Submission Summary:

• Submission details:
• Submission received: 7 August 2012, 18:47:17
• Processing time: 9 min 3 sec
• Submitted sample:
• File MD5: 0xC5C015B355E2000064DDF4559E85A162
• File SHA-1: 0x3266F3DCC50C159B0D632F80D1D46508AB9BA309
• Filesize: 37,888 bytes
• Alias:
• Trojan.Gen.2 [Symantec]
• Trojan.Win32.Jorik.IRCbot.pjc [Kaspersky Lab]
• W32/Pinkslipbot.gen.be [McAfee]
• Worm:Win32/Autorun.AFV [Microsoft]
• Worm.Win32.AutoRun [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Communication with a remote IRC server.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\RECYCLER\logon.exe [file and pathname of the sample #1]	37,888 bytes	MD5: 0xC5C015B355E2000064DDF4559E85A162 SHA-1: 0x3266F3DCC50C159B0D632F80D1D46508AB9BA309	Trojan.Gen.2 [Symantec] Trojan.Win32.Jorik.IRCbot.pjc [Kaspersky Lab] W32/Pinkslipbot.gen.be [McAfee] Worm:Win32/Autorun.AFV [Microsoft] Worm.Win32.AutoRun [Ikarus]

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

• The following directory was created:
• %AppData%\RECYCLER

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	40,960 bytes
logon.exe	%AppData%\recycler\logon.exe	40,960 bytes

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations]
• LowRiskFileTypes = ".exe;.scr;"
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Remote Shell Manager = "%AppData%\RECYCLER\logon.exe"

so that logon.exe runs every time Windows starts

Other details

• The following Host Name was requested from a host database:
• d.theimagebook.com

• There was registered attempt to establish connection with the remote host. The connection details are:

Outbound traffic (potentially malicious)

• Attention! There was a new connection established with a remote IRC Server. The generated outbound IRC traffic is provided below: