Submission Summary:

• Submission details:
• Submission received: 8 September 2012, 08:17:48
• Processing time: 8 min 58 sec
• Submitted sample:
• File MD5: 0x6884F1D2DA39BAEC397768F8BFD860B8
• File SHA-1: 0x4F8499EED377674B1E895BC51A977DFB7733EC81
• Filesize: 1,410,179 bytes
• Alias:
• Backdoor.Graybird [Symantec]
• Trojan.Win32.Pincav.bxem [Kaspersky Lab]
• Generic PWS.zo [McAfee]
• Mal/Inject-DJ [Sophos]
• VirTool:Win32/DelfInject [Microsoft]
• Trojan-Dropper.Delf [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\ProgramData\NdsafeW\BysxkhK\BgxpnaJ.exe [file and pathname of the sample #1]	1,410,179 bytes	MD5: 0x6884F1D2DA39BAEC397768F8BFD860B8 SHA-1: 0x4F8499EED377674B1E895BC51A977DFB7733EC81	Backdoor.Graybird [Symantec] Trojan.Win32.Pincav.bxem [Kaspersky Lab] Generic PWS.zo [McAfee] Mal/Inject-DJ [Sophos] VirTool:Win32/DelfInject [Microsoft] Trojan-Dropper.Delf [Ikarus]

• The following directories were created:
• c:\ProgramData
• c:\ProgramData\NdsafeW
• c:\ProgramData\NdsafeW\BysxkhK
• c:\ProgramData\NdsafeW\DcdaakX
• c:\ProgramData\NdsafeW\FnxjxpN

Memory Modifications

• There were new processes created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\sistemanet

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• BgxpnaJ = "c:\ProgramData\NdsafeW\BysxkhK\BgxpnaJ.exe"

so that BgxpnaJ.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\sistemanet]
• direct = "jiijehjibjhojaadjaaajaocjaadjigjaoijfhjigjaafjigjibjghjaoojaaejigjaobjaoajhg)"
• name1 = "jffjaocjabojaabjaaojigjgd)"
• idnome = "jaohjaoajaoejaafjaoa)"
• lugarjpg = "jiijehjibjhojaadjaaajaocjaadjigjaoijfhjigjaafjigjibjghjaoojaaejigjaobjaoajhgjibjfhjiijaoojigjigjaogjhhjib)"
• dir2 = "jiijehjibjhojaadjaaajaocjaadjigjaoijfhjigjaafjigjibjghjaoojaaejigjaobjaoajhgjibjgojaaojabojaofjabojaabjghjib)"
• dir = "jiijehjibjhojaadjaaajaocjaadjigjaoijfhjigjaafjigjibjghjaoojaaejigjaobjaoajhgjibjffjabajaaejabojaogjaodjgejib)"

Other details

• The following Host Name was requested from a host database:
• dl.dropbox.com

• The following HTTP URLs were started reading:
• http://dl.dropbox.com/u/55131373/index.html
• http://dl.dropbox.com/u/55131519/index.html