Submission Summary:

• Submission details:
• Submission received: 3 August 2012, 12:14:13
• Processing time: 10 min 16 sec
• Submitted sample:
• File MD5: 0x63DCECD61EBE3F0225AB67B46DE2CF4A
• File SHA-1: 0xDA52AB1EE6E4F717221127B9191AFF9BCE90A941
• Filesize: 40,256 bytes
• Alias & packer info:
• Mal/PdfExDr-B [Sophos]
• Trojan.Win32.Dialer [Ikarus]
• packed with: UPX [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\intel\cc.bat	38 bytes	MD5: 0x4E8B4866990B16582997D9846C3EF235 SHA-1: 0x119008394417FBF97EBCD90F4C5BEBA99B95F5A2	(not available)
2	c:\intel\cc.js	75 bytes	MD5: 0xB008AA4ADA6CC9390E132AE5129A9CEF SHA-1: 0x655305B2D14020306F5D6544DFE33120BB3DA2E3	(not available)
3	c:\intel\iexplorer.exe [file and pathname of the sample #1]	40,256 bytes	MD5: 0x63DCECD61EBE3F0225AB67B46DE2CF4A SHA-1: 0xDA52AB1EE6E4F717221127B9191AFF9BCE90A941	Mal/PdfExDr-B [Sophos] Trojan.Win32.Dialer [Ikarus] packed with UPX [Kaspersky Lab]

• The following directory was created:
• c:\intel

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{0248EAF2-030A-466e-8DFA-C3BFE662E028}
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{0248EAF2-030A-466e-8DFA-C3BFE662E028}]
• StubPath = "wscript.exe "C:\intel\cc.js""

so that cc.js runs every time Windows starts

Other details

• To mark the presence in the system, the following Mutex object was created:
• AAAAAA9Pn5s7CvvbCwsbG9/PEEqaevnw==

• The following Host Name was requested from a host database:
• wjj430.3322.org