Submission Summary:

• Submission details:
• Submission received: 22 October 2012, 10:44:19
• Processing time: 12 min 30 sec
• Submitted sample:
• File MD5: 0x7628D86BBB0BD5542509050F4B33B4E7
• File SHA-1: 0x171ABA100A1E338206DE0EC5A6E0432D5E2E5EDA
• Filesize: 109,568 bytes
• Alias: Trojan-Dropper.Win32.Dorifel [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Policies\Policies.exe	109,568 bytes	MD5: 0x7628D86BBB0BD5542509050F4B33B4E7 SHA-1: 0x171ABA100A1E338206DE0EC5A6E0432D5E2E5EDA	Trojan-Dropper.Win32.Dorifel [Ikarus] packed with UPX [Kaspersky Lab]

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

• The following directories were created:
• %AppData%\Policies
• %AppData%\Intel

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
Policies.exe	%AppData%\policies\policies.exe	102,400 bytes
Intel.exe	%AppData%\Intel\Intel.exe	262,144 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	262,144 bytes

• Attention! The following processes were intentionally hidden from the user:

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE]
• Intel = "%AppData%\Intel\Intel.exe:*:Enabled:Intel"
• Policies = "%AppData%\Policies\Policies.exe:*:Enabled:Policies"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
• Intel = "%AppData%\Intel\Intel.exe"
• Policies = "%AppData%\Policies\Policies.exe"

so that Policies.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Intel = "%AppData%\Intel\Intel.exe"
• Policies = "%AppData%\Policies\Policies.exe"

so that Policies.exe runs every time Windows starts

• [HKEY_CURRENT_USER]
• Intel = "%AppData%\Intel\Intel.exe"
• Shell = "Explorer.exe,%AppData%\Policies\Policies.exe"
• Policies = "%AppData%\Policies\Policies.exe"
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
• Intel = "%AppData%\Intel\Intel.exe"
• Policies = "%AppData%\Policies\Policies.exe"

so that Policies.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Intel = "%AppData%\Intel\Intel.exe"
• Policies = "%AppData%\Policies\Policies.exe"

so that Policies.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
• run = "%AppData%\Policies\Policies.exe"

so that Policies.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell = "Explorer.exe,%AppData%\Policies\Policies.exe"

so that Policies.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
• load =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Russian Federation

• To mark the presence in the system, the following Mutex object was created:
• SSS

• The following Host Names were requested from a host database:
• football-x.org
• psport-live.biz
• synthetic-lab.biz

• The following HTTP URLs were started reading:
• http://football-x.org/acher/sys/UserAgent.png
• http://football-x.org/acher/sys/Referer.png
• http://football-x.org/acher/sys/Accept.png
• http://football-x.org/acher/sys/AcceptLanguage.png
• http://football-x.org/acher/sys/AcceptEncoding.png
• http://www.wannabrowser.ru/
• http://www.opera.com/
• http://www.1tv.ru/
• http://upyachka.ru/
• http://www.youtube.com/
• http://www.f-1.ru/
• http://www.fc-zenit.ru/
• http://www.rambler.ru/
• http://2ip.ru/
• http://www.lenta.ru/
• http://www.nigma.ru/
• http://wikipedia.org/
• http://pentagon.afis.osd.mil/
• http://www.mail.ru/
• http://www.vkontakte.ru/
• http://www.google.com/
• http://www.yahoo.com/
• http://www.hardcoreporn.com/
• http://www.sexymama.com/
• http://www.live.com/

• The following Internet downloads were started (the retrieved bits are saved into the local file):