ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 28 August 2008, 10:05:33
Processing time: 5 min 37 sec
Submitted sample:

File MD5: 0x716ADBF47C6FFFBD77604BE9E9DD7043
File SHA-1: 0xC61F438FDA88114F2ECD4D3D4B0D47409D2C9AA9
Filesize: 543,156 bytes

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%AppData%\FW\md.dll	18,944 bytes	MD5: 0x8626E6E744A0D23692E160BA459877F8 SHA-1: 0xA90B802E7DBB032E049A2466F03CC2AAE8145720
2	%DesktopDir%\Free Viewer.lnk	708 bytes	MD5: 0x754AC48F4F91D0EDD245409ABBCD2C6E SHA-1: 0xC77A4742E7F292C530098030E408BADC60CB3EBB
3	%StartMenu%\Free Viewer.lnk	708 bytes	MD5: 0x6F8746F2CBC0CCAF186EE89F4D79838D SHA-1: 0xE2DBE347F18CF201FE643D23AB1C07E71A375AF5
4	%Programs%\Free Viewer.lnk	714 bytes	MD5: 0x40674A8AFBE7973259F112182B0F584D SHA-1: 0xFCC3EFDB330DA470FBF30D08138A5B28CCC17FF0
5	%ProgramFiles%\FreeViewer\FreeViewer.exe	647,168 bytes	MD5: 0xA4F46C5893245CC99DC8CC0882C259F4 SHA-1: 0xFF538EE97CEA94D93C7CB65581EC0CEC75B45A9C
6	%ProgramFiles%\FreeViewer\logo.ICO	18,670 bytes	MD5: 0xD4D37712E990CDBE805DC2A52C58B158 SHA-1: 0xAAA7C9B9C41FC5FF5E42F0BDFBDA9890939369C5
7	%ProgramFiles%\FreeViewer\terms.txt	14,275 bytes	MD5: 0xFCAC623EE94630CA9841EFF192CAC29B SHA-1: 0x5052508059E7107DD2C7A6A3ECC5F24098A049CE
8	%ProgramFiles%\FreeViewer\Uninstall.exe	106,804 bytes	MD5: 0xA865E5B0D38BAD6C96AC99A5974BF03C SHA-1: 0xC595DD56CB045CC4737F5FE203E5CED444F8D17F
9	[file and pathname of the sample #1]	543,156 bytes	MD5: 0x716ADBF47C6FFFBD77604BE9E9DD7043 SHA-1: 0xC61F438FDA88114F2ECD4D3D4B0D47409D2C9AA9

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%StartMenu% is a variable that refers to the file system directory containing Start menu items. A typical path is C:\Documents and Settings\[UserName]\Start Menu.
%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%AppData%\FW
%ProgramFiles%\FreeViewer

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	274,432 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9C3BAADB-88D9-4F8E-9501-4A5422C90AD1}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Free Viewer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
HKEY_CURRENT_USER\Software\FWCV

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9C3BAADB-88D9-4F8E-9501-4A5422C90AD1}]

Exec = "C:\PROGRA~1\FREEVI~1\FREEVI~1.EXE"
HotIcon = "C:\PROGRA~1\FREEVI~1\FREEVI~1.EXE,101"
Icon = "C:\PROGRA~1\FREEVI~1\FREEVI~1.EXE,101"
Default Visible = "Yes"
CLSID = "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}"
ButtonText = "Free Viewer"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Free Viewer]

DisplayName = "Free Viewer"
UninstallString = ""%ProgramFiles%\FreeViewer\uninstall.exe""

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping]

{9C3BAADB-88D9-4F8E-9501-4A5422C90AD1} = 0x00002001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

Mozilla/4.0(Compatible Mozilla/4.0(Compatible-EmbeddedWB 14.57 http://bsalsa.com/ EmbeddedWB- 14.57 from: http://bsalsa.com/ = ""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

FW = "rundll32.exe %UserProfile%\APPLIC~1\FW\md.dll,InitSys"

so that md.dll runs every time Windows starts

[HKEY_CURRENT_USER\Software\FWCV]

(Default) = "%ProgramFiles%\freeviewer\freeviewer.exe"
GUID = "{12048FA8-5BC6-4B64-8B21-C1ED4269398F}"

The following Registry Values were modified:

[HKEY_CURRENT_USER\Control Panel\Desktop]

ForegroundLockTimeout = 0x00000000

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping]

NextId = 0x00002002

Other details

Analysis of the file resources indicate the following possible country of origin:

Russian Federation

To mark the presence in the system, the following Mutex object was created:

_!SHMSFTHISTORY!_

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
promo.cams.com	80	(null)	(null)

The following GET requests were made:

promo/randomcam.jsp?pid=g1006495-po
promo/index.jpg
promo/randomcam.jsp?pid=g255577-po

The data identified by the following URL was then requested from the remote web server:

http://actionpooses.com/stat.asp

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.