Submission Summary:

• Submission details:
• Submission received: 2 May 2009, 07:21:08
• Processing time: 6 min 9 sec
• Submitted sample:
• File MD5: 0x5574DFE1796CD79FECD32500EA758A38
• File SHA-1: 0x4D1F3B94E69B95663AA17A7F2C3A50FCBA328CFD
• Filesize: 64,052 bytes
• Alias & packer info:
• P2P-Worm.Agent!sd5 [PCTools]
• W32.SillyP2P [Symantec]
• P2P-Worm.Win32.Agent.ag [Kaspersky Lab]
• Generic.dx [McAfee]
• WORM_SILLY.CZ [Trend Micro]
• Mal/Packer [Sophos]
• Worm:Win32/Agent.AB [Microsoft]
• Win32/Agent.worm.64052 [AhnLab]
• packed with: YodaProtect [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
P2P-Worm.Agent!sd5	P2P-Worm.Agent!sd5 is a network-aware worm that attempts to replicate across peer-to-peer networks.

• Attention! The following threat category was identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[pathname with a string SHARE]\1CLICK DVD Copy 5.2.2.1.zip.exe [pathname with a string SHARE]\Adobe CS3 Keygen Package Serial.zip.exe [pathname with a string SHARE]\Adobe Photoshop CS2 Police Tested.zip.exe [pathname with a string SHARE]\Advanced Spyware Remover Professional.zip.exe [pathname with a string SHARE]\Alien Shooter Vengeance 2007.zip.exe [pathname with a string SHARE]\Alive 3GP Video Converter v1.8.0.2.zip.exe [pathname with a string SHARE]\Alive DVD Ripper v2.2.3.6.zip.exe [pathname with a string SHARE]\Bad Boys 2 Pcgame.zip.exe [pathname with a string SHARE]\Bloody Roar 4 PAL DVD.zip.exe [pathname with a string SHARE]\Blumentals Screensaver Factory Enterprise v4.5.zip.exe [pathname with a string SHARE]\ConvertXtoDVD v2.2.1.253.zip.exe [pathname with a string SHARE]\CopyToDVD v4.0.4.60.zip.exe [pathname with a string SHARE]\Crush Usa Eng PSP.zip.exe [pathname with a string SHARE]\Cute girl gets fucked by a older man.zip.exe [pathname with a string SHARE]\Dangerous Waters Exclusive Mission.zip.exe [pathname with a string SHARE]\Dave Mirra Freestyle Bmx.zip.exe [pathname with a string SHARE]\Diner Dash 3.zip.exe [pathname with a string SHARE]\DOOM 3 Full 3 CD Bonus.zip.exe [pathname with a string SHARE]\Dragon Naturally Speaking Preffered v9.51.zip.exe [pathname with a string SHARE]\DreamLight Photo Editor v1.77.zip.exe [pathname with a string SHARE]\Driver76.zip.exe [pathname with a string SHARE]\Dungeon Siege 2 Reloaded MaxGrab Working 4CD vers.zip.exe [pathname with a string SHARE]\Dungeon Siege.zip.exe [pathname with a string SHARE]\Elvandia Story NTSC-J.zip.exe [pathname with a string SHARE]\Enemy Territory QUAKE Wars Beta LEAK.zip.exe [pathname with a string SHARE]\Error Expert 1.2.9.zip.exe [pathname with a string SHARE]\Error Killer 2.6.2 Full.zip.exe [pathname with a string SHARE]\Fifa 2007 5 links only.zip.exe [pathname with a string SHARE]\FIM Speedway Grand Prix 2.zip.exe [pathname with a string SHARE]\Football Manager 2007 Graphics Mega Pack.zip.exe [pathname with a string SHARE]\Fruity Loops 7.0 Udate Plugins.zip.exe [pathname with a string SHARE]\Geist PAL.zip.exe [pathname with a string SHARE]\Geometry Wars for XP.zip.exe [pathname with a string SHARE]\Grand Theft Auto III.zip.exe [pathname with a string SHARE]\Grim Fandango.zip.exe [pathname with a string SHARE]\GTA Vice City.zip.exe [pathname with a string SHARE]\GTA Tokyo Xtreme Racer Drift PL.zip.exe [pathname with a string SHARE]\GTA Vice City Deluxe.zip.exe [pathname with a string SHARE]\Half Life 2 Episode One.zip.exe [pathname with a string SHARE]\HDD Life Pro v3.0.138.zip.exe [pathname with a string SHARE]\Hooligans Storm Over Europe.zip.exe [pathname with a string SHARE]\Hot girl gets fucked by another woman.zip.exe [pathname with a string SHARE]\Hoyle Card Games 2007.zip.exe [pathname with a string SHARE]\Jamiroquai The Return of the Space C.zip.exe [pathname with a string SHARE]\Jefferson Airplane Long John Silver.zip.exe [pathname with a string SHARE]\JetAudio v7.0.0.3001 Plus Vx.zip.exe [pathname with a string SHARE]\Johnny Cash Greatest Hits.zip.exe [pathname with a string SHARE]\Jon Bon Jovi Young Guns II Blaze Of.zip.exe [pathname with a string SHARE]\Kevin Burke Up Close.zip.exe [pathname with a string SHARE]\Kick Shot Pool.zip.exe [pathname with a string SHARE]\King Crimson Heavy ConstruKction.zip.exe [pathname with a string SHARE]\Led Zeppelin Box Set Vol.1.zip.exe [pathname with a string SHARE]\Lemonade Tycoon 2 New York Edition.zip.exe [pathname with a string SHARE]\LimeWire Pro 4.13.2.1.zip.exe [pathname with a string SHARE]\Lionel Richie Can't Slow Down.zip.exe [pathname with a string SHARE]\Liquidator.zip.exe [pathname with a string SHARE]\Live for Speed S2 0.5U Alpha.zip.exe [pathname with a string SHARE]\Lucio Dalla Storie di casa mia.zip.exe [pathname with a string SHARE]\Mature wife rubs her pussy.zip.exe [pathname with a string SHARE]\Metal Gear Solid 3Subsistence PAL ENG 3 DVDs.zip.exe [pathname with a string SHARE]\Metal Slug Anthology NTSC.zip.exe [pathname with a string SHARE]\Microsoft Money 2007.zip.exe [pathname with a string SHARE]\Microsoft Windows Vista Ultimate X86 iSO.zip.exe [pathname with a string SHARE]\Microsoft Windows XP SP2 Genuine.zip.exe [pathname with a string SHARE]\MooMa MP3 Ringtone Maker v1.20.zip.exe [pathname with a string SHARE]\MotoRacer 3 Gold Edition.zip.exe [pathname with a string SHARE]\MP3 Remix For Winamp 3.102 Final.zip.exe [pathname with a string SHARE]\My first homemade fuck video.zip.exe [pathname with a string SHARE]\NOD32 2.70.39 w Patch.zip.exe [pathname with a string SHARE]\NVidia DVD Player 2.55.zip.exe [pathname with a string SHARE]\Oasis Familiar To Millions.zip.exe [pathname with a string SHARE]\Open Video Capture 1.24.477.zip.exe [pathname with a string SHARE]\OrgScheduler LAN ver.5.1.zip.exe [pathname with a string SHARE]\Overlord 2007.zip.exe [pathname with a string SHARE]\Passware Kit Enterprise v8.0.2596.zip.exe [pathname with a string SHARE]\PC Error Eliminator 3.0.zip.exe [pathname with a string SHARE]\PhotoDex ProShow Gold 3.0.1935.zip.exe [pathname with a string SHARE]\Pirates of the Caribbean At Worlds End Pc Rip.zip.exe [pathname with a string SHARE]\Pirates of the Carribean At Worlds End.zip.exe [pathname with a string SHARE]\Powerzip 7.06 Full.zip.exe [pathname with a string SHARE]\Prince of Persia Sands of Time.zip.exe [pathname with a string SHARE]\RAW DANGER DVD NTSC ENG.zip.exe [pathname with a string SHARE]\Resident Evil 4.zip.exe [pathname with a string SHARE]\RollerCoaster Tycoon 3 Multilanguage ISO.zip.exe [pathname with a string SHARE]\Rome Total War.zip.exe [pathname with a string SHARE]\Roxio Copy And Convert 3.4.0.zip.exe [pathname with a string SHARE]\RS Premium Accounts.zip.exe [pathname with a string SHARE]\Serif PagePlus X2 v12.0 ISO.zip.exe [pathname with a string SHARE]\She is filmed by a hidden cam.zip.exe [pathname with a string SHARE]\Shrek The Third Pcgame.zip.exe [pathname with a string SHARE]\Sleepwalker.zip.exe [pathname with a string SHARE]\Smoking Guns Shooting Gallery.zip.exe [pathname with a string SHARE]\Sony Sound Forge v9.0 Full.zip.exe [pathname with a string SHARE]\SpongeBob SquarePants Obstacle Odyssea 2 Time Trouble v.zip.exe [pathname with a string SHARE]\Spyware Killer v2.1.zip.exe [pathname with a string SHARE]\Star Wars Republic Commando.zip.exe [pathname with a string SHARE]\Sygate Personal Firewall 5.6.3408.0.zip.exe [pathname with a string SHARE]\The Matrix Path Of Neo.zip.exe [pathname with a string SHARE]\Time Crisis II PS2 CD.zip.exe [pathname with a string SHARE]\Tom Clancys Splinter Cell FAiRLiGHT.zip.exe	64,052 bytes	MD5: 0x5574DFE1796CD79FECD32500EA758A38 SHA-1: 0x4D1F3B94E69B95663AA17A7F2C3A50FCBA328CFD	P2P-Worm.Agent!sd5 [PCTools] W32.SillyP2P [Symantec] P2P-Worm.Win32.Agent.ag [Kaspersky Lab] Generic.dx [McAfee] WORM_SILLY.CZ [Trend Micro] Mal/Packer [Sophos] Worm:Win32/Agent.AB [Microsoft] Win32/Agent.worm.64052 [AhnLab] packed with YodaProtect [Kaspersky Lab]

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	8,192 bytes
p2pex.zip.exe	%System%\p2pex.zip.exe	8,192 bytes
1CLICK DVD Copy 5.2.2.1.zip.exe	%DownloadedProgramFiles%\1click dvd copy 5.2.2.1.zip.exe	8,192 bytes
Adobe CS3 Keygen Package Serial.zip.exe	%DownloadedProgramFiles%\adobe cs3 keygen package serial.zip.exe	8,192 bytes
Adobe Photoshop CS2 Police Tested.zip.exe	%DownloadedProgramFiles%\adobe photoshop cs2 police tested.zip.exe	8,192 bytes
Advanced Spyware Remover Professional.zip.exe	%DownloadedProgramFiles%\advanced spyware remover professional.zip.exe	8,192 bytes
Alien Shooter Vengeance 2007.zip.exe	%DownloadedProgramFiles%\alien shooter vengeance 2007.zip.exe	8,192 bytes

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
• %DownloadedProgramFiles% is a variable that refers to the file system directory containing downloaded program files. A typical path is C:\Windows\Downloaded Program Files.

Registry Modifications

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• p2pex = "%System%\p2pex.zip.exe"

so that p2pex.zip.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• p2pex = "%System%\p2pex.zip.exe"

so that p2pex.zip.exe runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Italy

• To mark the presence in the system, the following Mutex object was created:
• -= P2Pex =-

• The following Host Name was requested from a host database:
• www.regione.calabria.it