Submission Summary:

• Submission details:
• Submission received: 28 July 2012, 01:40:53
• Processing time: 9 min 2 sec
• Submitted sample:
• File MD5: 0x7B6D12ED532D1CECD0EFD4B6234E1E42
• File SHA-1: 0xC72E7083C39FD2CA1995B0159FDBF398306128F2
• Filesize: 532,992 bytes
• Alias: Win32.SuspectCrc [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	532,992 bytes	MD5: 0x7B6D12ED532D1CECD0EFD4B6234E1E42 SHA-1: 0xC72E7083C39FD2CA1995B0159FDBF398306128F2	Win32.SuspectCrc [Ikarus]

Memory Modifications

• There was a new process created in the system:

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Brazil

• To mark the presence in the system, the following Mutex object was created:
• juiz_nao_fui_eu_que_matei_ester

• The following Host Name was requested from a host database:
• 173.192.108.2

• The data identified by the following URL was then requested from the remote web server:
• http://173.192.108.2/GUID.PHP?C=D

Downloaded File Summary:

• Download details:
• Download retrieved: 28 July 2012 01:53:02
• Processing time: 8 min 46 sec
• Downloaded sample:
• File MD5: 0xA118BBAB50308051A311F9D9E3072C85
• File SHA-1: 0x4C050F0740DB57E73FB4DF4D33A1BB72B3C77D2A
• Filesize: 643,072 bytes
• Alias: Backdoor.Win32.Delf [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).

Technical Details:

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	643,072 bytes	MD5: 0xA118BBAB50308051A311F9D9E3072C85 SHA-1: 0x4C050F0740DB57E73FB4DF4D33A1BB72B3C77D2A	Backdoor.Win32.Delf [Ikarus]

Memory Modifications

• There was a new process created in the system:

• Note:
• [generic host process filename] is a full path filename of [generic host process].

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0x870000 - 0x916000
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0x8F0000 - 0x996000
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0xD70000 - 0xE16000

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ADF2B7EE-E3EB-40C1-B43E-BF5E1343BB13}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ADF2B7EE-E3EB-40C1-B43E-BF5E1343BB13}\InprocServer32
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ADF2B7EE-E3EB-40C1-B43E-BF5E1343BB13}

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ADF2B7EE-E3EB-40C1-B43E-BF5E1343BB13}\InprocServer32]
• (Default) = "[file and pathname of the sample #1]"
• ThreadingModel = "Apartment"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ADF2B7EE-E3EB-40C1-B43E-BF5E1343BB13}]
• (Default) = ""