Submission Summary:

• Submission details:
• Submission received: 22 November 2008, 10:05:45
• Processing time: 6 min 54 sec
• Submitted sample:
• File MD5: 0xC70F0605D37F0CE4AD4DBFFB01B6C51C
• File SHA-1: 0x5893E7012BFEE67EBDB354BCC8AFA039F5CF77A6
• Filesize: 499,836 bytes

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Uses the AppInit_DLLs value in order to install a module that will be loaded into the address space of every running application.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\belomemu.dll %Temp%\jezemimu.dll %Temp%\wokohebu.dll	62,464 bytes	MD5: 0x01CEDF3F64831446927DB793188AF4A4 SHA-1: 0xF40D89EF597A5F6D0968CA067DB0CC1D53B8BD82	Trojan:Win32/Vundo.JD.dll [Microsoft]
2	%Temp%\ihuwipip.ini	1,583,621 bytes	MD5: 0x4444FD4EF2F821EDE80C2F51344FFBA7 SHA-1: 0xE0E6CB5788483259A0B42DA6F921CD96CB23DED3	(not available)
3	%Temp%\yozuluge	8,812 bytes	MD5: 0xB4C3C2BA2A0EC71818AD6A58B75B2C07 SHA-1: 0x684E76E0DF34387623FD152FD4FB2A81ABD015F0	(not available)
4	%System%\duwidabi	1,744 bytes	MD5: 0xCEEC6C285C3CEBE99B779168EFDF8F44 SHA-1: 0xD796ED99E029DB97A20833AE0EA4AEB58288516A	(not available)
5	%System%\poyimimu.dll %System%\suluyeba.dll %System%\werolime.dll	62,464 bytes	MD5: 0x5C399CAE23A1F64F9D59F8470384D784 SHA-1: 0x2B59B90B6F40754CC695184999F69F0A2AE6E215	Trojan:Win32/Vundo.JD.dll [Microsoft]
6	[file and pathname of the sample #1]	499,836 bytes	MD5: 0xC70F0605D37F0CE4AD4DBFFB01B6C51C SHA-1: 0x5893E7012BFEE67EBDB354BCC8AFA039F5CF77A6	(not available)

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
suluyeba.dll	%System%\suluyeba.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x19C0000 - 0x19DD6B3
suluyeba.dll	%System%\suluyeba.dll	Process name: dllhost.exe Process filename: %System%\dllhost.exe Address space: 0x2530000 - 0x254D6B3

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• The following system service was modified:

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{61a50a06-dcbf-4614-8a3f-f94fded84534}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{61a50a06-dcbf-4614-8a3f-f94fded84534}\InprocServer32
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{61a50a06-dcbf-4614-8a3f-f94fded84534}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\fifahosa

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{61a50a06-dcbf-4614-8a3f-f94fded84534}\InprocServer32]
• (Default) = "%System%\suluyeba.dll"
• ThreadingModel = "Both"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• wupipenimi = "Rundll32.exe "%System%\poyimimu.dll",s"

so that poyimimu.dll runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
• LoadAppInit_DLLs = 0x00000001
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\fifahosa]
• suhefuga = AA D9 52 6F 1B 45 FC B0 F5 8E AE 9C B9 F4 9E F9 B1 85 FE 9B C5 B1 D4 E9 8B BB DB A4 8C C9 A5 D3 CC A7 AA FA B0 AC EC 8B 90 D1 F0 FE E7 BC AB E5 DF C4 BC A6 A6 F7 CC A3 D3 83 FC 8D E2 AC E4 E2 FB FA B3 98 FD 9D DB EA 85 AD FD 9C 84 E0 9B B0 A6 AF BC 8

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
• AppInit_DLLs = "%System%\werolime.dll"

so that werolime.dll runs every time a Windows application starts

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa]
• Notification Packages = 73 63 65 63 6C 69 00 43 3A 5C 57 49 4E 44 4F 57 53 5C 73 79 73 74 65 6D 33 32 5C 77 65 72 6F 6C 69 6D 65 2E 64 6C 6C 00
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
• Notification Packages = 73 63 65 63 6C 69 00 43 3A 5C 57 49 4E 44 4F 57 53 5C 73 79 73 74 65 6D 33 32 5C 77 65 72 6F 6C 69 6D 65 2E 64 6C 6C 00

Other details

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %System%\suluyeba.dll