Submission Summary:

• Submission details:
• Submission received: 31 October 2009, 12:26:50
• Processing time: 5 min 28 sec
• Submitted sample:
• File MD5: 0xF906D595F4F66CD6FB9A5570A3BC2E53
• File SHA-1: 0x3BAC9A9FC803ACA993CF398F4368ADFF1AD4699A
• Filesize: 468,235 bytes
• Alias: Trojan.LdPinch [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan-Downloader.Banload.HNC	Trojan-Downloader.Banload.HNC attempts to download malicious files to the local computer and execute them
Trojan-PWS.Magania	Trojan.PSW.Magania steals online gaming login information.
Trojan-PWS.OnlineGames.BX	Trojan-PWS.OnlineGames.BX attempts to monitor infected computers to steal password and other information associated with popular online games.

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\2.bat	65 bytes	MD5: 0xD537A8FE6E87D570953370B03B4E832F SHA-1: 0xBAA91FD5AA804443BED8F601D1E3364DB4A19F39	(not available)
2	%Windir%\Help\F3C74E3FA248.dll	124,976 bytes	MD5: 0xE63A71372DD5CB31D526594FC46C0002 SHA-1: 0x9B6B0F01365ED8151F35065873E833EA280D7F74	Generic PWS.bl [McAfee] Mal/LineDLL-B [Sophos] Trojan.LdPinch [Ikarus]
3	%Windir%\Help\F3C74E3FA248.exe	182,832 bytes	MD5: 0x9CD5AA5BF091F79428EAF466EE63ED5C SHA-1: 0x38CF9F7CB7D918C43C33C1FDAFFA73DA5DCB4FBE	Mal/EncPk-CK [Sophos] Trojan.LdPinch [Ikarus]
4	%System%\ro.dll	133,680 bytes	MD5: 0xA89338A277A1822C598C6B6FE2AAE3C8 SHA-1: 0x5DEFA57F4A7C2CB7F517178A1B319A484898CF2F	Trojan.LdPinch [Ikarus]
5	[file and pathname of the sample #1]	468,235 bytes	MD5: 0xF906D595F4F66CD6FB9A5570A3BC2E53 SHA-1: 0x3BAC9A9FC803ACA993CF398F4368ADFF1AD4699A	Trojan.LdPinch [Ikarus]

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
F3C74E3FA248.dll	%Windir%\HELP\F3C74E3FA248.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x1EE0000 - 0x1F2D000
F3C74E3FA248.dll	%Windir%\HELP\F3C74E3FA248.dll	Process name: msmsgs.exe Process filename: %ProgramFiles%\messenger\msmsgs.exe Address space: 0xCC0000 - 0xD0D000
F3C74E3FA248.dll	%Windir%\HELP\F3C74E3FA248.dll	Process name: dllhost.exe Process filename: %System%\dllhost.exe Address space: 0x2520000 - 0x256D000
F3C74E3FA248.dll	%Windir%\HELP\F3C74E3FA248.dll	Process name: sdnsmain.exe Process filename: %Windir%\dns\sdnsmain.exe Address space: 0x1620000 - 0x166D000
F3C74E3FA248.dll	%Windir%\HELP\F3C74E3FA248.dll	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0x1940000 - 0x198D000

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32
• HKEY_CURRENT_USER\Software\WinRAR SFX

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32]
• (Default) = "%Windir%\HELP\F3C74E3FA248.dll"
• ThreadingModel = "Apartment"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}]
• (Default) = "SSUUDL"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
• {1DBD6574-D6D0-4782-94C3-69619E719765} = ""
• [HKEY_CURRENT_USER\Software\WinRAR SFX]
• C%%WINDOWS = "C:\WINDOWS"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China