ThreatExpert Report: not-a-virus:FraudTool.Win32.PowerAntivirus2009.ai, TROJ

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 25 August 2008, 10:05:04
Processing time: 6 min 45 sec
Submitted sample:

File MD5: 0x67BBCC9CF28A563B77C2B739439B7AFB
File SHA-1: 0x96605E478416A15D7598B3151270CB97123D1F08
Filesize: 706,040 bytes
Alias:

not-a-virus:FraudTool.Win32.PowerAntivirus2009.ai [Kaspersky Lab]
TROJ_FAKEAV.FF [Trend Micro]

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Antivir64\Antivir64.ini	71 bytes	MD5: 0x20DA52D5469934C11671565F3D91F480 SHA-1: 0x4D0B5665074DB9C5D06F9F577A95C0DC2DBB64A1	(not available)
2	%AppData%\[filename of the sample #1 without extension]\base.dat	3,261 bytes	MD5: 0xCD610B9325CC3F0FD2649081CD7F6C1F SHA-1: 0x5BC43CE33F8166D899DC4ACA3C0D132C9DEDADE5	(not available)
3	%AppData%\[filename of the sample #1 without extension]\base2.dat	6,832 bytes	MD5: 0xA4A9F3EBC65B26398E18DBACF7113AC1 SHA-1: 0x10ED39D8158A45BAB18A5B40AEE569C5F921CAF6	(not available)
4	%AppData%\[filename of the sample #1 without extension]\Desc.dat	39,610 bytes	MD5: 0x0F6CB67747B0B1F22E975DDC14AF0ED3 SHA-1: 0xE1CC118B7BBD9A2B2A9E445CA46883EC64B0C1FE	(not available)
5	%AppData%\[filename of the sample #1 without extension]\spline.dat	4,400 bytes	MD5: 0xC3EC0AC43976D8E0F2D3342B7AA319D4 SHA-1: 0x56C1D6116E748E0B055DF6D43DFB44B46B67528C	(not available)
6	[file and pathname of the sample #1]	706,040 bytes	MD5: 0x67BBCC9CF28A563B77C2B739439B7AFB SHA-1: 0x96605E478416A15D7598B3151270CB97123D1F08	not-a-virus:FraudTool.Win32.PowerAntivirus2009.ai [Kaspersky Lab] TROJ_FAKEAV.FF [Trend Micro]

Note:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

The following directories were created:

%AppData%\Antivir64
%AppData%\[filename of the sample #1 without extension]

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	1,662,976 bytes

Other details

Analysis of the file resources indicate the following possible countries of origin:

	Russian Federation
	Germany

To mark the presence in the system, the following Mutex objects were created:

Antivir64_AppManager_server_mutex
.NET CLR Data_Perf_Library_Lock_PID_25c
.NET CLR Networking_Perf_Library_Lock_PID_25c
.NET Data Provider for Oracle_Perf_Library_Lock_PID_25c
.NET Data Provider for SqlServer_Perf_Library_Lock_PID_25c
.NETFramework_Perf_Library_Lock_PID_25c
ASP.NET_Perf_Library_Lock_PID_25c
ASP.NET_2.0.50727_Perf_Library_Lock_PID_25c
aspnet_state_Perf_Library_Lock_PID_25c
ContentFilter_Perf_Library_Lock_PID_25c
ContentIndex_Perf_Library_Lock_PID_25c
ISAPISearch_Perf_Library_Lock_PID_25c
PerfDisk_Perf_Library_Lock_PID_25c
PerfNet_Perf_Library_Lock_PID_25c
PerfOS_Perf_Library_Lock_PID_25c
PerfProc_Perf_Library_Lock_PID_25c
PSched_Perf_Library_Lock_PID_25c
RemoteAccess_Perf_Library_Lock_PID_25c
RSVP_Perf_Library_Lock_PID_25c
Spooler_Perf_Library_Lock_PID_25c
TapiSrv_Perf_Library_Lock_PID_25c
Tcpip_Perf_Library_Lock_PID_25c
TermService_Perf_Library_Lock_PID_25c
WmiApRpl_Perf_Library_Lock_PID_25c

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.