Submission Summary:

• Submission details:
• Submission received: 7 September 2012, 08:13:29
• Processing time: 8 min 1 sec
• Submitted sample:
• File MD5: 0xC27F0CF63E747FB1541ACE0BF9713A2E
• File SHA-1: 0x5D908D5258572EC25ECB783F5F206E6B39D1163E
• Filesize: 44,544 bytes
• Alias:
• Worm:Win32/Chiviper.C [Microsoft]
• Trojan-Downloader.Win32.Small [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\000ec83.tmp	44,544 bytes	MD5: 0xC94A8CC4DA89D6F3378D4812520EA670 SHA-1: 0xF7FCA0CFCFBFD3ABCD4B7FBDB46F3325462CB546	Worm:Win32/Chiviper.C [Microsoft] Trojan-Downloader.Win32.Small [Ikarus]
2	[file and pathname of the sample #1]	44,544 bytes	MD5: 0xC27F0CF63E747FB1541ACE0BF9713A2E SHA-1: 0x5D908D5258572EC25ECB783F5F206E6B39D1163E	Worm:Win32/Chiviper.C [Microsoft] Trojan-Downloader.Win32.Small [Ikarus]
3	%Windir%\usp10.dll	11,264 bytes	MD5: 0x11218062A91273D2D0A478A9CF93629E SHA-1: 0x6695B8816C895A5585782C0C375776B5B32B8970	Worm:Win32/Chiviper.C [Microsoft] Trojan-Downloader.Win32.Small [Ikarus]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Registry Modifications

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager]
• ExcludeFromKnownDlls =
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
• ExcludeFromKnownDlls =

Other details

• To mark the presence in the system, the following Mutex object was created:
• WinSDK32

• The following Host Name was requested from a host database:
• 192.5.5.241

• The data identified by the following URLs was then requested from the remote web server:
• http://tx.fokvlzlwlel.com/css/m821.txt
• http://liang5.xcnowkfla.com/tj/post.asp?d10=&d11=ver-czcz-96&d21=54&d22=xp

Downloaded File Summary:

• Download details:
• Download retrieved: 7 September 2012 08:21:31
• Processing time: 7 min 46 sec
• Downloaded sample:
• File MD5: 0x80CB04C1663D02476935F8F6E09D1813
• File SHA-1: 0x8C7E4244AF7BA340004E0818D5723568E208F0E7
• Filesize: 90,112 bytes
• Alias:
• Trojan.Gampass.E [Symantec]
• PWS:Win32/OnLineGames.KQ [Microsoft]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following file was modified:
• %System%\ws2help.dll

Memory Modifications

• There was a new process created in the system:

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
WS2HELP.dll	%Windir%\com	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0x3E0000 - 0x3FC000
ws2helpxp.dll	%System%\ws2helpxp.dll	Process name: VMwareUser.exe Process filename: %ProgramFiles%\vmware\vmware tools\vmwareuser.exe Address space: 0x71AA0000 - 0x71AA8000

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Republic of Korea

• To mark the presence in the system, the following Mutex object was created:
• SDFLKJSL32

• The following Host Name was requested from a host database:
• 192.5.5.241