6F1E6EBD53CC936EA65E21D3	Net-Worm.Win32.Koobface.bgr [Kaspersky Lab] Mal/KoobHeur-A [Sophos] Worm.Win32.Koobface [Ikarus] packed with PE_Patch.UPX [Kaspersky Lab]
2	%Windir%\prxid93ps.dat	247 bytes	MD5: 0xDB859F7CB14250550E63F8C3777D1201 SHA-1: 0xF2EB0AECEFC114D16ADE6AB1900031D379FBEB2B	(not available)
3	%Windir%\xdv34567.bat	167 bytes	MD5: 0x5D2F8D307E6DD9DB99D3B4C42DCA39E2 SHA-1: 0x989FDC62A699F4AF23F2865494AA0CAD3486E412	(not available)

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• sysldtray = "%Windir%\ld12.exe"

so that ld12.exe runs every time Windows starts