Submission Summary:

• Submission details:
• Submission received: 11 September 2012, 12:02:25
• Processing time: 8 min 3 sec
• Submitted sample:
• File MD5: 0x4338E8274EBC07E744F4A54DB0EE1B80
• File SHA-1: 0xEE0AB527EBF11E1DAF0CB68E56FF39357914D25D
• Filesize: 279,040 bytes
• Alias:
• TrojanDropper:Win32/Gamania.gen!A [Microsoft]
• Trojan-Dropper.Win32.Delfsnif [Ikarus]

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\$$c1.tmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
2	%Temp%\$$c1.tmp.bat	155 bytes	MD5: 0xC448736602DEE64ADECFB235CDD20659 SHA-1: 0x4EC93C58D34ABCC0828F1FDFF0954E63F4190DBB	(not available)
3	%ProgramFiles%\Windows NT\SERVICES.EXE [file and pathname of the sample #1]	279,040 bytes	MD5: 0x4338E8274EBC07E744F4A54DB0EE1B80 SHA-1: 0xEE0AB527EBF11E1DAF0CB68E56FF39357914D25D	TrojanDropper:Win32/Gamania.gen!A [Microsoft] Trojan-Dropper.Win32.Delfsnif [Ikarus]
4	%System%\ACE.dll	220,672 bytes	MD5: 0xB56BE9B1F867FD8E20AD3B442B68C636 SHA-1: 0x6C7824282FB80CF384DDF80EA8D927A340A96A77	Mal_Infostl [Trend Micro] Troj/Lineag-Gen [Sophos] PWS:Win32/Gamania.gen!B [Microsoft] Trojan-Dropper.Delf [Ikarus]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
SERVICES.EXE	%ProgramFiles%\windows nt\services.exe	N/A
[filename of the sample #1]	[file and pathname of the sample #1]	N/A

• There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
explorer.exe	%Windir%\explorer.exe	20,480 bytes

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
ACE.dll	%System%\ACE.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x1E10000 - 0x1E95000
ACE.dll	%System%\ACE.dll	Process name: msmsgs.exe Process filename: %ProgramFiles%\messenger\msmsgs.exe Address space: 0xD60000 - 0xDE5000
ACE.dll	%System%\ACE.dll	Process name: sdnsmain.exe Process filename: %Windir%\dns\sdnsmain.exe Address space: 0x1620000 - 0x16A5000
ACE.dll	%System%\ACE.dll	Process name: SERVICES.EXE Process filename: %ProgramFiles%\windows nt\services.exe Address space: 0xD90000 - 0xE15000

Registry Modifications

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Userinit =

Other details

• To mark the presence in the system, the following Mutex object was created:
• oleacc-msaa-loaded

• The following Host Name was requested from a host database:
• 192.5.5.241

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %System%\ACE.dll