Submission Summary:

• Submission details:
• Submission received: 3 August 2009, 11:48:44
• Processing time: 8 min 0 sec
• Submitted sample:
• File MD5: 0x6D717FF51BD05ED309E14AA158E022CC
• File SHA-1: 0xAEE1230437C1923A053D84D82A54BD6DD36C8397
• Filesize: 72,704 bytes
• Alias & packer info:
• Suspicious.MH690 [Symantec]
• Trojan-Downloader.Win32.Banload [Ikarus]
• packed with: PE_Patch.UPX [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan.Generic	Common Components that may be used by Trojans Small, DRSN Search, Binet, Euniverse, Adrotator and Dloader among others.

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	72,704 bytes	MD5: 0x6D717FF51BD05ED309E14AA158E022CC SHA-1: 0xAEE1230437C1923A053D84D82A54BD6DD36C8397	Suspicious.MH690 [Symantec] Trojan-Downloader.Win32.Banload [Ikarus] packed with PE_Patch.UPX [Kaspersky Lab]

• The following directory was created:
• c:\winnt_

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\dark

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• winntR1 = "C:\winnt_\winntR1.exe"
• winntR2 = "C:\winnt_\winntR2.exe"
• winnt2 = "C:\winnt_\winnt2.exe"
• winnt3 = "C:\winnt_\winnt3.exe"
• winnt4 = "C:\winnt_\winnt4.exe"
• winnt5 = "C:\winnt_\winnt5.exe"
• winnt6 = "C:\winnt_\winnt6.exe"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Brazil

• The following Internet downloads were started (the retrieved bits are saved into the local file):