Submission Summary:

• Submission details:
• Submission received: 26 June 2012, 01:01:48
• Processing time: 11 min 27 sec
• Submitted sample:
• File MD5: 0x4D4847D032F7E319E6997FAC25B05205
• File SHA-1: 0xF2FCF9C8BB6E2C4CE4CD26E1330252C2955865C5
• Filesize: 279,736 bytes
• Alias:
• PWS-Banker.gen.ad [McAfee]
• Troj/AutoIt-PQ [Sophos]
• Worm.Win32.AutoIt [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Programs%\Startup\mmsn.exe %Programs%\Startup\?.exe	125 bytes	MD5: 0x7C5F5A68051F6B0C0E9A2AD33C40D415 SHA-1: 0x120865765927A61AF83F02B83DC297EEDE61EC41	(not available)
2	[file and pathname of the sample #1]	279,736 bytes	MD5: 0x4D4847D032F7E319E6997FAC25B05205 SHA-1: 0xF2FCF9C8BB6E2C4CE4CD26E1330252C2955865C5	Trojan-Downloader.Win32.AutoIt.tk [Kaspersky Lab] PWS-Banker.gen.ad [McAfee] Troj/AutoIt-PQ [Sophos] Worm.Win32.AutoIt [Ikarus] packed with UPX [Kaspersky Lab]

• Note:
• %Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.

Memory Modifications

• There was a new process created in the system:

Other details

• Analysis of the file resources indicate the following possible country of origin:

	United Kingdom

• The following Internet Connection was established:

• The following GET requests were made:
• yahoo.exe
• mmsn.exe