Submission Summary:

• Submission details:
• Submission received: 27 May 2009, 18:53:00
• Processing time: 5 min 13 sec
• Submitted sample:
• File MD5: 0xC5336FE6410A9A7FAC06D3087F3340A7
• File SHA-1: 0x6FD2C4F22A351CAF509785A9BC3405DC8D1060CB
• Filesize: 183,296 bytes
• Alias & packer info:
• Trojan Horse [Symantec]
• Trojan-Downloader.Win32.VB.mng [Kaspersky Lab]
• Generic Downloader.x!bu [McAfee]
• Mal/VB-G [Sophos]
• Trojan-Banker.Win32.Bancos [Ikarus]
• Win-Trojan/Xema.variant [AhnLab]
• packed with: PE_Patch.UPX [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\3361\a	33 bytes	MD5: 0xD789D0EAE4935B7486B64CC9D114DB85 SHA-1: 0x88CC8F0A349D86177D164A50586393886C89ADAC	(not available)
2	%System%\3361\SVCHOST.EXE	65,536 bytes	MD5: 0x90C109DDE2A18E873FDA2C240C3BE590 SHA-1: 0xE507C125CAB21813B10EFD3BFDDAAA06C5777BFC	Trojan-Clicker.VB.cwf [PCTools] Trojan Horse [Symantec] Trojan-Clicker.Win32.VB.cwf [Kaspersky Lab] Generic.dx!cn [McAfee] Mal/VB-G [Sophos]
3	[file and pathname of the sample #1]	183,296 bytes	MD5: 0xC5336FE6410A9A7FAC06D3087F3340A7 SHA-1: 0x6FD2C4F22A351CAF509785A9BC3405DC8D1060CB	Trojan Horse [Symantec] Trojan-Downloader.Win32.VB.mng [Kaspersky Lab] Generic Downloader.x!bu [McAfee] Mal/VB-G [Sophos] Trojan-Banker.Win32.Bancos [Ikarus] Win-Trojan/Xema.variant [AhnLab] packed with PE_Patch.UPX [Kaspersky Lab]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• %System%\3361

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[generic host process]	[generic host process filename]	20,480 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	299,008 bytes
SVCHOST.EXE	%System%\3361\SVCHOST.EXE	73,728 bytes

• Notes:
• [generic host process filename] is a full path filename of [generic host process].

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig\DEBUG

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig\DEBUG]
• Trace Level = ""
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
• Use FormSuggest = "yes"
• [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
• Use FormSuggest = "yes"
• DisableScriptDebuggerIE = "yes"
• Error Dlg Displayed On Every Error = "no"
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
• Use FormSuggest = "yes"
• DisableScriptDebuggerIE = "yes"
• Error Dlg Displayed On Every Error = "no"

• The following Registry Value was deleted:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32]
• InprocServer32 = "IW[F9`$@Q?NcrI3z%N[,>`NTP6lYuf(laaqF-Q9q."

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}]
• (Default) = "Microsoft WinSock Control, version 6.0 (SP6)"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32]
• (Default) = "%System%\MSWINSCK.OCX"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32]
• (Default) = "%System%\MSWINSCK.OCX, 1"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32]
• (Default) = "%System%\MSWINSCK.OCX"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSWinsock.Winsock]
• (Default) = "Microsoft WinSock Control, version 6.0 (SP6)"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1]
• (Default) = "Microsoft WinSock Control, version 6.0 (SP6)"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0]
• (Default) = "Microsoft Winsock Control 6.0 (SP6)"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32]
• (Default) = "%System%\MSWINSCK.OCX"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR]
• (Default) = ""
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug]
• Auto = "0"
• [HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\Explorer\Navigating\.Current]
• (Default) = ""
• [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
• Cookies = "%UserProfile%\Cookies"
• Cache = "%LocalSettings%\Temporary Internet Files"
• History = "%LocalSettings%\History"
• [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1601 = 0x00000000
• [HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Current]
• (Default) = ""
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1601 = 0x00000000

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China

• The following Host Name was requested from a host database:
• pk.ub9.net

• The following HTTP URL was started reading:
• http://pk.ub9.net/PushMission2Client03.asp?MAC=&Publicer=kk_01