Submission Summary:

• Submission details:
• Submission received: 31 July 2012, 11:08:48
• Processing time: 9 min 50 sec
• Submitted sample:
• File MD5: 0x785BC44509D28562ABA9D42DE7A2C1F8
• File SHA-1: 0x520774A9D5D18B53984C2321C71C2B57554A3E8F
• Filesize: 532,992 bytes

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

• The following file was created in the system:

Memory Modifications

• There was a new process created in the system:

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Brazil

• To mark the presence in the system, the following Mutex object was created:
• xxx_xxx_sss_www_uuu_xxx_zzz

• The following Host Name was requested from a host database:
• 108.163.160.78

• The data identified by the following URL was then requested from the remote web server:
• http://108.163.160.78/?N=D

Downloaded File Summary:

• Download details:
• Download retrieved: 31 July 2012 11:21:53
• Processing time: 9 min 58 sec
• Downloaded sample:
• File MD5: 0x521F11F6605E873025E1F60073D6B103
• File SHA-1: 0x0D3E2329A05C52EDA316CCE91FFCCA8AA0CD1B89
• Filesize: 643,072 bytes
• Alias: Backdoor.Win32.Delf [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).

Technical Details:

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	643,072 bytes	MD5: 0x521F11F6605E873025E1F60073D6B103 SHA-1: 0x0D3E2329A05C52EDA316CCE91FFCCA8AA0CD1B89	Backdoor.Win32.Delf [Ikarus]

Memory Modifications

• There was a new process created in the system:

• Note:
• [generic host process filename] is a full path filename of [generic host process].

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0x870000 - 0x916000
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0x8F0000 - 0x996000
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0xD70000 - 0xE16000

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31B40E75-8B29-45B0-89CE-81C6F1D0138F}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31B40E75-8B29-45B0-89CE-81C6F1D0138F}\InprocServer32
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31B40E75-8B29-45B0-89CE-81C6F1D0138F}

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31B40E75-8B29-45B0-89CE-81C6F1D0138F}\InprocServer32]
• (Default) = "[file and pathname of the sample #1]"
• ThreadingModel = "Apartment"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31B40E75-8B29-45B0-89CE-81C6F1D0138F}]
• (Default) = ""