Submission Summary:

• Submission details:
• Submission received: 31 July 2012, 07:28:22
• Processing time: 14 min 19 sec
• Submitted sample:
• File MD5: 0xCD6E6DE794CA2C50C09BD19BC0C92591
• File SHA-1: 0xD8BF07567FED8CBD8F030AF9742054460A8E14B9
• Filesize: 4,903,558 bytes
• Alias: Virus.Win32.Oliga [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Capability to send out email message(s) with the built-in SMTP client engine.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\CD Box Labeler Pro\calibrat.ini	276 bytes	MD5: 0x53646821B330CC80F220C3DC22A7D849 SHA-1: 0xBF393B29F3A9490F924A09E331E95A39234238B4	(not available)
2	%Temp%\31.exe	89,088 bytes	MD5: 0xDEDAAA08737885F36939ED13538048AF SHA-1: 0x222A4BA91B43FBCDA618FBAC5108FA1CFAA1E377	Trojan Horse [Symantec] Generic.dx!bcdp [McAfee] Mal/Generic-L [Sophos] Virus.Win32.Oliga [Ikarus]
3	%Temp%\32.EXE	8,065,024 bytes	MD5: 0xDDC1D8B05EF05356A90A560460B204A5 SHA-1: 0x7AE4E03462E370A71B2F7663F4B0E62E4D9D3594	(not available)
4	%Temp%\ICACHE-0D847852.tmp %Temp%\ICACHE-5F31D983.tmp %Temp%\ILIST-08BDFA4D.tmp %Temp%\ILIST-51FFFE0F.tmp	262,144 bytes	MD5: 0xEC87A838931D4D5D2E94A04644788A55 SHA-1: 0x2E000FA7E85759C7F4C254D4D9C33EF481E459A7	(not available)
5	[file and pathname of the sample #1]	4,903,558 bytes	MD5: 0xCD6E6DE794CA2C50C09BD19BC0C92591 SHA-1: 0xD8BF07567FED8CBD8F030AF9742054460A8E14B9	Virus.Win32.Oliga [Ikarus]

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directory was created:
• %AppData%\CD Box Labeler Pro

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
31.exe	%Temp%\31.exe	393,216 bytes
32.EXE	%Temp%\32.exe	8,065,024 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib
• HKEY_CURRENT_USER\Software\Green Point Software UK
• HKEY_CURRENT_USER\Software\Green Point Software UK\CD Box Labeler Pro
• HKEY_CURRENT_USER\Software\Green Point Software UK\CD Box Labeler Pro\MRUFonts
• HKEY_CURRENT_USER\Software\Green Point Software UK\CD Box Labeler Pro\Properties

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib]
• vga.drv 640x480x32(BGR 0) = "31,31,31,31"
• [HKEY_CURRENT_USER\Software\Green Point Software UK\CD Box Labeler Pro\Properties]
• DisplayWarning = 0x00000000
• RzStatusBar1_Visible = "False"

Other details

• To mark the presence in the system, the following Mutex object was created:
• 32.EXE