Submission Summary:

• Submission details:
• Submission received: 6 February 2010, 00:44:26
• Processing time: 13 min 34 sec
• Submitted sample:
• File MD5: 0x7006BEF384BB14AD949DF02BD8778CD9
• File SHA-1: 0xDC3635F134C13D5393D9F22D75792EAA3981F7F7
• Filesize: 89,991 bytes
• Alias:
• Win32.Alman.B [PCTools]
• W32.Almanahe.B!inf [Symantec]
• Virus.Win32.Alman.b [Kaspersky Lab]
• W32/Almanahe.c [McAfee]
• PE_CORELINK.C-1 [Trend Micro]
• W32/Alman-C [Sophos]
• Virus:Win32/Almanahe.B [Microsoft]
• Win32/Alman.C [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Worm.IM.Sohanad	Worm.IM.Sohanad spreads via Yahoo Messenger and infects Windows. It sends a message to all Yahoo Messenger contacts of an infected user. The message contains a link enticing users to download the worm. The worm also disable certain Windows functionalities abd hijacks Internet Explorer homepage. It also downloads other maware and it will also attempt to propagate via the means of creating copies of itself onto removable devices such as USB flash and hard drives.
Trojan.Almanahe	Trojan.Almanahe may be installed on a system when users unknowingly visit malicious websites. It uses rootkit technology to evade scanners and contacts a remote server where it downloads and installs an updated copy of itself.

• Attention! The following threat category was identified:

Threat Category	Description
	A virus capable to modify other files by infecting, prepending, or overwriting them them with its own body

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\linkinfo.dll	53,248 bytes	MD5: 0x08B1547672A359972E7038834AB18C9F SHA-1: 0xBAAD24272B5B13DC105112AEC20451508B86183F	Trojan.Almanahe [PCTools] W32.Almanahe.B!inf [Symantec] Virus.Win32.Agent.bu [Kaspersky Lab] W32/Almanahe.dll [McAfee] PE_CORELINK.C-O [Trend Micro] W32/Alman-E [Sophos] Trojan:Win32/Almanahe.B.dll [Microsoft] Win-Trojan/Agent.53248.GU [AhnLab]
2	[file and pathname of the sample #1]	89,991 bytes	MD5: 0x7006BEF384BB14AD949DF02BD8778CD9 SHA-1: 0xDC3635F134C13D5393D9F22D75792EAA3981F7F7	Win32.Alman.B [PCTools] W32.Almanahe.B!inf [Symantec] Virus.Win32.Alman.b [Kaspersky Lab] W32/Almanahe.c [McAfee] PE_CORELINK.C-1 [Trend Micro] W32/Alman-C [Sophos] Virus:Win32/Almanahe.B [Microsoft] Win32/Alman.C [AhnLab]

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
IEXPLORE.EXE	%ProgramFiles%\Internet Explorer\IEXPLORE.EXE	102,400 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	57,344 bytes

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Other details

• The data identified by the following URL was then requested from the remote web server:
• http://h1.ripway.com/rrq/3.exe