Submission Summary:

• Submission details:
• Submission received: 23 October 2012, 18:11:09
• Processing time: 10 min 35 sec
• Submitted sample:
• File MD5: 0xB1B94171A0304196CAE8C4497EA38D1F
• File SHA-1: 0xAD8229EA7FD2913DBB04A680313B307CD46A2F93
• Filesize: 503,296 bytes

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

• There was a new process created in the system:

• Notes:
• [generic host process filename] is a full path filename of [generic host process].

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0xB50000 - 0xBCE000
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0xB10000 - 0xB8E000
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0x1C90000 - 0x1D0E000

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Google
• HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome
• HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
• HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\cdjbnddbclciabnckgeahmneohjlahdm

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• [filename of the sample #1 without extension] = ""%System%\rundll32.exe" "[file and pathname of the sample #1]",_Size"

so that [file and pathname of the sample #1] runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\cdjbnddbclciabnckgeahmneohjlahdm]
• path = "%AppData%\chromeupdate.crx"
• version = "1.0"

Other details

• To mark the presence in the system, the following Mutex object was created:
• {22222222-2222-2222-2222-222222222222}

• The following Host Name was requested from a host database:
• pernowclick.com

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• [file and pathname of the sample #1]
• the hook is handled by its export "RichCompare()"