Submission Summary:

• Submission details:
• Submission received: 15 July 2009, 21:57:51
• Processing time: 6 min 19 sec
• Submitted sample:
• File MD5: 0xC0F07A5675B3F2B08452E0F1D67B4517
• File SHA-1: 0x08E06FD120D95A68331F37F80C9FD6D6DBD6FB7F
• Filesize: 211,456 bytes
• Alias & packer info:
• Infostealer [Symantec]
• Generic PWS.y!dw [McAfee]
• Mal/Generic-A [Sophos]
• TrojanSpy:Win32/Sparsay.gen!A [Microsoft]
• Trojan-Spy.Win32.Sparsay [Ikarus]
• packed with: Execryptor [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Packed with a packer that is known to be used by malware (e.g. to complicate threat analysis or detection).
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan.Banker	Trojan.Banker steals information such as bank accounts, usernames, passwords and credit card details from your computer and sends it to the attacker.
Trojan-PWS.Delf.II	Trojan-PWS.Delf.II tries to steal usernames and passwords stored on the infected system and send them to an attackers.

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\mshelp.exe [file and pathname of the sample #1]	211,456 bytes	MD5: 0xC0F07A5675B3F2B08452E0F1D67B4517 SHA-1: 0x08E06FD120D95A68331F37F80C9FD6D6DBD6FB7F	Infostealer [Symantec] Generic PWS.y!dw [McAfee] Mal/Generic-A [Sophos] TrojanSpy:Win32/Sparsay.gen!A [Microsoft] Trojan-Spy.Win32.Sparsay [Ikarus] packed with Execryptor [Kaspersky Lab]
2	%System%\sqla.dll	16 bytes	MD5: 0xD9A6A1F8EE390C638A5FB3E58D35B2F3 SHA-1: 0xBA23C6296075C90C8961FDB9CC380FC1274F45DC	(not available)

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
mshelp.exe	%System%\mshelp.exe	1,449,984 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	1,449,984 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
• HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications
• HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\DHTMLSpy
• HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\DHTMLSpy\Settings

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Generic Host Process for WinXP Services = "mshelp.exe"

so that mshelp.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
• Generic Host Process for WinXP Services = "mshelp.exe"

so that mshelp.exe runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Russian Federation

• The following Internet downloads were started (the retrieved bits are saved into the local file):