Submission Summary:

• Submission details:
• Submission received: 17 June 2009, 19:13:20
• Processing time: 5 min 47 sec
• Submitted sample:
• File MD5: 0x526D3AA0940EAB964EB179892D7F56C6
• File SHA-1: 0x2C2FCDD4ACB2E2702856A037E18B25DC52C1F47C
• Filesize: 125,440 bytes
• Alias:
• Rootkit.Podnuha!sd6 [PCTools]
• Trojan Horse [Symantec]
• Rootkit.Win32.Podnuha.bzh [Kaspersky Lab]
• Generic Dropper [McAfee]
• Mal/Dropper-AC [Sophos]
• Trojan-Dropper.Win32.Boaxxe [Ikarus]
• Win-Trojan/Podnuha.125440.AB [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Rootkit.Podnuha!sd6	Rootkit.Podnuha!sd6 is a threat that relies on rootkit-specific techniques in order to hide its presence in the system.

• Attention! The following threat categories were identified:

Threat Category	Description
	A code with the rootkit-specific techniques designed to hide the software presence in the system
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\audiosr.dll	97,792 bytes	MD5: 0x0CF21569E96A12044FE77A47D347A45E SHA-1: 0x6E3ADF64F037B4FD9C9F9AC981F1322C6A81E258	Trojan Horse [Symantec] Rootkit.Win32.Podnuha.bzj [Kaspersky Lab] Generic.dx [McAfee] Mal/Generic-A [Sophos] Rootkit.Win32.Podnuha [Ikarus] Win-Trojan/Podnuha.97792.AE [AhnLab]
2	[file and pathname of the sample #1]	125,440 bytes	MD5: 0x526D3AA0940EAB964EB179892D7F56C6 SHA-1: 0x2C2FCDD4ACB2E2702856A037E18B25DC52C1F47C	Rootkit.Podnuha!sd6 [PCTools] Trojan Horse [Symantec] Rootkit.Win32.Podnuha.bzh [Kaspersky Lab] Generic Dropper [McAfee] Mal/Dropper-AC [Sophos] Trojan-Dropper.Win32.Boaxxe [Ikarus] Win-Trojan/Podnuha.125440.AB [AhnLab]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{36DA212B-D297-4D18-9541-A736D8179C40}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{36DA212B-D297-4D18-9541-A736D8179C40}\InprocServer32
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{36DA212B-D297-4D18-9541-A736D8179C40}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{36DA212B-D297-4D18-9541-A736D8179C40}\InprocServer32]
• (Default) = "%System%\audiosr.dll"
• ThreadingModel = "apartment"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings]
• bf = 9D 5D EA 98 47 F9 A2 50 69 54 4A 1C 17 24 32 DA F3 94 44 53 AF 82 C2 36 91 34 A4 81 4A FB 6A FF
• bk = A5 54 80 8B 4F 85 D7 2D 7C 2A 52 5D 57 60 6B 8B DA 96 4E 22 F7 C2 92 6E D3 06 E1 9C 18 D3 3E CE 69 DE 75 7B BE 4A 66
• iu = 0x00000F4B
• mu = 7B 14 AE 47 E1 7A 84 3F

Other details

• Analysis of the file resources indicate the following possible countries of origin:

	Russian Federation
	United Kingdom