Submission Summary:

• Submission details:
• Submission received: 27 November 2011, 19:56:56
• Processing time: 9 min 42 sec
• Submitted sample:
• File MD5: 0x759CA80274DB9600865F98DD29EA7D5A
• File SHA-1: 0xDFACAFE2CCEB271AC8B4366D3ADA2337285DA949
• Filesize: 721,745 bytes
• Alias:
• Malware.Imaut [PCTools]
• W32.Imaut!gen1 [Symantec]
• Worm.Win32.AutoIt.dn [Kaspersky Lab]
• W32/YahLover.worm.gen [McAfee]
• Mal/Sohana-A [Sophos]
• Worm.Win32.AutoIt [Ikarus]
• Win32/Sohaned.worm.230400 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\gphone.exe %System%\gphone.exe [file and pathname of the sample #1]	721,745 bytes	MD5: 0x759CA80274DB9600865F98DD29EA7D5A SHA-1: 0xDFACAFE2CCEB271AC8B4366D3ADA2337285DA949	Malware.Imaut [PCTools] W32.Imaut!gen1 [Symantec] Worm.Win32.AutoIt.dn [Kaspersky Lab] W32/YahLover.worm.gen [McAfee] Mal/Sohana-A [Sophos] Worm.Win32.AutoIt [Ikarus] Win32/Sohaned.worm.230400 [AhnLab]
2	%System%\autorun.ini	96 bytes	MD5: 0x0450BD6F856C038A41AB0E645B3B293B SHA-1: 0xEBBCA685215823672FD692F6C3612F06DC30E084	Net-Worm.SillyFDC!rem [PCTools] W32.SillyFDC [Symantec] Generic!atr [McAfee] W32/Sohana-BI [Sophos]
3	%Windir%\Tasks\At1.job	346 bytes	MD5: 0xC1471581747DBE9666EBE370D3698FBC SHA-1: 0x680BA3456C94C5DE96A6A2213E43736FA3CB2DED	(not available)

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	708,608 bytes
gphone.exe	%System%\gphone.exe	708,608 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
• NofolderOptions = 0x00000001

to remove the Folder Options item from all Windows Explorer menus and from Control Panel

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
• DisableTaskMgr = 0x00000001
• DisableRegistryTools = 0x00000001

to prevent users from starting Task Manager (Taskmgr.exe)
to disable the Windows registry editors (Regedt32.exe and Regedit.exe)

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Yahoo Messengger = "%System%\gphone.exe"

so that gphone.exe runs every time Windows starts

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
• Default_Page_URL =
• Default_Search_URL =
• Search Page =
• Start Page =
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell =
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
• Start Page =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	United Kingdom

• The following ports were open in the system:

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URLs was then requested from the remote web server:
• http://gototalgo.googlepages.com/setting.ini
• http://seeprivatecam.googlepages.com/setting.ini