Submission Summary:

• Submission details:
• Submission received: 10 August 2012, 07:55:12
• Processing time: 8 min 45 sec
• Submitted sample:
• File MD5: 0xD0F8E5D7E9797C5D08564F9E01EA7F5E
• File SHA-1: 0x8883A319A9B9E4AD49FEABDDC572D87A0EE6C7FC
• Filesize: 217,088 bytes

Technical Details:

File System Modifications

• The following file was created in the system:

Registry Modifications

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
• NoProtectedModeBanner = 0x00000001
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 2500 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• {53ABFD1D-F696-812E-C7D4-E92A27B85B93} = "%AppData%\Adobe\Acrobat\6.0\Preferences\sol.exe"

• The following Registry Value was deleted:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit]
• LastKey = "My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

• The following Registry Value was modified:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1609 =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Russian Federation

• To mark the presence in the system, the following Mutex object was created:
• 53ABFD1DF696812EC7D4E92A27B85B9353AB53ABFD1D