Submission Summary:

• Submission details:
• Submission received: 14 September 2012, 14:39:15
• Processing time: 8 min 20 sec
• Submitted sample:
• File MD5: 0x429F60B52F8C60C664A228BCCF835600
• File SHA-1: 0xCB013247CA23B672FA63488E0D972F23136FABF9
• Filesize: 467,653 bytes
• Alias & packer info:
• HackTool.Win32.Binder.bs [Kaspersky Lab]
• Mal/Packer [Sophos]
• Trojan.SuspectCRC [Ikarus]
• packed with: FSG [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system
	A hacktool that could be used by attackers to break into a system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\IMGRES.JPG	9,490 bytes	MD5: 0xC475CD569C44634D3FBE3D477E1653B4 SHA-1: 0x97FAC8957E05C9C39D274E6E456D3DBBA86624F5	(not available)
2	%Temp%\NICEPICS.EXE	675,840 bytes	MD5: 0x2D82218A9296CA3C91D402A21A7BF3C3 SHA-1: 0x1B8E7FE645C5058578B1060C1A33F315AA2DB8C2	Backdoor.Win32.Delf.aecw [Kaspersky Lab] Generic BackDoor.xa [McAfee] Mal/Behav-058 [Sophos] Backdoor:Win32/Fynloski.A [Microsoft] Trojan.Win32.CDur [Ikarus]
3	[file and pathname of the sample #1]	467,653 bytes	MD5: 0x429F60B52F8C60C664A228BCCF835600 SHA-1: 0xCB013247CA23B672FA63488E0D972F23136FABF9	HackTool.Win32.Binder.bs [Kaspersky Lab] Mal/Packer [Sophos] Trojan.SuspectCRC [Ikarus] packed with FSG [Kaspersky Lab]

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directory was created:
• %AppData%\dclogs

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

• There were new processes created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\DC3_FEXEC

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\DC3_FEXEC]
• 9/14/2012 at 2:41:01 PM = "{8eca90c0-39b7-11db-855f-806d6172696f-13441600}"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	France

• To mark the presence in the system, the following Mutex object was created:
• DC_MUTEX-G3SQ7N1

• The following Host Names were requested from a host database:
• 192.5.5.241
• yournameonhost.no-ip.biz

• There was registered attempt to establish connection with the remote host. The connection details are:

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %Temp%\nicepics.exe

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 1711: