Submission Summary:

• Submission details:
• Submission received: 14 January 2009, 10:46:54
• Processing time: 5 min 24 sec
• Submitted sample:
• File MD5: 0xBA0069B922185D5048A5A8094E9E0824
• File SHA-1: 0x12762096FE398A756BC41DE18A3EA5FB3486756C
• Filesize: 97,091 bytes
• Alias:
• TrojanDownloader:Win32/Frethog.C [Microsoft]
• Worm.Win32.Viking [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Registers a 32-bit in-process server DLL.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\AhnRpta.exe	69,120 bytes	MD5: 0x388B8FBC36A8558587AFC90FB23A3B99 SHA-1: 0xED55AD0A7078651857BD8FC0EEDD8B07F94594CC	(not available)
2	%System%\afmain0.dll	78,848 bytes	MD5: 0xC7926ABA862831526A6D6E1B64B8A85A SHA-1: 0x45ED45C26573364686B25A07D57ECC824925F314	TrojanDownloader:Win32/Frethog.C [Microsoft] Worm.Win32.Viking [Ikarus] packed with PE_Patch [Kaspersky Lab]
3	[file and pathname of the sample #1]	97,091 bytes	MD5: 0xBA0069B922185D5048A5A8094E9E0824 SHA-1: 0x12762096FE398A756BC41DE18A3EA5FB3486756C	TrojanDownloader:Win32/Frethog.C [Microsoft] Worm.Win32.Viking [Ikarus]

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
AhnRpta.exe	%Windir%\ahnrpta.exe	81,920 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	225,280 bytes

• There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	524,288 bytes

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
afmain0.dll	%System%\afmain0.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x19C0000 - 0x19EB000
afmain0.dll	%System%\afmain0.dll	Process name: dllhost.exe Process filename: %System%\dllhost.exe Address space: 0x2530000 - 0x255B000
afmain0.dll	%System%\afmain0.dll	Process name: sdnsmain.exe Process filename: %Windir%\dns\sdnsmain.exe Address space: 0x1620000 - 0x164B000
afmain0.dll	%System%\afmain0.dll	Process name: AhnRpta.exe Process filename: %Windir%\ahnrpta.exe Address space: 0x8D0000 - 0x8FB000
afmain0.dll	%System%\afmain0.dll	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0xC50000 - 0xC7B000

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB4C402F-882A-4526-8C08-51278EA437C1}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB4C402F-882A-4526-8C08-51278EA437C1}\InprocServer32
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB4C402F-882A-8C08-4526-51278EA437C1}

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB4C402F-882A-4526-8C08-51278EA437C1}\InprocServer32]
• (Default) = "%System%\afmain0.dll"
• ThreadingModel = "Apartment"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB4C402F-882A-8C08-4526-51278EA437C1}]
• VcbitExeModuleName = "[file and pathname of the sample #1]"
• VcbitDllModuleName = "%System%\afmain0.dll"
• VcbitSobjEventName = "CVBASDDOOPADSAMN_0"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
• {BB4C402F-882A-4526-8C08-51278EA437C1} = "hook dll rising"

Other details

• The following Internet downloads were started (the retrieved bits are saved into the local file):

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %System%\afmain0.dll