Submission Summary:

• Submission details:
• Submission received: 4 August 2012, 08:25:23
• Processing time: 10 min 3 sec
• Submitted sample:
• File MD5: 0x8D23B14C0CE7A6F3E16836891214B0A1
• File SHA-1: 0xC673A940AB932DD23A23910CD8004194886D7E05
• Filesize: 111,616 bytes
• Alias:
• Trojan.FakeAV [Symantec]
• Trojan-PSW.Win32.LdPinch.agwd [Kaspersky Lab]
• Downloader-ASH.gen.b [McAfee]
• Mal/EncPk-FO [Sophos]
• Rogue:Win32/Fakeinit [Microsoft]
• Trojan-PWS.Win32.LdPinch [Ikarus]
• Win-Trojan/Fakealert.111616.B [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	An exploit code that takes advantage of an existing software vulnerability
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\mousehook.dll	22,016 bytes	MD5: 0x5888BF5B96ABACA2333634169E6A3E84 SHA-1: 0x01BFC5F7313D713DF165D9AC37563EECBA6623E9	Trojan Horse [Symantec] Trojan.Win32.Agent2.dfq [Kaspersky Lab] Downloader-ASH.gen.f [McAfee] Mal/EncPk-XF [Sophos] Rogue:Win32/Fakeinit [Microsoft] Trojan.Win32.Agent [Ikarus] Win-Trojan/Xema.variant [AhnLab]
2	%Temp%\ntdll64.dll	46,080 bytes	MD5: 0xE76D06190112C2574D7ABA667FCE3465 SHA-1: 0xD9B62F8FE185749E196E5672817A867904403C3F	Trojan Horse [Symantec] Exploit.Win32.IMG-WMF.ki [Kaspersky Lab] Downloader-ASH.gen.f [McAfee] Mal/EncPk-XF [Sophos] Rogue:Win32/Fakeinit [Microsoft] Exploit.Win32.IMG-WMF [Ikarus] Win-Trojan/Img-wmf.46080.H [AhnLab]
3	%System%\dllcache\userinit.exe [file and pathname of the sample #1]	111,616 bytes	MD5: 0x8D23B14C0CE7A6F3E16836891214B0A1 SHA-1: 0xC673A940AB932DD23A23910CD8004194886D7E05	Trojan.FakeAV [Symantec] Trojan-PSW.Win32.LdPinch.agwd [Kaspersky Lab] Downloader-ASH.gen.b [McAfee] Mal/EncPk-FO [Sophos] Rogue:Win32/Fakeinit [Microsoft] Trojan-PWS.Win32.LdPinch [Ikarus] Win-Trojan/Fakealert.111616.B [AhnLab]
4	%System%\init32.exe	24,576 bytes	MD5: 0x39B1FFB03C2296323832ACBAE50D2AFF SHA-1: 0xE5AEDCBE25A97C89101F1F3860FF846E94D70445	(not available)

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following file was modified:
• %System%\userinit.exe

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	122,880 bytes
init32.exe	%System%\init32.exe	32,768 bytes
userinit.exe	%System%\dllcache\userinit.exe	122,880 bytes
[generic host process]	[generic host process filename]	20,480 bytes

• Notes:
• [generic host process filename] is a full path filename of [generic host process].

Registry Modifications

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software]
• 2a422c91-6984-47e4-94be-04c4fad5f8d8 = 0x00000001
• 1099ce4a-ff51-4a8d-ab3c-c74b9c06e46f = 0x0000000E
• [HKEY_CURRENT_USER\Software\Microsoft]
• WinId = "{0DFD3B09-1732-4DEC-9117-A68546E141BD}"

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Providers]
• LogonTime =
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers]
• LogonTime =

Other details

• To mark the presence in the system, the following Mutex object was created:
• Config Mutex

• The data identified by the following URL was then requested from the remote web server:
• http://lsp-test-nax.ind.in/?a=conf&code=14

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %Temp%\mousehook.dll