Submission Summary:

• Submission details:
• Submission received: 13 August 2012, 02:27:33
• Processing time: 7 min 52 sec
• Submitted sample:
• File MD5: 0xCD67FE5426FE9CE9547B52AA395F960B
• File SHA-1: 0x40131880CE8800BA622D1B8A6A9C41AAF5F467DF
• Filesize: 34,816 bytes
• Alias & packer info:
• Downloader [Symantec]
• Trojan-Downloader.Win32.Geral.almp [Kaspersky Lab]
• Troj/Agent-UWR [Sophos]
• Trojan-Downloader.Win32.Geral [Ikarus]
• packed with: UPX [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%ProgramFiles%\Common Files\rkdltecq\qioifz.pif [file and pathname of the sample #1]	34,816 bytes	MD5: 0xCD67FE5426FE9CE9547B52AA395F960B SHA-1: 0x40131880CE8800BA622D1B8A6A9C41AAF5F467DF	Downloader [Symantec] Trojan-Downloader.Win32.Geral.almp [Kaspersky Lab] Troj/Agent-UWR [Sophos] Trojan-Downloader.Win32.Geral [Ikarus] packed with UPX [Kaspersky Lab]
2	%System%\97984.DEP	5,302,272 bytes	MD5: 0x3A86F218B5177EFDF52258F0BD20BA01 SHA-1: 0xD2A2D124A6124EA3E79D40544076DDDADA7F50B3	Trojan-Downloader.Win32.Geral.alms [Kaspersky Lab] Trojan-Downloader.Win32.Geral [Ikarus]

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• %ProgramFiles%\Common Files\rkdltecq

Memory Modifications

• There was a new process created in the system:

• The following module was loaded into the address space of other process(es):

• The following system service was modified:

Service Name	Display Name	New Status	Service Filename
PolicyAgent	IPSEC Services	"Stopped"	%System%\lsass.exe

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32]
• (Default) = "%System%\97984.DEP"

• The following Registry Value was deleted:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32]
• (Default) = "%System%\webcheck.dll"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China

• To mark the presence in the system, the following Mutex object was created:
• QINGCHULIULANGDONGWU

• The following Host Name was requested from a host database:
• 192.5.5.241

• The following Internet download was started (the retrieved bits are saved into the local file):

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.