Submission Summary:

• Submission details:
• Submission received: 18 November 2009, 23:46:41
• Processing time: 8 min 37 sec
• Submitted sample:
• File MD5: 0x29DE30A42D1D3AE29C5BE07893B25DB7
• File SHA-1: 0xA03E9CBFD6C838DFBAF07B586F4AAD5200F4E2C7
• Filesize: 134,144 bytes
• Alias:
• Trojan-Downloader.Win32.FraudLoad.wvtu [Kaspersky Lab]
• Trojan:Win32/FakeXPA [Microsoft]
• Trojan-Downloader.Win32.FraudLoad [Ikarus]
• Win-Trojan/Fakeav.134144 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of a rogue antispyware application that uses aggressive and deceptive advertising along with false reports of exaggerated system security threats to persuade users to download and purchase their product.
Attempts to use BITS (Background Intelligent Transfer Service). Some threats are known to use BITS to evade firewall filtering and download files without firewall inspection.
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonAppData%\Microsoft\Network\Downloader\qmgr0.dat	4,232 bytes	MD5: 0x885BAD9DB9D873C65F22C55879B1A51D SHA-1: 0x4CF2A4CBA4D8BCD39CDD11D31FAEE5559596B6AF	(not available)
2	%CommonAppData%\Microsoft\Network\Downloader\qmgr1.dat	5,126 bytes	MD5: 0xFD691008C5D9D820B5AC14F0601D1EA8 SHA-1: 0xC8527435BE0E72B14EA18F0B39C436C3944205FF	(not available)
3	%ProgramFiles%\CSec\cs.exe	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
4	[file and pathname of the sample #1]	134,144 bytes	MD5: 0x29DE30A42D1D3AE29C5BE07893B25DB7 SHA-1: 0xA03E9CBFD6C838DFBAF07B586F4AAD5200F4E2C7	Trojan-Downloader.Win32.FraudLoad.wvtu [Kaspersky Lab] Trojan:Win32/FakeXPA [Microsoft] Trojan-Downloader.Win32.FraudLoad [Ikarus] Win-Trojan/Fakeav.134144 [AhnLab]

• Notes:
• %CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

• The following directories were created:
• %CommonAppData%\Microsoft\Network\Downloader
• %ProgramFiles%\CSec

Memory Modifications

• There was a new process created in the system:

• The following system service was modified:

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\036572811B10AEE34F7A01871D13AA85

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\036572811B10AEE34F7A01871D13AA85]
• gwbrammuhmt = "CFJLIXFAh!!"
• jxawt = "I=vgu!!"
• dfdwt = "Gtbj:ovm>bF;?"
• owzxxrza = "BaJqF!!"
• usia = "EO?_VK;nJeofn!!"

Other details

• The following port was open in the system:

Heuristics Analysis

• Heuristically identified capability to use BITS (Background Intelligent Transfer Service) to schedule the following download task:
• http://windows-update3.com/download/timesroman.tif