ThreatExpert Report: Downloader.Trojan

Submission Summary:

Submission details:

Submission received: 30 September 2012, 02:41:07
Processing time: 9 min 49 sec
Submitted sample:

File MD5: 0x7FF968FC13585107A5CD470DA131A67B
File SHA-1: 0x4287C9305D2F6F70A8C585EBE900B353455B628C
Filesize: 129,713 bytes
Alias: Downloader.Trojan [Symantec]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\AdobeARM.exe	69,632 bytes	MD5: 0xE7580321E4A34B5A583245653C688157 SHA-1: 0x3916D7BA7A3EA18B9A933E7528845A6EA968D94D	Downloader.Trojan [Symantec]
2	[file and pathname of the sample #1]	129,713 bytes	MD5: 0x7FF968FC13585107A5CD470DA131A67B SHA-1: 0x4287C9305D2F6F70A8C585EBE900B353455B628C	Downloader.Trojan [Symantec]

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
AdobeARM.exe	%Temp%\adobearm.exe	77,824 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	266,240 bytes

Registry Modifications

The newly created Registry Value is:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

Adobe Download Manager = "%Temp%\adobearm.exe"

Other details

To mark the presence in the system, the following Mutex object was created:

_SHuassist.mtx

The data identified by the following URL was then requested from the remote web server:

http://www.samandersonconstruction.com/event_list.htm

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.