Submission Summary:

• Submission details:
• Submission received: 11 September 2012, 16:12:40
• Processing time: 12 min 18 sec
• Submitted sample:
• File MD5: 0x6CFD19C5EBAF87D40AFD76D3653BF86F
• File SHA-1: 0x62BD0274E8F77A3439F900F35A43C6997B0B7260
• Filesize: 53,148 bytes
• Alias:
• Mal/PWS-AL [Sophos]
• Trojan-PWS.OnlineGames [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%ProgramFiles%\Common Files\00017E33ce.dll	10,240 bytes	MD5: 0xF1F49FB85AB029AD86C02EBECB892B12 SHA-1: 0x664A602F8E843218C1158571714CD0ADEE1DA939	Infostealer [Symantec] PWS-Mmorpg!yy [McAfee] Troj/WoW-KL [Sophos] Trojan.Win32.Genome [Ikarus]
2	%ProgramFiles%\Common Files\whh14016.ocx	61,852 bytes	MD5: 0x9C3111018D0A7D1C0208408E254FBA72 SHA-1: 0x31F3E8FBC21E263FDFE76482E74158A374F5FCD2	Generic PWS.yx [McAfee] Trojan-PWS.Win32.Kykymber [Ikarus]
3	[file and pathname of the sample #1]	53,148 bytes	MD5: 0x6CFD19C5EBAF87D40AFD76D3653BF86F SHA-1: 0x62BD0274E8F77A3439F900F35A43C6997B0B7260	Mal/PWS-AL [Sophos] Trojan-PWS.OnlineGames [Ikarus]
4	%System%\whhfd008.ocx	14,336 bytes	MD5: 0x731659D09654891912AC223E20CD10AB SHA-1: 0x13CEE04ADC7B09EF1C0C6B9ABC02D0C7BC02A071	Infostealer [Symantec] PWS-Mmorpg!yr [McAfee] Troj/Monkif-Fam [Sophos] Trojan.Win32.Patched [Ikarus]

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

• Notes:
• [generic host process filename] is a full path filename of [generic host process].

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
00017E33ce.dll	%ProgramFiles%\Common Files\00017E33ce.dll	Process name: svchost.exe Process filename: %System%\svchost.exe Address space: 0xB50000 - 0xD56000

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E0200804
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\E0200804

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E0200804]
• Ime File = "WHHFD008.OCX"
• Layout Text = "US"
• Layout File = "kbdus.dll"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\E0200804]
• Ime File = "WHHFD008.OCX"
• Layout Text = "US"
• Layout File = "kbdus.dll"
• [HKEY_CURRENT_USER\Keyboard Layout\Preload]
• 2 = "00000409"

• The following Registry Value was modified:
• [HKEY_CURRENT_USER\Keyboard Layout\Preload]
• 1 =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China

• To mark the presence in the system, the following Mutex objects were created:
• jahCQWN14016_rel_regamle_00000200_
• jahCQWN14016_rel_regamle_00000212_
• jahCQWN14016_rel_regamle_00000220_