Submission Summary:

• Submission details:
• Submission received: 4 November 2009, 03:47:29
• Processing time: 5 min 10 sec
• Submitted sample:
• File MD5: 0x9A94D87E272770F80AEE56256B4676C8
• File SHA-1: 0x80656FC27623F8B17F4F185486FD509744D077E7
• Filesize: 12,288 bytes
• Alias & packer info:
• Downloader [Symantec]
• Trojan-Downloader.Win32.Genome.vpd [Kaspersky Lab]
• Trojan-PWS.Win32.Lineage.IV [Ikarus]
• Win-Trojan/Dadobra.11776 [AhnLab]
• packed with: PE_Patch.PECompact [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Net-Worm.Koobface	Net-Worm.Koobface is a network-aware worm that attempts to replicate across the existing network(s) and also can be used to hijack certain aspects of users' web browser functionality (such as homepage, search page, and security settings).
Backdoor.Rbot.AEU	Backdoor.Rbot.AEU is a backdoor trojan which opens network ports and attempts to allow an attacker unauthorized access to the infected machine without users knowledge.

• Attention! The following threat categories were identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonPrograms%\Startup\dll32.exe %System%\dll32.exe %System%\msndll.exe	184,320 bytes	MD5: 0xD534CF3DCA6ECC4246D2C7663FA35D5E SHA-1: 0xCB05907D485DD91F46371D483B63EF551CCEC60E	Downloader [Symantec] Trojan-Downloader.Win32.Banload.bej [Kaspersky Lab] Virus.Win32.Bancos [Ikarus] Win-Trojan/Banload.436736 [AhnLab] packed with PE_Patch.PECompact [Kaspersky Lab]
2	%System%\msdll.exe	156,160 bytes	MD5: 0x57E44ACF6348ECBA0C1CAB52B18BAE55 SHA-1: 0xC0707F1997A6865D3616C45731A186F414105C18	Infostealer.Bancos [Symantec] Trojan-Banker.Win32.Banker.agh [Kaspersky Lab] Mal/Behav-043 [Sophos] Trojan-Downloader.Win32.Banload [Ikarus] packed with PE_Patch.PECompact [Kaspersky Lab]
3	[file and pathname of the sample #1]	12,288 bytes	MD5: 0x9A94D87E272770F80AEE56256B4676C8 SHA-1: 0x80656FC27623F8B17F4F185486FD509744D077E7	Downloader [Symantec] Trojan-Downloader.Win32.Genome.vpd [Kaspersky Lab] Trojan-PWS.Win32.Lineage.IV [Ikarus] Win-Trojan/Dadobra.11776 [AhnLab] packed with PE_Patch.PECompact [Kaspersky Lab]

• Notes:
• %CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
msdll.exe	%System%\msdll.exe	438,272 bytes
msndll.exe	%System%\msndll.exe	499,712 bytes
dll32.exe	%System%\dll32.exe	499,712 bytes
dll32.exe	%CommonPrograms%\startup\dll32.exe	499,712 bytes

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Microsoft Redirect = "%System%\msdll.exe"
• dll32 = "%System%\dll32.exe"

so that msdll.exe runs every time Windows starts
so that dll32.exe runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Brazil

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URLs was then requested from the remote web server:
• http://www.webbradesconet.com/avisos.php
• http://www.legendgundogs.com/Scripts/_vti_cnf/RunActiveContent.js
• http://www.legendgundogs.com/Scripts/_vti_cnf/msn.js