| Visit ThreatExpert web site | | | Close Report |
| What's been found | Severity Level |
| Downloads/requests other files from Internet. |  |
 | File System Modifications |
| # | Filename(s) | File Size | File Hash | Alias |
| 1 | [file and pathname of the sample #1] | 54,784 bytes | MD5: 0x8B7BF426158085A84FF5D9486D7F4E94 SHA-1: 0x98E680F9B537A18C82A787ED71A287D40532DB15 |
packed with PE_Patch [Kaspersky Lab] |
 | Memory Modifications |
| Process Name | Process Filename | Main Module Size |
| [filename of the sample #1] | [file and pathname of the sample #1] | 65,536 bytes |
 | Other details |
[McAfee] [Sophos] [Ikarus]| What's been found | Severity Level |
| Downloads/requests other files from Internet. | |
| Registers a 32-bit in-process server DLL. | |
| Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module). | |
| Contains characteristics of an identified security risk. |  |
 | Possible Security Risk |
| Security Risk | Description |
| Adware.BHO.GEN |
Adware.BHO.GEN is adware that use BHOs to display ads or can be used for malicious purposes like gathering info on your surfing habits. It also has the functionality to download and install further malicious files from remote servers. |
| Trojan.FakeAlert |
Trojan.FakeAlert will hijack the desktop background with an image alerting the user that their computer system has been infected with spyware. It also changes some settings of windows which include:- disabling permissions for the user to change the background image and setting the active desktop to 'show web content'. It is usually installed in conjunction with a rogue anti-spyware application. |
| File System Modifications |
| # | Filename(s) | File Size | File Hash | Alias |
| 1 |
%System%\msxml71.dll
|
126,980 bytes | MD5: 0x05012C010CC9CF546ACD195D1121DE5B SHA-1: 0xFF8C32651E8B2B9975FB1D9F5B3EA056D3EA2413 |
(not available) |
| 2 | [file and pathname of the sample #1] | 65,028 bytes | MD5: 0xAC2CD625100E10002427091064409416 SHA-1: 0x4A239416503B6EDA8B2EDA225A53E254400CEEB3 |
packed with PE_Patch [Kaspersky Lab] |
| 3 | [file and pathname of the sample #2] | 140,804 bytes | MD5: 0x6BC9AAAB2A9F763F89E22DC5FC4E188F SHA-1: 0x0F397C249E985CF103B75BA582D010327AED02FC |
(not available) |
| 4 | [file and pathname of the sample #3] | 72,704 bytes | MD5: 0xE27831CA7852B885624552ED87A90353 SHA-1: 0xAB35D9CEAA3C011536025B48AF92D62E29B55DFA |
Generic Dropper.cx [McAfee] |
| 5 | [file and pathname of the sample #4] | 74,251 bytes | MD5: 0xE4326CA961B5DEF229EB6A3BFFBE5C98 SHA-1: 0xDE829E5B45EFE0F0143F8B0EA6A711371508D988 |
Mal/FakeAV-AH [Sophos] Trojan-Downloader.Win32.FraudLoad [Ikarus] |
| Memory Modifications |
| Process Name | Process Filename | Main Module Size |
| [filename of the sample #2] | [file and pathname of the sample #2] | 163,840 bytes |
| [filename of the sample #4] | [file and pathname of the sample #4] | 118,784 bytes |
| [filename of the sample #3] | [file and pathname of the sample #3] | 139,264 bytes |
| Module Name | Module Filename | Address Space Details |
| msxml71.dll | %System%\msxml71.dll | Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0xF80000 - 0xFC5000 |
 | Registry Modifications |
| Other details |
| Server Name | Server Port | Connect as User | Connection Password |
| last-visit.com | 80 | (null) | (null) |
[PCTools] [Symantec] [Kaspersky Lab] [Trend Micro] [Ikarus] [AhnLab]| What's been found | Severity Level |
| Downloads/requests other files from Internet. | |
| Registers a 32-bit in-process server DLL. | |
| Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module). | |
| Contains characteristics of an identified security risk. | |
| Possible Security Risk |
| Security Risk | Description |
| Adware.BHO.GEN |
Adware.BHO.GEN is adware that use BHOs to display ads or can be used for malicious purposes like gathering info on your surfing habits. It also has the functionality to download and install further malicious files from remote servers. |
| Trojan.FakeAlert |
Trojan.FakeAlert will hijack the desktop background with an image alerting the user that their computer system has been infected with spyware. It also changes some settings of windows which include:- disabling permissions for the user to change the background image and setting the active desktop to 'show web content'. It is usually installed in conjunction with a rogue anti-spyware application. |
| Trojan.Agent.ASMU |
Trojan.Agent.ASMU is a malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment. |
| Threat Category | Description |
 |
A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment |
| File System Modifications |
| # | Filename(s) | File Size | File Hash | Alias |
| 1 | [file and pathname of the sample #1] | 118,276 bytes | MD5: 0x281D3D14925F71B9A393625EADFC7CA8 SHA-1: 0xD87ECA0C1A9E492F205D267775F83F38BB919A37 |
Trojan.Agent.ASMU [PCTools] Trojan Horse [Symantec]Trojan.Win32.Agent.asmu [Kaspersky Lab]TROJ_AGENT.APO [Trend Micro]AdWare.BHO [Ikarus]Win-Trojan/Bho.118276 [AhnLab]packed with PE_Patch.UPX [Kaspersky Lab] |
| Memory Modifications |
| Process Name | Process Filename | Main Module Size |
| [generic host process] | [generic host process filename] | 20,480 bytes |
| Module Name | Module Filename | Address Space Details |
| [filename of the sample #1] | [file and pathname of the sample #1] | Process name: [generic host process] Process filename: [generic host process filename] Address space: 0xAA0000 - 0xAF6000 |
| [filename of the sample #1] | [file and pathname of the sample #1] | Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0xF80000 - 0xFD6000 |
| Registry Modifications |
| Other details |
| Server Name | Server Port | Connect as User | Connection Password |
| ?id=g | 80 | (null) | (null) |
All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.
The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.
Copyright © 2010 ThreatExpert. All rights reserved.