ThreatExpert Report: Trojan-Dropper.Win32.Delf.xo, Application.Active

Submission Summary:

Submission details:

Submission received: 31 December 2007, 21:47:06
Processing time: 3 min 27 sec
Submitted sample:

File MD5: 0x483098816F7A958F5BCD87F2C80FCFF1
Filesize: 1,582,520 bytes

Summary of the findings:

What's been found	Severity Level
Capability to send out email message(s) with the built-in SMTP client engine.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Application.Active_Keylogger	Active Keylogger captures keystrokesto hidden, encrypted log files. It can be run in stealth mode and has the ability to send the logs to predefined email addresses. We recommend removal of this product if not installed for a purpose.
Adware.Component.Unrelated	These common components have files and keys that are in different threats but the threats are not related to one another in that the author of the signature is not the same. It is recommended that all these entries be removed.

Attention! The following threat categories were identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%DesktopDir%\Personal PC Spy.lnk	707 bytes	MD5: 0xB619BBBE4A19F033BB18D78EFB18FC8C	(not available)
2	%Temp%\Personal.PC.Spy.v1.9.1-HERiTAGE\Personal.PC.Spy.v1.9 Crack.exe	705,024 bytes	MD5: 0x0F66BB358159BDFDAB2B65152F485C43	Trojan-Dropper.Win32.Delf.xo [Kaspersky Lab]
3	%Temp%\Personal.PC.Spy.v1.9.1-HERiTAGE\Personal.PC.Spy.v1.9.1-HERiTAGE.exe	1,003,008 bytes	MD5: 0x21AB1A7515E09B3AEF57F34E2E517EBA	Trojan-Dropper.Win32.Delf.xo [Kaspersky Lab]
4	%Temp%\Personal.PC.Spy.v1.9.1-HERiTAGE\Personal.PC.Spy.v1.9.1-HERiTAGE.sfv	214 bytes	MD5: 0xC3D8731A7F744E6F92DDD411EA1B1CE8	(not available)
5	%Programs%\Personal PC Spy\Personal PC Spy Help.lnk	719 bytes	MD5: 0xEA49DCD72AF253C46A0788330A24D321	(not available)
6	%Programs%\Personal PC Spy\Personal PC Spy License Agreement.lnk	736 bytes	MD5: 0xDB637749678914D540A28E1723226C95	(not available)
7	%Programs%\Personal PC Spy\Personal PC Spy.lnk	719 bytes	MD5: 0xB0F8930849B0B6E30B87000AEECE960B	(not available)
8	%Programs%\Personal PC Spy\Uninstall Personal PC Spy.lnk	748 bytes	MD5: 0xBE9803F65B48B09EE72CEF72C9503008	(not available)
9	%Programs%\Personal PC Spy\Visit the Official Personal PC Spy Website.lnk	913 bytes	MD5: 0xDF865F0A27E3EA35CB254D7D196C4A1A	(not available)
10	%ProgramFiles%\Personal PC Spy\alert.dat	268 bytes	MD5: 0x1009349D50640BB03941D960FA3C55E6	(not available)
11	%ProgramFiles%\Personal PC Spy\LICENSE.TXT	2,616 bytes	MD5: 0x53C68450B7426D50251E47DE1CEACB54	(not available)
12	%ProgramFiles%\Personal PC Spy\pmode.dll	29,696 bytes	MD5: 0x3388856F18FC7428C6F0840D048F3B77	Application.Active_Keylogger [PCTools] not-a-virus:Monitor.Win32.ActiveKeyLogger.24 [Kaspersky Lab]
13	%ProgramFiles%\Personal PC Spy\ppcs.chm	22,164 bytes	MD5: 0xE669D5D0043A9D1D4370FE00DC0743BB	(not available)
14	%ProgramFiles%\Personal PC Spy\ppcs.exe	557,772 bytes	MD5: 0xBCA30F86517F54485342C42A0FEDF925	not-a-virus:Monitor.Win32.InvisibleKeyLogger.19 [Kaspersky Lab]
15	%ProgramFiles%\Personal PC Spy\README.TXT	1,597 bytes	MD5: 0x9BFCB669A56A0EC590C5C85A4A3E86FB	(not available)
16	%ProgramFiles%\Personal PC Spy\Uninstall.exe	83,452 bytes	MD5: 0x49CBA8FA8A74FE5AC8F0BF5084209A70	(not available)
17	%ProgramFiles%\Personal PC Spy\Visit the Official Personal PC Spy Website.url	84 bytes	MD5: 0x7C19AECD9E5982C6E1FE0EC9AD425080	(not available)
18	%ProgramFiles%\Personal PC Spy\win16sys.dll	31,232 bytes	MD5: 0x6281A617C66B8801D81825317EE9263B	Backdoor.Graybird [Symantec] BackDoor-AWQ [McAfee]
19	%ProgramFiles%\Personal PC Spy\win32sys.dll	51,712 bytes	MD5: 0x309BE7F49FAE8E9CBE8DF7CF555FBC17	not-a-virus:Monitor.Win32.InvisibleKeyLogger.18 [Kaspersky Lab]
20	%ProgramFiles%\Personal PC Spy\Zipdll.dll	73,216 bytes	MD5: 0xD0E75A20A08F86991BF48674C02738E1	not-a-virus:Monitor.Win32.InvisibleKeyLogger.b [Kaspersky Lab]
21	%System%\exp16sys.dll	1 bytes	MD5: 0x9E688C58A5487B8EAF69C9E1005AD0BF	(not available)
22	[file and pathname of the sample #1]	1,582,520 bytes	MD5: 0x483098816F7A958F5BCD87F2C80FCFF1	(not available)
23	%Windir%\winlogon.exe	143,360 bytes	MD5: 0x7853580697BB0E3E4DE73635F72421AB	(not available)

Notes:

%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

The following directories were created:

%CommonAppData%\a32w
%CommonAppData%\ppc32w
%Temp%\Personal.PC.Spy.v1.9.1-HERiTAGE
%Programs%\Personal PC Spy
%ProgramFiles%\Personal PC Spy
%ProgramFiles%\Personal PC Spy\syslog

Notes:

%CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
~DP4.exe	%Temp%\~DP4.exe	217,088 bytes
Personal.PC.Spy.v1.9 Crack.exe	%Temp%\Personal.PC.Spy.v1.9.1-HERiTAGE\Personal.PC.Spy.v1.9 Crack.exe	733,184 bytes
Personal.PC.Spy.v1.9.1-HERiTAGE.exe	%Temp%\Personal.PC.Spy.v1.9.1-HERiTAGE\Personal.PC.Spy.v1.9.1-HERiTAGE.exe	1,032,192 bytes
~DP3.exe	%Temp%\~DP3.exe	376,832 bytes
~DP2.exe	%Temp%\~DP2.exe	376,832 bytes
winlogon.exe	%Windir%\winlogon.exe	376,832 bytes

Attention! The following process was intentionally hidden from the user:

Process Name	Main Module Size
ppcs.exe	3,780,608 bytes

The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
pmode.dll	%ProgramFiles%\Personal PC Spy\pmode.dll	Process name: dllhost.exe Process filename: %System%\dllhost.exe Address space: 0x2650000 - 0x2662000

Registry Modifications

The following Registry Key was created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Personal PC Spy

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

winlogon = "%Windir%\winlogon.exe"

so that winlogon.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Personal PC Spy]

DisplayName = "Personal PC Spy"
UninstallString = "%ProgramFiles%\Personal PC Spy\Uninstall.exe"
InstallLocation = "%ProgramFiles%\Personal PC Spy"
DisplayVersion = "1.9.1"
DisplayIcon = "%ProgramFiles%\Personal PC Spy\Personal PC Spy,0"
Publisher = "Personal PC Spy Software, INC"
HelpLink = "http://www.personalpcspy.com"
Contact = "support@personalpcspy.com"

[HKEY_CURRENT_USER\Control Panel\Colors]

WindowNumHWND = "30353930353930333730353930353130333730353630353830353830363113"

[HKEY_CURRENT_USER\Software\Classes]

MSKRTLR = D7 07 00 00 0B 00 00 00 13 00 00 00 14 00 00 00 3A 00 00 00 30 00 00 00

Other details

To mark the presence in the system, the following Mutex object was created:

aikeylogger

There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:

%ProgramFiles%\Personal PC Spy\pmode.dll

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.