Submission Summary:

• Submission details:
• Submission received: 26 October 2012, 10:14:49
• Processing time: 13 min 50 sec
• Submitted sample:
• File MD5: 0x97E9EE53ACC897F5FB8ACEF6EF7FEBD2
• File SHA-1: 0xC59D3ADCC6E9670D3BBC0B371847DE147D1B68D0
• Filesize: 70,656 bytes

• Summary of the findings:

What's been found	Severity Level
Capability to steal information such personal financial data (credit card numbers, online banking login details), user profiles, software registration keys, passwords.
Produces outbound traffic.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following file was created in the system:

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\WinRAR

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\WinRAR]
• HWID = 7B 46 31 41 41 34 33 34 31 2D 44 36 38 43 2D 34 45 35 39 2D 41 36 44 46 2D 41 34 42 42 37 32 36 35 41 43 39 41 7D

Other details

• The following Host Names were requested from a host database:
• 210.56.23.100
• 61.7.235.35
• 59.90.221.6
• 200.169.13.84

• There was registered attempt to establish connection with the remote host. The connection details are:

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 8080: