ThreatExpert Report: SecurityRisk.Downldr

Submission Summary:

Submission details:

Submission received: 11 August 2012, 22:48:47
Processing time: 10 min 50 sec
Submitted sample:

File MD5: 0x9B1A8928CB8A527CC79EFEE3940167AA
File SHA-1: 0x018B25E1988E0093C32DBEC8AF2FB445841F8531
Filesize: 395,656 bytes
Alias: SecurityRisk.Downldr [Symantec]

Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! The following threat category was identified:

Threat Category	Description
	A spyware program that represents security risk for a local system

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\license1.txt	10,969 bytes	MD5: 0xD86C48BFC889204F6C79091AECF94255 SHA-1: 0x91D5D7A4CF3F3F187FA05E1D3B94B494082691B9	(not available)
2	%ProgramFiles%\smarttip\SmartTipC.exe	735,400 bytes	MD5: 0x736DB0F737737A592FC4C2EDABF0A8E7 SHA-1: 0x3153A9AAC7912F36033F4FBC6E03981680C8322F	SecurityRisk.Downldr [Symantec]
3	%ProgramFiles%\smarttip\Uninstall.exe	85,076 bytes	MD5: 0xBEE2F50E34EA6110DD305D97476AE93C SHA-1: 0xAEAB9B855B51C5E4A8831DCF2F072462CCC524AF	(not available)
4	[file and pathname of the sample #1]	395,656 bytes	MD5: 0x9B1A8928CB8A527CC79EFEE3940167AA SHA-1: 0x018B25E1988E0093C32DBEC8AF2FB445841F8531	SecurityRisk.Downldr [Symantec]

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directory was created:

%ProgramFiles%\smarttip

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	667,648 bytes
SmartTipC.exe	%ProgramFiles%\smarttip\SmartTipC.exe	2,048,000 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\???????(SmartTip)

The newly created Registry Values are:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

smarttip = "%ProgramFiles%\smarttip\SmartTipC.exe /RUN"

so that SmartTipC.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\???????(SmartTip)]

DisplayName = "???????(SmartTip)"
InstallLocation = "%ProgramFiles%\smarttip"
UninstallString = "%ProgramFiles%\smarttip\Uninstall.exe"
DisplayIcon = "%ProgramFiles%\smarttip\SmartTipC.exe"
DisplayVersion = "1.0.0.1"
URLInfoAbout = "http://smarttip.co.kr"
Publisher = "TGSM"

Other details

Analysis of the file resources indicate the following possible country of origin:

Republic of Korea

To mark the presence in the system, the following Mutex object was created:

CSmartTipC.exe's One and Only Handle

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.