Submission Summary:

• Submission details:
• Submission received: 8 July 2009, 23:43:54
• Processing time: 7 min 27 sec
• Submitted sample:
• File MD5: 0xE28ECAC172DD0B6A178E4ABBD6E92AF7
• File SHA-1: 0xF3D2B1552D41EC2F609A4895158DC2CF66CD7CDB
• Filesize: 909,950 bytes
• Alias:
• Trojan-Downloader.Win32.CodecPack.ilv [Kaspersky Lab]
• FakeAlert-EZ [McAfee]
• Trojan-Dropper.Win32.Winwebsec [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonAppData%\13209064\13209064.exe	741,450 bytes	MD5: 0xDDAC356365C02D52C30E2B27AFA26D30 SHA-1: 0x6CCDDFD99E1A3C3C636ADFBC49C8DA6BCF4B6193	AntiVirus2008 [Symantec] FakeAlert-DZ [McAfee]
2	%Temp%\$inst\2.tmp	36 bytes	MD5: 0x8708699D2C73BED30A0A08D80F96D6D7 SHA-1: 0x684CB9D317146553E8C5269C8AFB1539565F4F78	(not available)
3	%Temp%\INS1.tmp	905,271 bytes	MD5: 0xCE756E6E88174431E2EF04B74CF7C986 SHA-1: 0xE54E6B6250C8E546E0B2C24EDA0721E4849986C4	Trojan-Downloader.Win32.CodecPack.ilv [Kaspersky Lab]
4	%ProgramFiles%\Adult Tube XXX codec\Antivirus\391.exe	10,752 bytes	MD5: 0x39EF491B937577930F7057F2A7D2E3F4 SHA-1: 0x53211FC6E298FBB3F48D21C1401EC03298950889	Packed.Generic.237 [Symantec]
5	%ProgramFiles%\Adult Tube XXX codec\Antivirus\codec.exe	25,088 bytes	MD5: 0x50F81D56BC7E620032D6E87C917AA663 SHA-1: 0x627CA3D7AE7CFD969E60EFB2FECA284E49D42748	Trojan.Win32.FraudPack.pfw [Kaspersky Lab] FakeAlert-ES [McAfee] Trojan-Downloader.Win32.Dontovo [Ikarus] Win-Trojan/Fraudpack.25088.F [AhnLab]
6	%ProgramFiles%\Adult Tube XXX codec\Antivirus\install.48322.exe	59,904 bytes	MD5: 0x6B8828C90810B4C46EB93BAB5976BE89 SHA-1: 0x7612C9F5D24FABD301EAEF692635E6894210C674	Downloader [Symantec] Trojan-Downloader.Win32.CodecPack.ilv [Kaspersky Lab] Trojan-Downloader.Win32.CodecPack [Ikarus]
7	%ProgramFiles%\Adult Tube XXX codec\Antivirus\lol.exe	86,528 bytes	MD5: 0xEE8171ED76AE49A9C68DD5D33CE74931 SHA-1: 0x2EF3F1611292314F53ECAF716ADCB39F5E3CA2DB	(not available)
8	%ProgramFiles%\Adult Tube XXX codec\Antivirus\service.exe	83,968 bytes	MD5: 0x6E42355DB044533BEA5F06552065EFA3 SHA-1: 0xFE709BC4B0D2E773200E5038B256BF22D9EF6EEF	Packed.Win32.Tdss.m [Kaspersky Lab]
9	%ProgramFiles%\Adult Tube XXX codec\Antivirus\setup.exe	741,413 bytes	MD5: 0xB315ABCD03549EC2331AD58D5F099F86 SHA-1: 0x6F413AF8ABFD9F715C237D2ABAF285754CE7750C	FakeAlert-WinwebSecurity.gen [McAfee]
10	%Windir%\ld12.exe	17,920 bytes	MD5: 0x5C8C37B5CE36B12AAA670B30BD84887A SHA-1: 0xA4FA0FA20BF53D9780EB4F58053743F84AF9F86C	W32.Koobface.A [Symantec] Trojan-Downloader.Win32.Injecter.ddn [Kaspersky Lab] packed with PE_Patch.UPX [Kaspersky Lab]
11	[file and pathname of the sample #1]	909,950 bytes	MD5: 0xE28ECAC172DD0B6A178E4ABBD6E92AF7 SHA-1: 0xF3D2B1552D41EC2F609A4895158DC2CF66CD7CDB	Packed.Win32.Tdss.m, Trojan-Downloader.Win32.Injecter.ddn, Trojan.Win32.FraudPack.pfw, Trojan-Downloader.Win32.CodecPack.ilv [Kaspersky Lab] FakeAlert-EZ [McAfee] Trojan-Dropper.Win32.Winwebsec [Ikarus]

• Notes:
• %CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• The following directories were created:
• %CommonAppData%\13209064
• %Temp%\$inst
• %ProgramFiles%\Adult Tube XXX codec
• %ProgramFiles%\Adult Tube XXX codec\Antivirus

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
INS1.tmp	%Temp%\ins1.tmp	139,264 bytes
setup.exe	%ProgramFiles%\adult tube xxx codec\antivirus\setup.exe	720,896 bytes
install.exe	%ProgramFiles%\Adult Tube XXX codec\Antivirus\install.exe	57,344 bytes
ld12.exe	%Windir%\ld12.exe	57,344 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	32,768 bytes

Registry Modifications

• The following Registry Keys were deleted:
• HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating
• HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Current
• HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Default

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• sysldtray = "%Windir%\ld12.exe"

so that ld12.exe runs every time Windows starts

• The following Registry Values were deleted:
• [HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Default]
• (Default) = "%SystemRoot%\media\Windows XP Start.wav"
• [HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Current]
• (Default) = "%SystemRoot%\media\Windows XP Start.wav"
• [HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating]
• (Default) = ""

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Russian Federation

• To mark the presence in the system, the following Mutex object was created:
• xx464dg433xx12

• The following Internet Connection was established:

• The data identified by the following URL was then requested from the remote web server:
• http://porno-tube-xxx.com/notify.php?ip=80.237.152.53&id=0122