ThreatExpert Report: Trojan Horse, Generic.dx, Mal/Generic-L

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 23 October 2012, 12:20:16
Processing time: 7 min 45 sec
Submitted sample:

File MD5: 0xB36739FA40FA26F2895038F6FC119599
File SHA-1: 0x320D60AFA340102A9FAFE35E2A28F4BBF34A7123
Filesize: 117,671 bytes

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

Possible Security Risk

Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\gameguru.nfo	167 bytes	MD5: 0x7ACBC9F87284654CB636B7074DECA66E SHA-1: 0xCB7F9D14639DE1849386B74CDA3EE965BE3B9538	(not available)
2	%Temp%\unl-graw.exe	120,320 bytes	MD5: 0x16D81016018E85983F593006E5D56796 SHA-1: 0x9B2D7A6CAB82AA041224C76999EC83A9B5CE9FF5	Trojan Horse [Symantec] Generic.dx [McAfee] Mal/Generic-L [Sophos] packed with UPX [Kaspersky Lab]
3	%Temp%\unl.nfo	4,147 bytes	MD5: 0x9E3100F099FFC5D9DD2B197812555579 SHA-1: 0xA6D9321C31B4FF470B026BBAD09DA04DFD75B050	(not available)
4	%Temp%\unleashed.nfo	4,069 bytes	MD5: 0xA88AE561D3DE0A5B90DDE04B4C5CE11C SHA-1: 0x300E5DB3258E5D6E0A5A6FE3EC86C27FAEF6073D	(not available)
5	%System%\miccyhook.dll	184,320 bytes	MD5: 0xECB4610233F86771AF9201F29F2B109D SHA-1: 0xF5794B4A1CE2E7509C6DD3EEF65ED7DDC10E2DE3	(not available)
6	[file and pathname of the sample #1]	117,671 bytes	MD5: 0xB36739FA40FA26F2895038F6FC119599 SHA-1: 0x320D60AFA340102A9FAFE35E2A28F4BBF34A7123	(not available)

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
unl-graw.exe	%Temp%\unl-graw.exe	925,696 bytes

Other details

To mark the presence in the system, the following Mutex objects were created:

DDrawWindowListMutex
__DDrawExclMode__

The following Host Name was requested from a host database:

192.5.5.241

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.