Submission Summary:

• Submission details:
• Submission received: 20 July 2009, 16:25:57
• Processing time: 7 min 39 sec
• Submitted sample:
• File MD5: 0xE04EB489B94B4E9FDD998B52659CF499
• File SHA-1: 0x8BBEB2C6061EF3C0660C6E466595E7ED836284B9
• Filesize: 28,798 bytes
• Alias:
• Trojan-PWS.Magania [PCTools]
• Infostealer.Gampass [Symantec]
• Trojan-GameThief.Win32.Magania.bjsy [Kaspersky Lab]
• Generic Dropper.eb [McAfee]
• Troj/Drop-CW [Sophos]
• Trojan-PWS.Win32.LdPinch [Ikarus]
• Win-Trojan/Magania.28796.C [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-PWS.Magania	Trojan.PSW.Magania steals online gaming login information.

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%FontsDir%\R6WhWBmZsEdPZDjQP.Ttf	200 bytes	MD5: 0x59E176A07862A8C14CF4C9E928C40D9D SHA-1: 0x2D12A013FEE40EA4C6BEBAAA479A2A1C493FCED6	(not available)
2	%System%\dfc8ac3ed7da.dll	792,064 bytes	MD5: 0x6728270CB7DBB776ED086F5AC4C82310 SHA-1: 0xE913CC86F68627541DAE2A92509AB230F427E980	(not available)
3	%System%\EN7hzSreCat8.dll	226,918 bytes	MD5: 0xA9B4D9E894F40BF34FF8B313F700970B SHA-1: 0xB0E8257A18D646A89AB3B3ACB81BA1ED232E6453	Trojan-PWS.Magania [PCTools] Infostealer.Gampass [Symantec] Trojan-GameThief.Win32.Magania.bkef [Kaspersky Lab] PWS-OnlineGames.ek [McAfee] Troj/PWS-BCC [Sophos] Generic.Onlinegames [Ikarus] Win-Trojan/Magania.226916.B [AhnLab]
4	[file and pathname of the sample #1]	28,798 bytes	MD5: 0xE04EB489B94B4E9FDD998B52659CF499 SHA-1: 0x8BBEB2C6061EF3C0660C6E466595E7ED836284B9	Trojan-PWS.Magania [PCTools] Infostealer.Gampass [Symantec] Trojan-GameThief.Win32.Magania.bjsy [Kaspersky Lab] Generic Dropper.eb [McAfee] Troj/Drop-CW [Sophos] Trojan-PWS.Win32.LdPinch [Ikarus] Win-Trojan/Magania.28796.C [AhnLab]

• Notes:
• %FontsDir% is a variable that refers to a virtual folder containing fonts. A typical path is C:\Windows\Fonts.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following file was modified:
• %System%\comres.dll

Memory Modifications

• There was a new process created in the system:

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
EN7hzSreCat8.dll	%System%\EN7hzSreCat8.dll	Process name: dllhost.exe Process filename: %System%\dllhost.exe Address space: 0x2530000 - 0x2543000
dfc8ac3ed7da.dll	%System%\dfc8ac3ed7da.dll	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0x77050000 - 0x77115000

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FCA4D3BE-C6C7-4F4D-9CBD-CB2666647ACA}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FCA4D3BE-C6C7-4F4D-9CBD-CB2666647ACA}\InprocServer32

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FCA4D3BE-C6C7-4F4D-9CBD-CB2666647ACA}\InprocServer32]
• (Default) = "%System%\EN7hzSreCat8.dll"
• ThreadingModel = "Apartment"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
• {FCA4D3BE-C6C7-4F4D-9CBD-CB2666647ACA} = ""