Submission Summary:

• Submission details:
• Submission received: 7 June 2012, 11:48:44
• Processing time: 11 min 53 sec
• Submitted sample:
• File MD5: 0xE564E91A46F1D8752130A400DB76AAAC
• File SHA-1: 0xF79C4F5A7E6667D6E82FD2BC62E0D0A8C9D9B560
• Filesize: 877,056 bytes
• Alias:
• Worm.Win32.AutoRun.fnc [Kaspersky Lab]
• W32/Tupym.worm [McAfee]
• W32/AutoRun-BUC [Sophos]
• Worm.Win32.AutoIt [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk

Description

Worm.IM.Sohanad

Worm.IM.Sohanad spreads via Yahoo Messenger and infects Windows. It sends a message to all Yahoo Messenger contacts of an infected user. The message contains a link enticing users to download the worm. The worm also disable certain Windows functionalities abd hijacks Internet Explorer homepage. It also downloads other maware and it will also attempt to propagate via the means of creating copies of itself onto removable devices such as USB flash and hard drives.

• Attention! The following threat category was identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\autorun.ini	102 bytes	MD5: 0x948C74CD98911B420FF89DAC13399BCB SHA-1: 0x76DFC73518F003953923B1B4F2B973F4BB56A411	W32.Svich [Symantec] Worm.Win32.AutoRun.gmp [Kaspersky Lab] W32/Tupym.worm!inf [McAfee] W32/AutoRun-AOA [Sophos]
2	[file and pathname of the sample #1] %System%\system3_.exe %Windir%\system3_.exe	877,056 bytes	MD5: 0xE564E91A46F1D8752130A400DB76AAAC SHA-1: 0xF79C4F5A7E6667D6E82FD2BC62E0D0A8C9D9B560	Worm.Win32.AutoRun.fnc [Kaspersky Lab] W32/Tupym.worm [McAfee] W32/AutoRun-BUC [Sophos] Worm.Win32.AutoIt [Ikarus]
3	%Windir%\Tasks\At1.job	350 bytes	MD5: 0x756C9EA2454D9EEEB27098DB77E3D164 SHA-1: 0xB3A5E34B84571990AE55329A9088C4C7D00CEDA7	(not available)

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	966,656 bytes
system3_.exe	%System%\system3_.exe	966,656 bytes
system3_.exe	%Windir%\system3_.exe	966,656 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Yahoo Messengger = "%System%\system3_.exe"

so that system3_.exe runs every time Windows starts

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
• Default_Page_URL =
• Default_Search_URL =
• Search Page =
• Start Page =
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell =
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
• Start Page =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	United Kingdom

• To mark the presence in the system, the following Mutex object was created:
• _!SHMSFTHISTORY!_

• The following Internet Connections were established:

• The following GET requests were made:
• asdb000/setting.ini
• index.html
• set/setting.ini
• asdb002/setting.ini
• asdb004/setting.ini
• asdb006/setting.ini
• asdb008/setting.ini
• asdb010/setting.ini
• asdb012/setting.ini
• asdb014/setting.ini
• asdb016/setting.ini
• asdb018/setting.ini
• index.jpg
• asdb020/setting.ini
• asdb022/setting.ini
• asdb024/setting.ini
• asdb026/setting.ini
• asdb028/setting.ini
• asdb030/setting.ini
• asdb032/setting.ini
• asdb034/setting.ini
• asdb036/setting.ini
• asdb038/setting.ini
• asdb040/setting.ini
• asdb042/setting.ini
• asdb044/setting.ini
• asdb046/setting.ini
• asdb048/setting.ini
• asdb050/setting.ini

• The following HTTP URL was started reading:
• http://pagesinxt.com/?dn=h1.ripway.c om&fp=1LR5COwAw8E2nXGhaS5HCbfri2Dx2vh%2FQNJmyvOf4w %2Bd%2FmvGl8%2F1Ub1jrGX%2BwXONMby%2FUUAnNVzOvqp5SI q%2BEg%3D%3D&prvtof=0ppHC1hBix9Y7U0WRsMoZVEg8DIPVD LSjP943rCyMRw%3D&poru=MOwNGhdXnw9qn0qnaKw1xpKe70Dg..