Submission Summary:

• Submission details:
• Submission received: 26 October 2012, 01:27:57
• Processing time: 13 min 51 sec
• Submitted sample:
• File MD5: 0x83592E099824CB69C32ED815294FBFD0
• File SHA-1: 0x782DDA462980FDF2329CF0DF319C286703EF427D
• Filesize: 110,080 bytes
• Alias: BackDoor-FIQ.dr [McAfee]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Locations\spoolsv.exe	68,608 bytes	MD5: 0xF478DB6A69FB2CDE960339A44E105B33 SHA-1: 0x7F7ECB933955E23A10F101B1845E941198986792	BackDoor-FIQ [McAfee]
2	[file and pathname of the sample #1]	110,080 bytes	MD5: 0x83592E099824CB69C32ED815294FBFD0 SHA-1: 0x782DDA462980FDF2329CF0DF319C286703EF427D	BackDoor-FIQ.dr [McAfee]

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

• The following directory was created:
• %AppData%\Locations

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\IP
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Options
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\RTF
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Settings
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Text
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Word6
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Write

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• spoolsv = "%AppData%\Locations\spoolsv.exe"

so that spoolsv.exe runs every time Windows starts

Other details

• The following Internet Connection was established:

• The following GET request was made:
• QRTF96.jsp?8Bl3SGQJ1pvY0=LPI5Rfhf9mI/+wj4mMY5+M=LP1InRmjn1T