Submission Summary:

• Submission details:
• Submission received: 6 April 2010, 16:40:51
• Processing time: 7 min 28 sec
• Submitted sample:
• File MD5: 0xF48E7073F2BB68C060E977FF4B537C10
• File SHA-1: 0x9608380688F042414D12AD33381D38E93A776F92
• Filesize: 61,467 bytes
• Packer info: packed with: PE_Patch [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

• The following files were created in the system:

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

• Notes:
• [generic host process filename] is a full path filename of [generic host process].

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Spain

• The following Internet downloads were started (the retrieved bits are saved into the local file):

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Downloaded File Summary:

• Download details:
• Download retrieved: 6 April 2010 16:48:19
• Processing time: 7 min 29 sec
• Downloaded sample #1:
• File MD5: 0x2B21E120937F43F20F7F4CFA152B3F65
• File SHA-1: 0x1C277DACC80BF8CFB8DF7B5F5F66E9E5FDAEDE44
• Filesize: 1,593,856 bytes
• Downloaded sample #2:
• File MD5: 0x653815C1C217E096F5A21E582CAFF5DD
• File SHA-1: 0x1E75B594AD83F8875312BD3D5AE5022BEF56DC8B
• Filesize: 1,213,467 bytes
• Packer info: packed with: PE_Patch [Kaspersky Lab]
• Downloaded sample #3:
• File MD5: 0x23B64C82B636868922D66A7D293A3CFD
• File SHA-1: 0xDA0FF41C600838CBA178B57C8337D08BFD690A25
• Filesize: 876,544 bytes
• Alias: Mal/VBDrop-I, Mal/VBInject-D [Sophos]

• Summary of the findings:

What's been found	Severity Level
Hosts file modification that may block access to the security web sites.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\nsafrt.dll	756,224 bytes	MD5: 0x5B0426AE59A9E5DC73E5B277AD874361 SHA-1: 0xD1489C619E0D7FAD5AF4CD0305D0901E23651017	Troj/Banker-EWZ [Sophos] Win32.SuspectCrc [Ikarus]
2	%ProgramFiles%\Common Files\safemode	552 bytes	MD5: 0xF847207DF0B2E5228D8F122FB5DBDA3F SHA-1: 0x9E9FD581D494D56F1AFDE998CD33738601EA8F29	(not available)
3	[file and pathname of the sample #1]	1,593,856 bytes	MD5: 0x2B21E120937F43F20F7F4CFA152B3F65 SHA-1: 0x1C277DACC80BF8CFB8DF7B5F5F66E9E5FDAEDE44	(not available)
4	%System%\[filename of the sample #2 without extension].bat	140 bytes	MD5: 0xF103BF428A0C3F6A8815157D610283A7 SHA-1: 0x378A6C0DFCB64A9F7432959C198103A41C7A9C54	(not available)
5	[file and pathname of the sample #2]	1,213,467 bytes	MD5: 0x653815C1C217E096F5A21E582CAFF5DD SHA-1: 0x1E75B594AD83F8875312BD3D5AE5022BEF56DC8B	packed with PE_Patch [Kaspersky Lab]
6	[file and pathname of the sample #3]	876,544 bytes	MD5: 0x23B64C82B636868922D66A7D293A3CFD SHA-1: 0xDA0FF41C600838CBA178B57C8337D08BFD690A25	Mal/VBDrop-I, Mal/VBInject-D [Sophos]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following file was modified:
• %System%\drivers\etc\hosts

Memory Modifications

• There were new processes created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\full

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• winFile = "%ProgramFiles%\Common Files\system32\winFile.exe"

Other details

• Analysis of the file resources indicate the following possible countries of origin:

	Brazil
	Spain

• The HOSTS file was updated with the following URL-to-IP mappings:

• The following Host Name was requested from a host database:
• www.aabbcomunidade.com.br