Submission Summary:

• Submission details:
• Submission received: 22 November 2008, 22:05:38
• Processing time: 6 min 19 sec
• Submitted sample:
• File MD5: 0x789332437016B74D61F7CD413A08294E
• File SHA-1: 0x4D5CF996DE8A1EFA9F7C6F739EEBD81C44767906
• Filesize: 62,464 bytes
• Alias:
• I-Worm.Wigon.Gen [PCTools]
• Trojan.Pandex [Symantec]
• Email-Worm.Win32.Agent.bx [Kaspersky Lab]
• Spy-Agent.bv [McAfee]
• Mal/Basine-C [Sophos]
• Spammer:Win32/Cutwail.gen!B [Microsoft]
• Email-Worm.Win32.Agent.bx [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Capability to send out email message(s) with the built-in SMTP client engine.
Produces outbound traffic.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	62,464 bytes	MD5: 0x789332437016B74D61F7CD413A08294E SHA-1: 0x4D5CF996DE8A1EFA9F7C6F739EEBD81C44767906	I-Worm.Wigon.Gen [PCTools] Trojan.Pandex [Symantec] Email-Worm.Win32.Agent.bx [Kaspersky Lab] Spy-Agent.bv [McAfee] Mal/Basine-C [Sophos] Spammer:Win32/Cutwail.gen!B [Microsoft] Email-Worm.Win32.Agent.bx [Ikarus]

Memory Modifications

• There was a new process created in the system:

Other details

• To mark the presence in the system, the following Mutex objects were created:
• 70botashdfg
• 71botashdfg
• 72dfsajfhfg
• crypt32LogoffPortEvent
• memoryallocblock
• zone_dns_mutex

• The following port was open in the system:

• The following Host Name was requested from a host database:
• mxs.mail.ru

• There was registered attempt to establish connection with the remote host. The connection details are:

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 2546: