Submission Summary:

• Submission details:
• Submission received: 24 May 2009, 22:40:22
• Processing time: 5 min 34 sec
• Submitted sample:
• File MD5: 0xE3A35F659652AF215A0F7DAD67A47202
• File SHA-1: 0x972989917B8EC151B52510EB166F745553CB9DBC
• Filesize: 11,776 bytes
• Alias:
• Net-Worm.Koobface [PCTools]
• Infostealer [Symantec]
• Trojan.Win32.Agent2.gqr [Kaspersky Lab]
• Generic.dx [McAfee]
• W32/Koobfa-Gen, W32/Koobfa-Gen [Sophos]
• Worm.Win32.Koobface [Ikarus]
• Win-Trojan/Agent2.11776.E [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Net-Worm.Koobface	Net-Worm.Koobface is a network-aware worm that attempts to replicate across the existing network(s) and also can be used to hijack certain aspects of users' web browser functionality (such as homepage, search page, and security settings).

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\9g234sdfdfgjf23	1 bytes	MD5: 0xC4CA4238A0B923820DCC509A6F75849B SHA-1: 0x356A192B7913B04C54574D18C28D46E6395428AB	(not available)
2	%Windir%\pp04.exe	11,776 bytes	MD5: 0xE3A35F659652AF215A0F7DAD67A47202 SHA-1: 0x972989917B8EC151B52510EB166F745553CB9DBC	Net-Worm.Koobface [PCTools] Infostealer [Symantec] Trojan.Win32.Agent2.gqr [Kaspersky Lab] Generic.dx [McAfee] W32/Koobfa-Gen, W32/Koobfa-Gen [Sophos] Worm.Win32.Koobface [Ikarus] Win-Trojan/Agent2.11776.E [AhnLab]

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
pp04.exe	%Windir%\pp04.exe	40,960 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	40,960 bytes

Other details

• To mark the presence in the system, the following Mutex object was created:
• 9g234sdfdfgjf2304