Submission Summary:

• Submission details:
• Submission received: 22 June 2009, 02:13:44
• Processing time: 6 min 56 sec
• Submitted sample:
• File MD5: 0x4E2F538FA4DFE028C221EE7F020A05D4
• File SHA-1: 0x3A2055B22105B8DE4B384D7A1936AFAAFD7DF8C1
• Filesize: 34,828 bytes
• Alias & packer info:
• Worm.GetCodec [PCTools]
• Trojan.Brisv.A [Symantec]
• Worm.Win32.GetCodec.a [Kaspersky Lab]
• W32/GetCodec.a [McAfee]
• W32/GetCodec-A [Sophos]
• Worm.Win32.GetCodec [Ikarus]
• Win32/Getcodec.worm.86016 [AhnLab]
• packed with: PE_Patch.PECompact [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Worm.GetCodec	Worm.GetCodec spreads via the Windows Media audio and video files as it modifies these files to have Trojan-Downloader.WMA.GetCodec characteristic.

• Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	34,828 bytes	MD5: 0x4E2F538FA4DFE028C221EE7F020A05D4 SHA-1: 0x3A2055B22105B8DE4B384D7A1936AFAAFD7DF8C1	Worm.GetCodec [PCTools] Trojan.Brisv.A [Symantec] Worm.Win32.GetCodec.a [Kaspersky Lab] W32/GetCodec.a [McAfee] W32/GetCodec-A [Sophos] Worm.Win32.GetCodec [Ikarus] Win32/Getcodec.worm.86016 [AhnLab] packed with PE_Patch.PECompact [Kaspersky Lab]

• The following files were modified:
• %CommonDocuments%\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma
• %CommonDocuments%\My Music\Sample Music\New Stories (Highway Blues).wma

• Note:
• %CommonDocuments% is a variable that refers to the file system directory that contains documents that are common to all users. A typical paths is C:\Documents and Settings\All Users\Documents.

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Extensions
• HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Extensions\.mp3
• HKEY_CURRENT_USER\Software\Microsoft\PIMSRV

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Extensions\.mp3]
• Permissions = 0x00000021
• [HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences]
• URLAndExitCommandsEnabled = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\PIMSRV]
• prot = "%Windir%\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\."

Other details

• To mark the presence in the system, the following Mutex object was created:
• PIMSRV1