ThreatExpert Report: Win32.AutoIt

Submission Summary:

Submission details:

Submission received: 4 August 2012, 03:34:38
Processing time: 9 min 20 sec
Submitted sample:

File MD5: 0xE7C3A4804053F45508D0E9ED4241CBA9
File SHA-1: 0xB0C0493117105789210C49D14E19678B59058BAD
Filesize: 1,374,911 bytes
Alias: Win32.AutoIt [Ikarus]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\Userpre\user\docs\dhclient.exe	348,079 bytes	MD5: 0x56E357A7F1643116551C79C5393ACB9F SHA-1: 0x735903F7AD93D4EA22036137171F4576EDB42441	Win32.AutoIt [Ikarus] packed with UPX [Kaspersky Lab]
2	c:\Userpre\user\docs\fo.exe	22,016 bytes	MD5: 0x4E5D9EDC8AEEDAA23263F1958A3350CA SHA-1: 0xE0B21BD02AAF074496010B5143D525AB4D818069	packed with UPX [Kaspersky Lab]
3	c:\Userpre\user\docs\Ministry of Foreign Affairs (MOFA) ARMS PICS.pps	1,100,800 bytes	MD5: 0xB4B8996C55AE7778BA7D67BE2D34A342 SHA-1: 0x8BD1FB9467EE2B0A5F476173E2DCF96E6BB4DA7E	(not available)
4	[file and pathname of the sample #1]	1,374,911 bytes	MD5: 0xE7C3A4804053F45508D0E9ED4241CBA9 SHA-1: 0xB0C0493117105789210C49D14E19678B59058BAD	Win32.AutoIt [Ikarus] packed with UPX [Kaspersky Lab]

The following directories were created:

c:\Userpre
c:\Userpre\user
c:\Userpre\user\docs

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
dhclient.exe	C:\Userpre\user\docs\dhclient.exe	790,528 bytes
[generic host process]	[generic host process filename]	45,056 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	151,552 bytes
fo.exe	C:\Userpre\user\docs\fo.exe	65,536 bytes

Note:

[generic host process filename] is a full path filename of [generic host process].

Registry Modifications

The following Registry Key was created:

HKEY_CURRENT_USER\Software\WinRAR SFX

The newly created Registry Value is:

[HKEY_CURRENT_USER\Software\WinRAR SFX]

C%%Userpre%user%docs% = "C:\Userpre\user\docs\"

Other details

Analysis of the file resources indicate the following possible countries of origin:

	United Kingdom
	Russian Federation

To mark the presence in the system, the following Mutex object was created:

_!SHMSFTHISTORY!_

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
shell.windows.com	80	(null)	(null)

The following GET requests were made:

fileassoc/0409/xml/redir.asp?Ext=pps
fileassoc/0409/xml/index.jpg

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.