Submission Summary:

• Submission details:
• Submission received: 10 November 2009, 01:23:08
• Processing time: 8 min 8 sec
• Submitted sample:
• File MD5: 0xFC39B13587919F9EDC255B877B501F28
• File SHA-1: 0xA64D49BD61D68EA78E84B443B3D5C7211F0F42BC
• Filesize: 930,828 bytes
• Alias:
• Backdoor.Delf.WAX [PCTools]
• W32.Zori.B [Symantec]
• Backdoor.Win32.Delf.aig [Kaspersky Lab]
• PE_ZORI.F [Trend Micro]
• Mal/Behav-024, Mal/Behav-027, Mal/Behav-010, Mal/Behav-053 [Sophos]
• Virus:Win32/Zori.B [Microsoft]
• Win-Trojan/Spdhidpkg.910336 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Adware.Component.Unrelated	These common components have files and keys that are in different threats but the threats are not related to one another in that the author of the signature is not the same. It is recommended that all these entries be removed.

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\svchost.exe [file and pathname of the sample #1] %Windir%\Temp\ssshost.exe	930,828 bytes	MD5: 0xFC39B13587919F9EDC255B877B501F28 SHA-1: 0xA64D49BD61D68EA78E84B443B3D5C7211F0F42BC	Backdoor.Delf.WAX [PCTools] W32.Zori.B [Symantec] Backdoor.Win32.Delf.aig [Kaspersky Lab] PE_ZORI.F [Trend Micro] Mal/Behav-024, Mal/Behav-027, Mal/Behav-010, Mal/Behav-053 [Sophos] Virus:Win32/Zori.B [Microsoft] Win-Trojan/Spdhidpkg.910336 [AhnLab]

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	1,183,744 bytes
ssshost.exe	%Windir%\temp\ssshost.exe	1,183,744 bytes
svchost.exe	%Windir%\svchost.exe	1,183,744 bytes

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\mysoft

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\mysoft]
• Version = 0x000003E9

• The following Registry Value was modified:
• [HKEY_CURRENT_USER\Control Panel\International]
• iDate =
• sDate =
• sShortDate =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China

• To mark the presence in the system, the following Mutex object was created:
• byc001

• The following Internet Connection was established:

• The following GET requests were made:
• my/iexplorer.exe
• my/svchost.dll
• my/ssshost.exe