Submission Summary:

• Submission details:
• Submission received: 12 August 2012, 12:15:29
• Processing time: 7 min 57 sec
• Submitted sample:
• File MD5: 0xF2E33954747A19BC57EF7F2B32B35C52
• File SHA-1: 0x72919EA413C9E834A33149283F5FD42CF1C3B0BE
• Filesize: 37,376 bytes
• Alias & packer info:
• Downloader [Symantec]
• Trojan-Downloader.Win32.Geral.almp [Kaspersky Lab]
• Troj/Agent-UWR [Sophos]
• Trojan-Downloader.Win32.Geral [Ikarus]
• packed with: UPX [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%ProgramFiles%\Common Files\rkdltecq\qioifz.pif [file and pathname of the sample #1]	37,376 bytes	MD5: 0xF2E33954747A19BC57EF7F2B32B35C52 SHA-1: 0x72919EA413C9E834A33149283F5FD42CF1C3B0BE	Downloader [Symantec] Trojan-Downloader.Win32.Geral.almp [Kaspersky Lab] Troj/Agent-UWR [Sophos] Trojan-Downloader.Win32.Geral [Ikarus] packed with UPX [Kaspersky Lab]
2	%System%\98062.DEP	5,302,272 bytes	MD5: 0x808A5BA667C5F6C4F7F27B9509D68E59 SHA-1: 0xB77C784FAE71654DF5E377CC4925B538E31AA790	Trojan-Downloader.Win32.Geral.alms [Kaspersky Lab] Trojan-Downloader.Win32.Geral [Ikarus]

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• %ProgramFiles%\Common Files\rkdltecq

Memory Modifications

• There was a new process created in the system:

• The following module was loaded into the address space of other process(es):

• The following system service was modified:

Service Name	Display Name	New Status	Service Filename
PolicyAgent	IPSEC Services	"Stopped"	%System%\lsass.exe

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32]
• (Default) = "%System%\98062.DEP"

• The following Registry Value was deleted:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32]
• (Default) = "%System%\webcheck.dll"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China

• To mark the presence in the system, the following Mutex object was created:
• ZHIDCONGAALNG

• The following Host Name was requested from a host database:
• 192.5.5.241

• The following Internet download was started (the retrieved bits are saved into the local file):

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.