Submission Summary:

• Submission details:
• Submission received: 25 November 2009, 15:01:42
• Processing time: 8 min 21 sec
• Submitted sample:
• File MD5: 0xDB2F1E170EAA7C251334C2F7661E3DD8
• File SHA-1: 0xE837F92F5BB5DA61EFD367B1D098A49606558AD6
• Filesize: 19,456 bytes
• Alias:
• Trojan.Generic [PCTools]
• Trojan Horse [Symantec]
• Trojan.Win32.Sasfis.vfn [Kaspersky Lab]
• Mal/EncPk-LP [Sophos]
• Trojan:Win32/Oficla.E [Microsoft]
• Dropper/Malware.19456.J [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\1.tmp %System%\ajoa.nwo	25,601 bytes	MD5: 0xDB9CE75D3474FCA3D07FFFDD769A329E SHA-1: 0x721A3D42E7ECBDF21E9941DC101AEC8CA97EB443	Trojan.Generic [PCTools] Trojan Horse [Symantec] Troj/Oficla-Gen [Sophos] Trojan:Win32/Oficla.E [Microsoft]
2	[file and pathname of the sample #1]	19,456 bytes	MD5: 0xDB2F1E170EAA7C251334C2F7661E3DD8 SHA-1: 0xE837F92F5BB5DA61EFD367B1D098A49606558AD6	Trojan.Generic [PCTools] Trojan Horse [Symantec] Trojan.Win32.Sasfis.vfn [Kaspersky Lab] Mal/EncPk-LP [Sophos] Trojan:Win32/Oficla.E [Microsoft] Dropper/Malware.19456.J [AhnLab]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\idid

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\idid]
• url0 = F8 9B 20 62 FC 48 D0 3E 27 FC 1D F7 94 5A FF 3F F3 80 39 3D AB 06 8C 2B 20 E2 57 F2 97 1A E8 79 E0 EF B3 16 CF 5C 34 12 56 B1 C3 4C 37 93 C9 25

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell =

Other details

• The following Host Name was requested from a host database:
• ablegang.com

• The following HTTP URLs were started reading:
• http://ablegang.com/master/bb.php?id=&v=200&tm=3&b=7540485712
• http://ablegang.com/master/bb.php?id=&v=200&tm=4&b=7540485712
• http://ablegang.com/master/bb.php?id=&v=200&tm=5&b=7540485712