ThreatExpert Report: Trojan-Downloader.VB

Submission Summary:

Submission details:

Submission received: 22 October 2012, 12:42:00
Processing time: 12 min 2 sec
Submitted sample:

File MD5: 0xBC81D01B322676425A64FE87B3EA098C
File SHA-1: 0xBD31278746C6D1F7CD002B082FAD7C763A1A8520
Filesize: 98,304 bytes
Alias: Trojan-Downloader.VB [Ikarus]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	98,304 bytes	MD5: 0xBC81D01B322676425A64FE87B3EA098C SHA-1: 0xBD31278746C6D1F7CD002B082FAD7C763A1A8520	Trojan-Downloader.VB [Ikarus]

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	73,728 bytes

Other details

Analysis of the file resources indicate the following possible country of origin:

China

To mark the presence in the system, the following Mutex object was created:

BDBDBD

The data identified by the following URLs was then requested from the remote web server:

http://www.liuliangliuliang.com/?mac=&username=008&v=15&&&BC854C35B38577663D8B727CA6A3D2934E791A9D
http://www.liuliangliuliang.co m/4/result.php?mac=&kw=&v=15&username=008&&&res:// C:\WINDOWS\system32\shdoclc.dll/navcancl.htm
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.6951155
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=4.564917E-02
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.7127305
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.9193771
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.6779477
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.4898947
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.4596408
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.544014
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.4018421
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.7506877
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=4.493386E-02
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.1146233
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.5382463
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.543177
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.1503113
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.8077798
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.5330223
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.4311444
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.6459513
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.2815034
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.497071
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.9051293
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.1061338
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.8783846
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.3469571
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.7105542
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.5748649
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=7.870889E-02
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.1955349
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.4258493
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.5815027
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.2035823
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.9925722
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.2905775
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.4063817
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.3680561
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.4153764
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.2835597
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.5964378
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.6842518
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=9.418428E-03
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.4509994
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.7308336
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.7144864
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.5789587
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.4846081
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.4365833
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.174397
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.8276715
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.5497299
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.6541777
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.8860662
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.2492701
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.3634671
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.153209
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.9811468
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.2681322
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.5228044
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.2979961
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.353987
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.629924
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=8.273447E-02
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=6.320935E-02
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.3647552
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=4.222625E-02
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.3843828
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.2994958
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.7925651
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=6.515855E-02
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.1331328
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.2491038
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=3.860092E-02
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.2520046
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.7267505
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.3115087
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.579242
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.5398371
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.8335098
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=5.903703E-02
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.669188
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.8901429
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.2203175
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.502492
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.294584
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.1794478
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.8308381
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.6067784
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.3761454
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.3399419
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.113619
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=5.652767E-02
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.2222826
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.7501041
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.6002153
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.2717226
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.2322268
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.8753275
http://www.liuliangliuliang.com/4/getKw.php?mac=&v=15&username=008&rnd=0.7333151

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.