Submission Summary:

• Submission details:
• Submission received: 21 September 2012, 09:40:18
• Processing time: 8 min 11 sec
• Submitted sample:
• File MD5: 0x70E04ED91CD1F381E4DAE7DAF70DCE14
• File SHA-1: 0x93390ACBDB84F0989E927B9B43B20F49E0662657
• Filesize: 1,690,011 bytes
• Alias:
• Trojan-GameThief.Win32.WOW.acln [Kaspersky Lab]
• Win32.SuspectCrc [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\photogenics????????\??????.txt	199 bytes	MD5: 0xE1EA14D3AC9CF0C4C98B5B1194E811AC SHA-1: 0x57DEA80A113303E88AD9AED6D3B06CEB2463F48D	(not available)
2	%Temp%\photogenics????????\????\Photogenics????\Photogenics.exe	1,104,384 bytes	MD5: 0xA2899E145D7D65AC65832ED2B59F1747 SHA-1: 0xB060397BBC89E356CDF1D4D5EDEA306B727359AF	(not available)
3	%Temp%\photogenics????????\????\Photogenics????\Usp10.dll	90,629 bytes	MD5: 0x6342EF038432075756716DF616EBB7F8 SHA-1: 0x75921231F1681D972FD91D98080C02C1AF26A81B	Trojan.Gen [Symantec] Trojan-GameThief.Win32.WOW.acln [Kaspersky Lab] Mal/TinyDL-T [Sophos] Win32.SuspectCrc [Ikarus] Win-Trojan/Onlinegamehack.90629.F [AhnLab]
4	%Temp%\photogenics????????\???\Photogenics.exe	1,104,384 bytes	MD5: 0xB63C6FDFB3C3F4455A30D6348933B744 SHA-1: 0x6C3D09A56D2C5D46C130CAF138D7BB6FD5D1527E	(not available)
5	%Temp%\photogenics????????\???????\photogenics.ppc30_arm.cab	1,332,706 bytes	MD5: 0x929A9218083964572DD4216B3D3F5775 SHA-1: 0x1294C3688870F31CA32E483E8E9A4597A032784A	(not available)
6	[file and pathname of the sample #1]	1,690,011 bytes	MD5: 0x70E04ED91CD1F381E4DAE7DAF70DCE14 SHA-1: 0x93390ACBDB84F0989E927B9B43B20F49E0662657	Trojan-GameThief.Win32.WOW.acln [Kaspersky Lab] Win32.SuspectCrc [Ikarus]
7	%System%\Thumbs.db	406,528 bytes	MD5: 0x2EB58F9DCD6AB320B46744A4EA48B2D2 SHA-1: 0x79E785C9B4E783385AACB3C5ACB86C8567182138	(not available)

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following files were deleted:
• %System%\lpk.dll
• %System%\usp10.dll

• The following directories were created:
• %Temp%\photogenics????????
• %Temp%\photogenics????????\????
• %Temp%\photogenics????????\????\Photogenics????
• %Temp%\photogenics????????\???
• %Temp%\photogenics????????\???????

Memory Modifications

• There was a new process created in the system:

• Notes:
• [generic host process filename] is a full path filename of [generic host process].

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
lpk.dll	%System%\lpk.dll	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0x629C0000 - 0x629C9000