ThreatExpert Report: Mal/Packer, Mal/EncPk-BW, Trojan-Downloader.Win32.Banload..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 10 November 2009, 13:10:29
Processing time: 8 min 11 sec
Submitted sample:

File MD5: 0x33A2FA062D5A0E73A87D465816453574
File SHA-1: 0xDA23B70E10F2FD17FA513AF98B484A6C1C5AEB34
Filesize: 79,382 bytes

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Programs%\Unlocker\README.lnk	682 bytes	MD5: 0xBFE2B12647592AB6837A1FB6EBE2AA73 SHA-1: 0x307EB95B5AB2669485139D1A563B46EDD98294F9	(not available)
2	%Programs%\Unlocker\Uninstall.lnk	507 bytes	MD5: 0x341B99BA3640736E376278F704FDB96D SHA-1: 0xE3AC9C7B6D7F5C1B340648991E8D8C33A44EBC37	(not available)
3	%Programs%\Unlocker\Website.lnk	694 bytes	MD5: 0x971B8DC3034516792EB2805065A1672C SHA-1: 0xE93508911E73B3C9F48F1244ECA4C6E7B6AF7C0B	(not available)
4	%ProgramFiles%\Unlocker\README.TXT	1,635 bytes	MD5: 0x30CC39F133910A442994838B5CBF5442 SHA-1: 0x11790F31C830619B8FAA81E8DE52E4FCDF0862FD	(not available)
5	%ProgramFiles%\Unlocker\uninst.exe	39,041 bytes	MD5: 0x387C4782455CD82CF1C2B6F3349EF6F0 SHA-1: 0x111BAB1B840DEBA0F11555B10101C0E39AC1AEFD	(not available)
6	%ProgramFiles%\Unlocker\Unlocker.exe	28,243 bytes	MD5: 0x3CF0CA8D7C3C6CB902DDB2D5FAA17681 SHA-1: 0x455CC151A5CF7136072D965B64ED5ED59092E18B	Mal/Packer, Mal/EncPk-BW [Sophos] Trojan-Downloader.Win32.Banload [Ikarus] Win-Trojan/Xema.variant [AhnLab] packed with UPack [Kaspersky Lab]
7	%ProgramFiles%\Unlocker\Unlocker.url	59 bytes	MD5: 0xD8843CE8A17012C12BA8FD35DE88379E SHA-1: 0xF11FD6407BAE44B19C37C4CE60EF3F094F8711CA	(not available)
8	%ProgramFiles%\Unlocker\UnlockerDriver4.sys	3,584 bytes	MD5: 0xF79BA52F6A1E65B674BEA4F6C86EBB05 SHA-1: 0x40981693086B8A05CC09ECCF46A8DD72002BC564	(not available)
9	[file and pathname of the sample #1]	79,382 bytes	MD5: 0x33A2FA062D5A0E73A87D465816453574 SHA-1: 0xDA23B70E10F2FD17FA513AF98B484A6C1C5AEB34	(not available)

Notes:

%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%Programs%\Unlocker
%ProgramFiles%\Unlocker

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\edit.Unlocker
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\edit.Unlocker\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\edit.Unlocker
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\edit.Unlocker\command
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Unlocker

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\edit.Unlocker\command]

(Default) = "%ProgramFiles%\Unlocker\Unlocker.exe "%L""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\edit.Unlocker]

(Default) = "Unlocker"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\edit.Unlocker\command]

(Default) = "%ProgramFiles%\Unlocker\Unlocker.exe "%L""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\edit.Unlocker]

(Default) = "Unlocker"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Unlocker]

DisplayName = "Unlocker 1.5.2"
UninstallString = "%ProgramFiles%\Unlocker\uninst.exe"
DisplayIcon = "%ProgramFiles%\Unlocker\Unlocker.exe"
DisplayVersion = "1.5.2"
URLInfoAbout = "http://ccollomb.free.fr/unlocker/"
Publisher = "Cedrick Collomb"

Other details

Analysis of the file resources indicate the following possible country of origin:

United Kingdom

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.