Submission Summary:

• Submission details:
• Submission received: 22 September 2009, 13:55:38
• Processing time: 8 min 44 sec
• Submitted sample:
• File MD5: 0x32CF690AD88DB51FCD2463B99846CBB6
• File SHA-1: 0x3F3F477A3294DF9A3CBBF3E94688AC880D4ADF90
• Filesize: 438,664 bytes
• Alias:
• Trojan Horse [Symantec]
• DoS.Win32.LOIC.a [Kaspersky Lab]
• Generic.dx [McAfee]
• DoS.Win32.LOIC [Ikarus]
• Win-Trojan/Xema.variant [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan.Delf!ct	Trojan.Delf!ct

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Microsoft\Crypto\RSA\S-1-5-21-606747145-764733703-839522115-1003\55657e500425873367e5d8e1f88c1f80_a7bcc1a4-f7a4-4502-8650-8579e607f7f7	1,310 bytes	MD5: 0x5A6E0CBC660C966062B34AB638EDF74D SHA-1: 0x03FB90FBFBCF580482C0D8316D418F5A7CFDBE73	(not available)
2	%AppData%\Microsoft\Crypto\RSA\S-1-5-21-606747145-764733703-839522115-1003\f768e6d44b2d5767795a89fa5afb5bf1_a7bcc1a4-f7a4-4502-8650-8579e607f7f7	1,310 bytes	MD5: 0x23ED163DE608F684C838FCFF545311D9 SHA-1: 0x39FE895DA1347B2EB0394068057CC4CB78291E19	(not available)
3	[file and pathname of the sample #1]	438,664 bytes	MD5: 0x32CF690AD88DB51FCD2463B99846CBB6 SHA-1: 0x3F3F477A3294DF9A3CBBF3E94688AC880D4ADF90	Trojan Horse [Symantec] DoS.Win32.LOIC.a [Kaspersky Lab] Generic.dx [McAfee] DoS.Win32.LOIC [Ikarus] Win-Trojan/Xema.variant [AhnLab]

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

• The following directory was created:
• %System%\tmp

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Germany

• The following Host Names were requested from a host database:
• wpad.mrc.pctools.com.
• tox.awardspace.us
• www.praetox.com

• The following GET request was made:
• wpad.dat

• The following HTTP URLs were started reading:
• http://tox.awardspace.us/div/LOIC_version.php?cv=1.0.0.0
• http://www.praetox.com/inf/LOIC_link.html
• http://tox.awardspace.us/div/LOIC_dl.php%