Submission Summary:

• Submission details:
• Submission received: 23 October 2009, 15:18:36
• Processing time: 6 min 7 sec
• Submitted sample:
• File MD5: 0x9F832F22F12CCE6452FF13D5810A5968
• File SHA-1: 0x4D0C8173AEC900F016FE6B2DDBCCB7C673B0A810
• Filesize: 160,256 bytes
• Alias:
• Packed.Win32.Krap.ae [Kaspersky Lab]
• Downloader-BWS [McAfee]
• Mal/EncPk-JY [Sophos]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan.FakeAlert	Trojan.FakeAlert will hijack the desktop background with an image alerting the user that their computer system has been infected with spyware. It also changes some settings of windows which include:- disabling permissions for the user to change the background image and setting the active desktop to 'show web content'. It is usually installed in conjunction with a rogue anti-spyware application.

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\a.exe	141,828 bytes	MD5: 0x6DC3C9F9897BFFE7ED1B4EDE095D34C8 SHA-1: 0xCC050CFF7D2D5E7C569FAD2C1943AA3CC28C55DA	(not available)
2	[file and pathname of the sample #1]	160,256 bytes	MD5: 0x9F832F22F12CCE6452FF13D5810A5968 SHA-1: 0x4D0C8173AEC900F016FE6B2DDBCCB7C673B0A810	Packed.Win32.Krap.ae [Kaspersky Lab] Downloader-BWS [McAfee] Mal/EncPk-JY [Sophos]
3	%Windir%\Tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job	274 bytes	MD5: 0xEB55722DCD7C2A74B43970395AA2B14E SHA-1: 0xECB8EF4B7EF2309BEF937C731E27241B0EFDA6B2	(not available)

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\PopRock
• HKEY_CURRENT_USER\Software\XML

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• PopRock = "[file and pathname of the sample #1]"

so that [file and pathname of the sample #1] runs every time Windows starts

• [HKEY_CURRENT_USER\Software\PopRock]
• Az2 = "xC7aKZ+O6wyPlq1krRM4sG7m2LFGsYtHjHOagBf10Uk/n4gL8s8xs9LeD5KQVh3/j+XFa0mnr175UElKKyciA2gn6tUEA721Fj4P"
• Az0 = "tSLPLpWL7R22spR48AI743bz2Kge8sEIxFugpDOyghR618ly+M4489fIXLOoA1y40bDLSHfmqFGibGAgBm5nbT1nqNtCQvnyHiYJsDUSJq7PT/aTkb1xwhcY/GYFxA6strUiTjrqunRFkl5qtPEQSBiCsHqWOZdHSHKqf+J3UnOWDI3+pNT7vNp4uIhsj5nAC3whY7qn2tRps6P9OO+IOdiz+7pv34D0whI0iJ0qi1ipX4afIFvkxeA7l
• Az1 = "tSbFNJuL/h22spR48AI743bz2Kge8sESyUnkuje0lQRnidIz9cR7v8rAAL6rBEy0zK3LSHfmqFGibGAgBm5nbT1nqNtCQvnyHiYJujMHN6zGUu+Pjr1rwhcY/GYF1AStvbwlSX31vCoJ1Vsk97pvLi+zzwHGbIZZEWGsO7BsAXPHCtu0vJqg45My9o5ngpnbB2whcqu/0MMruaL1Oe6IJpOk7Louw53wl1Iv1IF89m66BZOWaj6HjfE="
• Av4 = 0x00015180
• Av5 = 0x00000002
• Av2 = 0x01CA54F7
• Av3 = 0xFA51F190
• Av6 = 0x00000001
• Av0 = 0x01CA5431
• Av1 = 0x68DF0F20
• Az4 = "7SDUIc7NyUn+3v4U1kYCuFW1zbQUrrs91Uiwuz65qx9Nk5xk/cwysdaVeIiwR0SEi7WoDWq93ivkK298QjAhKyFXr6IFUaa1ckpl/G5LOrTCcsqayrFNxHEr+lJFjx+OlIwiUDTQg25XinoX3slUXmrIkTzgIpdtHiHpU/MsOCmfU9i5+pXDu9UR7p420oCQL2ZlZuz7+v9Ij4/uVb22OrOI16VL4YzYmTMo758Gv1LTb4fFLiaNtaUpn

Other details

• The following port was open in the system:

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URLs was then requested from the remote web server:
• http://theimagesusa.com/resolution.php
• http://new-search-zone.com/borders.php
• http://www.asklots.com/jump1/?affiliate=mu1&subid=93928&terms=materials%20used%20to%20build%20a%20cornhole%20game&sid=Z259044623%40MzXyITOzIDOx8VO3cjMfJjMfNTNy8lNxQTOyMjN1ITM&a=zh5&mr=1&rc=0
• http://www.asklots.com/backcookie.js
• http://soloartsworld.com/udt/10f05ced714ae4804420debbc44b88ad4ef2ca1c56f74ec8168831d23664ff425c442bc98c1e4cd03/1155/726/2485007412a/3/utd.jpg