Submission Summary:

• Submission details:
• Submission received: 20 June 2012, 09:46:10
• Processing time: 13 min 52 sec
• Submitted sample:
• File MD5: 0x6A90426DBF6CC4AB9211FB8A9AE4DA50
• File SHA-1: 0x01A9288637BB0A1D84B83DDCC18B106650814404
• Filesize: 409,600 bytes

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%AppData%\windows security\security.exe	409,600 bytes	MD5: 0x0A5A56908991CE8B140A910096A908F5 SHA-1: 0x162510F3DF95C4685E46393069D4F19618D68A96
2	%Temp%\EXIEYjpeg	4,846 bytes	MD5: 0xBCE140055A656146D47908F822FB958F SHA-1: 0x67E7764E660BFF8F31FFC52AF0C40276300A75F5
3	[file and pathname of the sample #1]	409,600 bytes	MD5: 0x6A90426DBF6CC4AB9211FB8A9AE4DA50 SHA-1: 0x01A9288637BB0A1D84B83DDCC18B106650814404

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directory was created:
• %AppData%\windows security

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	36,864 bytes
security.exe	%AppData%\windows security\security.exe	36,864 bytes

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• security = "%AppData%\windows security\security.exe"

so that security.exe runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible countries of origin:

	Sweden
	India