Malware Database

We have been keeping a close eye on this malicious activity for the past 72 hours now and we have found some more interesting subject lines, e-mail bodies, and obfuscated javascript downloaders. The binary, javascript, and deobfuscated code have all been made available to Malware Database members.

What happens when you visit one of the sites?

start.html
–> 00.html
–>obfuscated downloader
–> watch.exe X****###***.exe (Adware/Antivirus2008)

Here are some of the e-mails we have found so far.

WARNING: The following list contains links to live malicious sites! Proceed at your own risk!

@@@@@@
Subject: Seinfeld movie to be released
Body: Your relatives told us to send you this hxxp://honest.es/start.html
@@@@@@

@@@@@@
Subject: Fast food causes men to shrink
Body: Boy fractures jaw in freak fight with dog, dog impaled hxxp://pierluigimazzoleni.com/start.html
@@@@@@

@@@@@@
Subject: NY Times offices set ablaze by arsonists
Body: Someone told us that you would like a raise hxxp://skv-burgebrach.de/start.html
@@@@@@
Subject:Mick Jagger reveals Angelina Jolie affair
Body:hxxp://www.marbresigranitsmontserrat.com/start.html
@@@@@@

@@@@@@
Subject:Britney Spears quits singing career
Body:Apple files lawsuit demanding that Psystar recall OpenMacs hxxp://www.centaurea-ae.org/hot.html
@@@@@@

@@@@@@
Subject:Conspiracy of 1865 Lincoln assassination exposed
Body:hxxp://clarabraun.com/hot.html
@@@@@@

@@@@@@
Subject:ATI and NVIDIA fix prices in the US
Body:McCain shows his conservative side when he asserts that both parents are important in the success of a family and does not believe in gay adoption hxxp://www.teatinas.com/news.html
@@@@@@

@@@@@@
Subject:Latest crazy hip in thing
Body:Microsft sends messae of approval of killing Jews when the character sequence “NYC” in wingdings is rendered as skull and cross bones symbol, Star of David and thumbs up gesture hxxp://www.eurotakt.sk/news.html
@@@@@@

@@@@@@
Subject:Scientists prove landing in Mars staged
Body:All the dirty secrets about American Idol, you win by getting there with favors.
hxxp://www.tsv-heusenstamm.de/news.html
@@@@@@

@@@@@@
Subject:Afghan bombing kills President Bush
Body:You can shoot 10 feet and do it again, the secret is right here. hxxp://7lyk-chanion.chan.sch.gr/news.html
@@@@@@

@@@@@@
Subject:Barack Obama pulls out from Presidential Race
Body:Obama found to have a hint of Clinton’s ideas by declaring support for health care scheme hxxp://agroimpex.com.pl/news.html
@@@@@@

7/20/08 3:00 PM UPDATE
@@@@@@
Subject: Learn how to kiss your partner
Body: Reporters in Iraq captured by guerillas, US$1b ransom demanded hxxp://nanni.schrod.eu/start.html

@@@@@@

@@@@@@
Subject: Demi Moore breaks up with Kutcher
Body: Thousands are left homeless as hurricane strikes central Louisiana hxxp://sigmasoft.it/start.html

@@@@@@

@@@@@@
Subject: First pictures of Pitt and Jolie’s babies
Body: Malaysia’s premier accused of sodomy and jailed hxxp://mlp-24.de/start.html
@@@@@@

7-21-08 10:50PM UPDATED
LIST OF MORE ACTIVE URLS (watch.exe & view.exe)