Submission Summary:

• Submission details:
• Submission received: 7 September 2009, 15:08:32
• Processing time: 6 min 36 sec
• Submitted sample:
• File MD5: 0xE5A14C47E9C26E78FCCB22EE71FEDD51
• File SHA-1: 0x354CBEAAED498DEAF7B5B17FDCFBA67BD53D0692
• Filesize: 22,913 bytes
• Alias:
• Hacktool [Symantec]
• not-a-Virus.Hacktool.Wpakill [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Registers a Winlogon notification package so that the installed module is loaded into the address space of winlogon.exe.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A hacktool that could be used by attackers to break into a system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\AMD64\antiwpa.dll	9,216 bytes	MD5: 0xE462556DC827175E5E01D34B16F2B531 SHA-1: 0xC2501DBCCB1A6CF87B72F459C198F9F28350B9DA	Generic.dx [McAfee] HackTool:Win32/Wpakill [Microsoft] not-a-Virus.Hacktool.Wpakill [Ikarus]
2	%Temp%\AntiWPA3.cmd	3,150 bytes	MD5: 0xAF9BD71FB0FF81D3ABDCC2A6FD946F4F SHA-1: 0x8D3D1026436B302E01901C1265B04C7A17473B1E	(not available)
3	%Temp%\IA64\antiwpa.dll	18,688 bytes	MD5: 0x3CF0071B0FA2245BD53E99828948ED03 SHA-1: 0x7D436B4DC50832D677E0423507A8CA0D12FEA1D4	Hacktool [Symantec] Generic.dx!xu [McAfee] HackTool:Win32/Wpakill.dll [Microsoft] not-a-Virus.Hacktool.Wpakill [Ikarus]
4	%Temp%\readme.txt	20,627 bytes	MD5: 0x024EB905807AEE93E1B9F0D50BFB1D67 SHA-1: 0xA4CD71234303CF54E63E10CD73E15CD1D69C8070	(not available)
5	%Temp%\X86\antiwpa.dll %System%\antiwpa.dll	5,376 bytes	MD5: 0x98C332990684CD9F113FBD495841C6FA SHA-1: 0xB42D4F6996759CD5EC6B5DE89F1EF1F3A40E7084	Hacktool [Symantec] Generic PUP.x [McAfee] HackTool:Win32/Wpakill [Microsoft] not-a-Virus.Hacktool.Wpakill [Ikarus] Win-Trojan/Xema.variant [AhnLab]
6	[file and pathname of the sample #1]	22,913 bytes	MD5: 0xE5A14C47E9C26E78FCCB22EE71FEDD51 SHA-1: 0x354CBEAAED498DEAF7B5B17FDCFBA67BD53D0692	Hacktool [Symantec] not-a-Virus.Hacktool.Wpakill [Ikarus]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directories were created:
• %Temp%\AMD64
• %Temp%\IA64
• %Temp%\X86

Memory Modifications

• There was a new process created in the system:

• Notes:
• [generic host process filename] is a full path filename of [generic host process].

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Antiwpa

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Antiwpa]
• Impersonate = 0x00000000
• Asynchronous = 0x00000000
• DllName = "antiwpa.dll"
• Logon = "onLogon"

so that antiwpa.dll is installed as a Winlogon notification package

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents]
• OOBETimer =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Germany