Submission Summary:

• Submission details:
• Submission received: 22 October 2012, 10:33:49
• Processing time: 10 min 24 sec
• Submitted sample:
• File MD5: 0x81D081C651BC2ACC1D451B1E3BBD160C
• File SHA-1: 0x52183C781CFC2A343B275027FF1A1FCBB764482B
• Filesize: 61,696 bytes
• Alias:
• Worm.Win32.AutoRun.cxiz [Kaspersky Lab]
• W32/Autorun.worm!nf [McAfee]
• Troj/Agent-SOM [Sophos]
• VirTool:Win32/VBInject.GN [Microsoft]
• Trojan.Win32.VBKrypt [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\J+oa2Aoa.exe	61,696 bytes	MD5: 0x81D081C651BC2ACC1D451B1E3BBD160C SHA-1: 0x52183C781CFC2A343B275027FF1A1FCBB764482B	Worm.Win32.AutoRun.cxiz [Kaspersky Lab] W32/Autorun.worm!nf [McAfee] Troj/Agent-SOM [Sophos] VirTool:Win32/VBInject.GN [Microsoft] Trojan.Win32.VBKrypt [Ikarus]

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{254F4E25-A65F-2764-0003-070806050704}

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{254F4E25-A65F-2764-0003-070806050704}]
• StubPath = "%Temp%\J+oa2Aoa.exe"

so that J+oa2Aoa.exe runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Spain

• The following Internet Connection was established:

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 443: