Submission Summary:

• Submission details:
• Submission received: 7 October 2009, 22:29:18
• Processing time: 5 min 47 sec
• Submitted sample:
• File MD5: 0x411BAA2C8CD20C6595022913363D41AD
• File SHA-1: 0x91402A27D6FA1FA07070F40D432D11924A34DD45
• Filesize: 61,440 bytes
• Alias:
• SecurityRisk.Downldr [Symantec]
• Trojan.Win32.VB.ghn [Kaspersky Lab]
• Generic.dx [McAfee]
• Mal/Generic-A [Sophos]
• Trojan:Win32/Provis!rts [Microsoft]
• Trojan.Win32.VB [Ikarus]
• Win-Trojan/Xema.variant [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A spyware program that represents security risk for a local system

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	61,440 bytes	MD5: 0x411BAA2C8CD20C6595022913363D41AD SHA-1: 0x91402A27D6FA1FA07070F40D432D11924A34DD45	SecurityRisk.Downldr [Symantec] Trojan.Win32.VB.ghn [Kaspersky Lab] Generic.dx [McAfee] Mal/Generic-A [Sophos] Trojan:Win32/Provis!rts [Microsoft] Trojan.Win32.VB [Ikarus] Win-Trojan/Xema.variant [AhnLab]

Memory Modifications

• There was a new process created in the system:

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China

• The following port was open in the system:

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URLs was then requested from the remote web server:
• http://i.nuseek.com/images/Themes/T101/bullets/0006.gif
• http://i.nuseek.com/images/misc/blank.gif
• http://i.nuseek.com/images/template/360x318/ist2_746781_female_student.jpg
• http://i.nuseek.com/Images/Shared/relLinkBkg.gif
• http://i.nuseek.com/images/Themes/T101/buttons/0006.gif
• http://53kkk.dydizhi.com/dydizhi.com.js
• http://53kkk.dydizhi.com/4e1ae39f-1d0a-4052-9646-01ecf7c79810.ippi?g=4e1ae39f-1d0a-4052-9646-01ecf7c79810
• http://js.revsci.net/gateway/gw.js?csid=F08747
• http://pix04.revsci.net/F08747/b3/0/3/0902050/310069187.js?D=DM_LOC%3Dhttp%253A%252F%252F53kkk.dydizhi.com%252F%26DM_EOM%3D1&C=F08747

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 80: