Malicious Links | Malware Database

Archive for the 'Malicious Links' Category

May

Twitter Trending Topic Attack

By lithium 0 Comments

Categories: Hack, Malicious Domains, Malicious Links, Malware and Twitter

Almost a full year has passed since we discovered the first trending topic attack on Twitter. This time the attack came back in the same fashion, but it was much less aggressive than the prior attack thanks to the swiftly acting Twitter security team.

In this latest attack, the tweet messages were coupled with the trending topic items such as Justin Bieber, Oil Spill, and Official Twitter App. The tweets all contained the text “haha this is the funniest video ive EVER SEEN!” followed by a link to the malware campaign.

In the following image, you can see the results of a search taken shortly after the attack started. As you can see, the accounts were communicating via the Twitter API, so it’s safe to assume that the cyber criminals behind the attack used some sort of script to make it all happen.

Clicking any of the URLs starts the redirection process to a website where a malicious file is downloaded using the technique known as “drive by download”, which runs this file automatically in the affected computer, without user’s awareness.

The malware site used for the attack is hxxp://pc-tv.tv/stickam/index2.html

In the following image you can see how it seems that a java complement is being loaded, which is necessary to view the video:

However, if we look at the code of this website, you can see how it’s actually calling an EXE file, which belongs to the malware. It has been detected as W32/Lolbot.B.worm.

The code is the following:

Jul

Database Update: 29 files (Low/Moderate Detection)

By djpnuemo 0 Comments

Categories: Database Update, Malicious Links and Malware

Files added to our database recently.

WARNING: URL’s may still be active. Proceed at your own risk.

Setup-73cb3_02009-1938.exe
Result: 12/41 (29.27%)
MD5: 082c4b1a7b77db893364c3fd3a77b647
VirusTotal
ThreatExpert Analysis
hxxp://secured-virus-scanner.com/download/

id_0122.exe or setup.exe
Result: 13/40 (32.5%)
MD5: 5e6ea7e4f4fbe148e3a06afa58daf581
VirusTotal
ThreatExpert Analysis
hxxp://youtube-adult.name/

pdrv.exe or vcru_1246903147.exe
Result: 12/40 (30%)
MD5: 97207099a118be4091785119b1d9937d
VirusTotal
ThreatExpert Analysis
hxxp://upload.octopus-multimedia.be/1/pdrv.exe

pp.10.exe or pp10.exe
Result: 24/40 (60%)
MD5: 133f989d913fea3e8802282bd37c5927
VirusTotal
ThreatExpert Analysis
hxxp://upload.octopus-multimedia.be/1/pp.10.exe

ld12.exe
Result: 22/41 (53.66%)
MD5: 5c8c37b5ce36b12aaa670b30bd84887a
VirusTotal
ThreatExpert Analysis

install.48322.exe
Result: 17/41 (41.47%)
MD5: 6b8828c90810b4c46eb93bab5976be89
VirusTotal
ThreatExpert Analysis

codec.exe
Result: 19/41 (46.35%)
MD5: 50f81d56bc7e620032d6e87c917aa663
VirusTotal
ThreatExpert Analysis

lol.exe
Result: 5/41 (12.2%)
MD5: ee8171ed76ae49a9c68dd5d33ce74931
VirusTotal
ThreatExpert Analysis

service.exe
Result: 7/41 (17.08%)
MD5: 6e42355db044533bea5f06552065efa3
VirusTotal
ThreatExpert Analysis

391.exe
Result: 8/41 (19.52%)
MD5: 39ef491b937577930f7057f2a7d2e3f4
VirusTotal
ThreatExpert Analysis

setup.exe
Result: 21/41 (51.22%)
MD5: 513ffc855daed8d0889188431add9d34
VirusTotal
ThreatExpert Analysis

FlashPlayer.exe
Result: 18/41 (43.91%)
MD5: 88d88eb7a3941e89c1c9dac8797e7301
VirusTotal
ThreatExpert Analysis
hxxp://healsearcher.com/download/2b58736731513d3d150878b420090701/

.exe
Result: 11/41 (26.83%)
MD5: 174aa8777d77426485747d6de4d0039b
VirusTotal
ThreatExpert Analysis

setup.exe
Result: 20/41 (48.79%)
MD5: e28ecac172dd0b6a178e4abbd6e92af7
VirusTotal
ThreatExpert Analysis

a.exe
Result: 26/41 (63.42%)
MD5: eb4209ac9062804a8c83831ffb0dc6c7
VirusTotal
ThreatExpert Analysis
hxxp://arplgm.cn/

VideoCodec.exe
Result: 14/41 (34.15%)
MD5: 8254d797dc12adaa7e50f30128199b17
VirusTotal
ThreatExpert Analysis
hxxp://healsearcher.com/download/4672366463673d3d0c36c19720090701/

Mediacodec.exe
Result: 16/41 (39.03%)
MD5: 72ede7e934e0777120ec95fa229f0a2a
VirusTotal
ThreatExpert Analysis

win.exe
Result: 23/41 (56.1%)
MD5: b6ebdb9c3e24ef845af65a8ea5d09540
VirusTotal
ThreatExpert Analysis
hxxp://ads.v8dc.com/win/

evilItTheir.pdf
Result: 12/41 (29.27%)
MD5: 3e43e2393e03b76af5f7ff1b30ed83a1
VirusTotal
Wepawet Analysis
hxxp://imagehut3.cn/images/

load.exe
Result: 5/41 (12.2%)
MD5: 55126b500a9cbecb6e3df1a61592fcc7
VirusTotal
ThreatExpert Analysis
hxxp://imagehut3.cn/images/update.php

install_flash_player.exe
Result: 0/41 (0%)
MD5: a51b5d3fee2215f0068fc36174a53513
VirusTotal
ThreatExpert Analysis
hxxp://missing-codecs.net/download/download.php

load.exe or sysguard.exe
Result: 2/40 (5%)
MD5: 507aedd5e26a6bf81635b067b8053ceb
VirusTotal
ThreatExpert Analysis
hxxp://91.212.198.116/lib/update.php

fotos_Album.exe
Result: 21/41 (51.22%)
MD5: af50713e6ff1cfc0e190261a48dc8ee2
VirusTotal
ThreatExpert Analysis

principal.txt or process.exe
Result: 12/40 (30%)
MD5: 097fcf4368c94d83563f205ce335f89b
VirusTotal
ThreatExpert Analysis
hxxp://www.hoje-noticias.pagebr.com/downloads/

TS45.SYS
Result: 2/41 (4.88%)
MD5: aba452fd10f74aabcac36b579046ede8
VirusTotal
ThreatExpert Analysis

plug2.txt or wiskyx.exe
Result: 20/41 (48.79%)
MD5: 6b88ad201100fe58920842be576f5482
VirusTotal
ThreatExpert Analysis
hxxp://www.hoje-noticias.pagebr.com/downloads/

winsex2.txt or winsex2.exe
Result: 11/40 (27.5%)
MD5: 3abb2f2eda63e9ed447aad1e502b5e25
VirusTotal
ThreatExpert Analysis
hxxp://www.hoje-noticias.pagebr.com/downloads/

Setup-27a_02022.exe
Result: 6/41 (14.64%)
MD5: a778ceee0fa0161bf77fa318fa3f1a51
VirusTotal
ThreatExpert Analysis

update.exe
Result: 14/40 (35%)
MD5: 4e37097b45d8885a55ef8bd0a0669446
VirusTotal
ThreatExpert Analysis
hxxp://vikd3jj-2.com/2/index.php

Jul

Database Update: 35 files (Low/Moderate/High Detection)

By djpnuemo 0 Comments

Categories: Database Update, Low Detection, Malicious Links and Malware

Files recently added to our database.

WARNING: URL’s may still be active. Proceed at your own risk!

Flash-Installer.exe
Result: 11/41 (26.83%)
MD5: 885b7d23c1a78ed4d255acae88fddc48
VirusTotal
ThreatExpert Analysis
hxxp://operasnower.com/download/6f4e4e2f61673d3d1db24bf820090701/

DVDTool.exe
Result: 4/40 (10%)
MD5: 3d4711e9f61975576977c193b67dd087
VirusTotal
ThreatExpert Analysis

Setup-c8d1_02009-1549.exe (Rogue: Personal Antivirus)
Result: 12/41 (29.27%)
MD5: 3a93a3cdb54b74558c6f589d9a952b08
VirusTotal
ThreatExpert Analysis
hxxp://1fast-antimalware-scanner.com/download/

Live-Player_setup.exe
Result: 13/40 (32.5%)
MD5: c96efb32b6ab067838bd55d2460dbe41
VirusTotal
ThreatExpert Analysis
hxxp://download.live-player.com/Live-Player_setup.php?grpid=2564&tag_id=717&nums=FGE7btIAOb&popt1=1320&popt2=1415&popt3=99

live-player.exe
Result: 3/41 (7.32%)
MD5: db6f7195ece6b08724797c550afd3f81
VirusTotal
ThreatExpert Analysis

mbt.exe
Result: 6/39 (15.39%)
MD5: e94a2e3ea98af4421b13aeba862e8052
VirusTotal
ThreatExpert Analysis
hxxp://www.alfafoxx.com/mldr/data/

wetin.exe
Result: 31/39 (79.49%)
MD5: 1dc1cd411a7c96593012f5c645fe164e
VirusTotal
ThreatExpert Analysis
hxxp://zuka.dsl.ge/images/

IMG511975310_134453_9198-JPG.EXE
Result: 25/41 (60.98%)
MD5: f861fbaa19a99742bce01543f1835ff3
VirusTotal
ThreatExpert Analysis
hxp://msnweb.dyns.net/photo.php

express.exe
Result: 21/39 (53.85%)
MD5: 3ddb9f0d4f3a56ec89bffb3963df1727
VirusTotal
ThreatExpert Analysis

technigo.exe
Result: 14/41 (34.15%)
MD5: 2f5a3eea9a63ea91b00f88780699a05d
VirusTotal
ThreatExpert Analysis
hxxp://free-ipodtouch.com/

load.exe
Result: 23/41 (56.1%)
MD5: 056c4da6712b5b340465fe0fc5ea27ab
VirusTotal
ThreatExpert Analysis
hxxp://cutaiamortgagegroup.cn/fl/welcome.php?id=0

softwarefortubeview.40009.exe
Result: 2/40 (5%)
MD5: 088d24c68e9f1ae123bd5a2bbc2cc70b
VirusTotal
ThreatExpert Analysis
hxxp://exe-4free.com/

a.exe
Result: 2/41 (4.88%)
MD5: 60ee97d0d32685ed956e8e06c5babe33
VirusTotal
ThreatExpert Analysis

b.exe
Result: 2/41 (4.88%)
MD5: d0e9750f20ae4ef17c6ddb96bf888d74
VirusTotal
ThreatExpert Analysis

c.exe or msa.exe
Result: 3/40 (7.5%)
MD5: 77f66b376ec4b9cb488fb24de46e2cb4
VirusTotal
ThreatExpert Analysis

msxml71.dll
Result: 2/41 (4.88%)
MD5: 8d5bc0ce4e7a29a34f03ced884d5235c
VirusTotal
ThreatExpert Analysis

Lv4.exe
Result: 5/40 (12.5%)
MD5: 6480d667075e6bd46a7d7a86407ab6f4
VirusTotal
ThreatExpert Analysis

Lv4.exe or sysguard.exe
Result: 5/40 (12.5%)
MD5: c4539cb6fa3267cca5e943f194e2b2dd
VirusTotal
ThreatExpert Analysis

ld12.exe
Result: 6/41 (14.64%)
MD5: b026b852edcd2c82a9bfce015040f4b8
VirusTotal
ThreatExpert Analysis

gsf83iujid.dll
Result: 21/40 (52.5%)
MD5: f7ac077d4769bd54a9a9769a3bf430b8
VirusTotal
ThreatExpert Analysis

ttrw.exe
Result: 18/37 (48.65%)
MD5: 9939f16d04b3328cdde271380bad6344
VirusTotal
ThreatExpert Analysis

gswrij.exe
Result: 22/41 (53.66%)
MD5: 514103cd33c939ccff85aa2e3f3050dd
VirusTotal
ThreatExpert Analysis

wyqrvts.exe
Result: 7/37 (18.92%)
MD5: 47fe746c558198ebc88141c1fcb1820e
VirusTotal
ThreatExpert Analysis

zjhufhdfe.exe
Result: 18/37 (48.65%)
MD5: 9ab9df0069d2ca94708a3a20ace7b983
VirusTotal
ThreatExpert Analysis

ykdu4wym.exe
Result: 28/40 (70%)
MD5: 1cfaa6345437f0fd9cf150190de786db
VirusTotal
ThreatExpert Analysis

file.exe or winlogon.exe
Result: 16/41 (39.03%)
MD5: d2ae07d299b8582191601fda4be21f98
VirusTotal
ThreatExpert Analysis
hxxp://inb4sk.com/download/

113.exe
Result: 16/41 (39.02%)
MD5: 03b8deece341a303f1c5fd29c5f4bef2
VirusTotal
ThreatExpert Analysis
hxxp://xpdeluxeprotector.com/

3fdf72dfe1f38848ddfc3b140d381ae5.exe
Result: 4/41 (9.76%)
MD5: 3fdf72dfe1f38848ddfc3b140d381ae5
VirusTotal
ThreatExpert Analysis

026.exe
Result: 36/41 (87.81%)
MD5: 3e59f435c8b3525fd33db209ca1197a2
VirusTotal
ThreatExpert Analysis
hxxp://s10248s0s.tzsx226.2666.com.cn/

2.exe
Result: 20/41 (48.79%)
MD5: cb1009efee932dde1e02085423248e15
VirusTotal
ThreatExpert Analysis
hxxp://down.ddosor.cn/

RsmxtuC.dll
Result: 36/41 (87.81%)
MD5: 7a0b0691c6ff3d2f3870a72b74db7293
VirusTotal
ThreatExpert Analysis

beep.sys
Result: 34/41 (82.93%)
MD5: ed4170dde297d5f80f765ad35e6e36cc
VirusTotal
ThreatExpert Analysis

ok.exe
Result: 30/41 (73.18%)
MD5: b467dd68a629637827543c07bf557c48
VirusTotal
ThreatExpert Analysis
hxxp://www.hkzj520.com/

Edsadn.exe
Result: 38/40 (95.00%)
MD5: 97f98921e4cb1fad1782eecc8f41ffe1
VirusTotal
ThreatExpert Analysis

IEupdate.exe
Result: 4/36 (11.11%)
MD5: 9b8cf35caac5c745a51b1bf52ffcdcdf
VirusTotal
ThreatExpert Analysis
hxxp://bot.anhheo.com/

Jul

Database Update: 41 files (Low/Moderate/High Detection)

By djpnuemo 0 Comments

Categories: Database Update, Low Detection, Malicious Domains, Malicious Links and Malware

Files added to our database over the past couple of days.

WARNING: URL’s may still be active. Proceed at your own risk.

gm.exe
Result: 15/40 (37.5%)
MD5: 65c2bc6576cdaea78ecd65047b242ca8
VirusTotal
ThreatExpert Analysis
hxxp://www.qiqijs.com/gm/

879687527.exe or ffxi.exe
Result: 29/41 (70.73%)
MD5: cf09bcea409e6094adbbc7d0f69a7c3d
VirusTotal
ThreatExpert Analysis
hxxp://207.159.133.42/images/v2/

879773428.exe or wow.exe
Result: 11/41 (26.83%)
MD5: 2d966f911fc139604b95a8677eca0564
VirusTotal
ThreatExpert Analysis
hxxp://207.159.133.42/images/v2/

879834329.exe or sk5.exe
Result: 11/41 (26.83%)
MD5: 5bb2edfbb0b769db6c5eebd0d6ed7217
VirusTotal
ThreatExpert Analysis
hxxp://207.159.133.42/images/v2/

879881229.exe or 11630.exe
Result: 7/41 (17.08%)
MD5: ed1db72c2534effe20e6e5d104c501cd
VirusTotal
ThreatExpert Analysis
hxxp://207.159.133.42/images/v2/

Iasv32.dll
Result: 6/41 (14.64%)
MD5: 9669b255bd6596818aec95d166574c50
VirusTotal
ThreatExpert Analysis

pcmstub.sys
Result: 5/41 (12.2%)
MD5: 549211d4da7ec01dd5c40c4053143ca5
VirusTotal
ThreatExpert Analysis

6to4ex.dll
Result: 9/41 (21.96%)
MD5: eaf2b7b2e5c9cbd77418a2802c975f78
VirusTotal
ThreatExpert Analysis

87799212810don.dll
Result: 8/41 (19.52%)
MD5: 435adc4e0b7be6a8f8fc4f4e7e7d4ab6
VirusTotal
ThreatExpert Analysis

879828128usa.dll
Result: 24/41 (58.54%)
MD5: 79f9672ce1047f3e76a80aa425032f35
VirusTotal
ThreatExpert Analysis

87969842828mxx.dll
Result: 5/41 (12.2%)
MD5: 4399c95e5b11aa8b8c9446510263b083
VirusTotal
ThreatExpert Analysis

87990152830mxx.dll
Result: 9/41 (21.96%)
MD5: 0e041d86c0d764ea87f2905c7098c976
VirusTotal
ThreatExpert Analysis

Setup-83c_02022.exe
Result: 0/40 (0%)
MD5: 3a18221ab69e7073b6fadb4f16430b09
VirusTotal
ThreatExpert Analysis
hxxp://1live-antimalware-scanner.com/download/

bb090621.exe
Result: 8/40 (20%)
MD5: 97750fab377384dd4f386cf33325a901
VirusTotal
ThreatExpert Analysis
hxxp://74.52.164.210/pk/

sopidkc.exe
Result: 9/41 (21.96%)
MD5: f3b2f16e1850ed009ef21942d43317f7
VirusTotal
ThreatExpert Analysis

tpsaxyd.exe
Result: 8/41 (19.52%)
MD5: 9a4759f9e61320596b6e3ba3dff4546b
VirusTotal
ThreatExpert Analysis

wiawow32.sys
Result: 4/41 (9.76%)
MD5: 82eaf1e88fdf764ef79ecaa426d0edb4
VirusTotal
ThreatExpert Analysis

winres.exe or logcde.dll or mscgftm.exe or msrkeuzk.exe or mswxbvwf.exe or msxyg.exe or windef.dll or winpaged.ocx
Result: 9/41 (21.96%)
MD5: b1c0b916bd54d43f2c09e9869967a7d1
VirusTotal
ThreatExpert Analysis
hxxp://x.b76.net/

MSWINSCK.OCX
Result: 12/41 (29.27%)
MD5: d945172c37107dedf39b00113c23a743
VirusTotal

installer_70321.exe (Rogue: Antivirus Plus)
Result: 12/41 (29.27%)
MD5: 48a8392ba23c78a154b3a34ccebf81fe
VirusTotal
ThreatExpert Analysis
hxxp://aveyco.cn/

rundll32.exe or AntivirusPlus.exe
Result: 12/40 (30%)
MD5: ace7244d41a5b228a0e15096ca0debf4
VirusTotal
ThreatExpert Analysis
hxxp://nextantivirusplus.com/install/

file.exe or winlogon.exe
Result: 10/40 (25%)
MD5: f390dd90d11ba0ad7930bcdb521f7a63
VirusTotal
ThreatExpert Analysis
hxxp://ina6iq.com/download/

uninstall_pav.exe
Result: 17/40 (42.5%)
MD5: 1ddfd19567b266ae657dc91f8afc2fd5
VirusTotal
ThreatExpert Analysis
hxxp://full-antispyware-scanner.com/

you_are_in_danger.pdf
Result: 8/41 (19.52%)
MD5: dede41335241dbe29378591391146164
VirusTotal
Wepawet Analysis
hxxp://ogzhnsltk.com/plugins/pdf.php

load.exe
Result: 18/40 (45%)
MD5: 0418e1fad04ca45e0353ac319f6594ab
VirusTotal
ThreatExpert Analysis
hxxp://ogzhnsltk.com/plugins/getexe.php

sdra64.exe
Result: 13/41 (31.71%)
MD5: b892237d388f79a2ecc45a747837ed35
VirusTotal
ThreatExpert Analysis

FlashPlayerH264Ext.exe or fqvoheve.exe
Result: 30/40 (75%)
MD5: 99656ce7cb52eb8b98021d41ced25043
VirusTotal
ThreatExpert Analysis
hxxp://www2.porntube-vip.com/downloads/

Setup_build6_102.exe
Result: 6/40 (15.00%)
MD5: bd0e254ee9f56c1878bdf37c1390b314
VirusTotal
ThreatExpert Analysis
hxxp://guardincorp.info/build6_102.php?cmd=getFile&counter=1&p=WKmimHVlaGuHjsbIo21zdYWMpYOInKOjY4nT1m6uqI61h8WilnGbk4F5bg%3D%3D

hb.exe or system32StopAor.exe
Result: 37/41 (90.24%)
MD5: 5e463684c3d8d2b9d3571f68aa6f3534
VirusTotal
ThreatExpert Analysis
hxxp://freett.com/950065/

hb1.exe
Result: 39/40 (97.50%)
MD5: 2941e1da3046c811062f1035eabb460c
VirusTotal
ThreatExpert Analysis
hxxp://freett.com/950065/

cq.exe
Result: 36/41 (87.81%)
MD5: 1dba0aa5b1c9816bb99e4939102d4fb3
VirusTotal
ThreatExpert Analysis
hxxp://freett.com/950065/

qn3.exe
Result: 38/41 (92.69%)
MD5: 473c5703c5775089f68ec1b1b9531ade
VirusTotal
ThreatExpert Analysis
hxxp://freett.com/950065/

pt.exe
Result: 34/41 (82.93%)
MD5: db1e3af73a496235cefad9ff9b0cd5ee
VirusTotal
ThreatExpert Analysis
hxxp://freett.com/950065/

guama.exe
Result: 40/41 (97.57%)
MD5: 8fe698cc98db1b6ea904082d505ff687
VirusTotal
ThreatExpert Analysis
hxxp://freett.com/950065/

arp.exe
Result: 29/41 (70.73%)
MD5: 4ee8ec44f3efee38aa0b56060a5d2b49
VirusTotal
ThreatExpert Analysis
hxxp://freett.com/950065/

pdrv.exe (Koobface)
Result: 16/41 (39.03%)
MD5: 270610f4f30b36324fe58f53cd6431ce
VirusTotal
ThreatExpert Analysis
hxxp://liesbethmilan.be/1/

drv.dll
Result: 7/41 (17.08%)
MD5: 3df0a669e0f88d38f4c85e25bea7759c
VirusTotal
ThreatExpert Analysis

drv.sys
Result: 10/41 (24.4%)
MD5: ef68e3c5136fe4432eb9ea88f7e7764e
VirusTotal
ThreatExpert Analysis

ActiveXsetup.exe
Result: 6/41 (14.64%)
MD5: c8284ef13ae75aa65c7ccaa410bc0ba4
VirusTotal
ThreatExpert Analysis
hxxp://shadexover.com/download/4276493576513d3d6d9d76c520090701/

.exe
Result: 1/40 (2.5%)
MD5: a5f122323c6ad6ce1404f54d337f26da
VirusTotal
ThreatExpert Analysis

tube_preview_141.exe (Rogue: Fast Antivirus 2009)
Result: 5/41 (12.2%)
MD5: 6b8e236b7608739d82db998f6d8b66e4
VirusTotal
ThreatExpert Analysis
hxxp://pokjuyt.ru/tube/

Jun

Database Update: 31 files (Low/Moderate Detection)

By djpnuemo 0 Comments

Categories: Database Update, Infection, Malicious Domains, Malicious Links and Malware

Files added to our database recently.

WARNING: URL’s may still be active. Proceed at your own risk.

logo.bmp
Result: 0/41 (0%)
MD5: 2084e9d74c7b69328bae463ec1bcfd16
VirusTotal
hxxp://recentbaseupdates.com/logo.bmp

rundll32.exe or AntivirusPlus.exe
Result: 15/41 (36.59%)
MD5: 9fcd867dc11848fc5d21b21445fbc7b9
VirusTotal
ThreatExpert Analysis
hxxp://nextantivirusplus.com/install/

InternetExplorer.dll
Result: 18/41 (43.91%)
MD5: b845fd0c24a794c5406f8a6772998a26
VirusTotal
ThreatExpert Analysis
hxxp://nextantivirusplus.com/install/

a.exe
Result: 1/41 (2.44%)
MD5: e3ed28a166aa120721a4f57531833197
VirusTotal
ThreatExpert Analysis

b.exe
Result: 11/41 (26.83%)
MD5: 1324477cf952062eccd3dc3e00540b37
VirusTotal
ThreatExpert Analysis

c.exe or msa.exe
Result: 8/41 (19.52%)
MD5: 3877597245bb995dbc8714b27a96bc10
VirusTotal
ThreatExpert Analysis

msxml71.dll
Result: 2/41 (4.88%)
MD5: d44b3cb9f39e2458b2f78155e8b1b8a9
VirusTotal
ThreatExpert Analysis

6746.pdf
Result: 19/41 (46.35%)
MD5: b7b7d52a205e950adf4795c14c7f7178
VirusTotal
Wepawet Analysis
hxxp://antivirusxp09.com/traff/pdf.php?id=1118

load.exe or winagent.exe
Result: 22/41 (53.66%)
MD5: 5ee26f43139a2cdb3a79a835574285a0
VirusTotal
ThreatExpert Analysis
hxxp://antivirusxp09.com/traff/load.php?id=1118&spl=2

1.exe
Result: 37/41 (90.25%)
MD5: b5ab26bfcdb6593eadb70c5d56a42a99
VirusTotal
ThreatExpert Analysis
hxxp://sesese.y145c.cn/

EN7hzSreCat8.dll or comres.dll
Result: 37/40 (92.5%)
MD5: 8eff27684cf5225720a48d22665eebdb
VirusTotal
ThreatExpert Analysis

dfc8ac3ed7da.dll
Result: 0/41 (0.00%)
MD5: 6728270cb7dbb776ed086f5ac4c82310
VirusTotal
ThreatExpert Analysis

Setup_build6_102.exe (Rogue: Fast Antivirus 2009)
Result: 2/40 (5%)
MD5: a8b49c0d46d93aa4fb366d8898201809
VirusTotal
ThreatExpert Analysis
hxxp://guardsecurity.info/build6_102.php?cmd=getFile&counter=2&p=WKmimHVlaGuHjsbIo21zdYWMpYOInKOjY4nT1m6uqI61h8WilnGbk4F5bw

ReleaseXP.exe
Result: 3/41 (7.32%)
MD5: 4d94aaa4631913325032f6201cd141ee
VirusTotal
ThreatExpert Analysis
hxxp://update1.fastantivirus09.com/

captcha6.exe
Result: 30/41 (73.18%)
MD5: ac479a1ccd4064e6606241779b31bf74
VirusTotal
ThreatExpert Analysis
hxxp://liesbethmilan.be/1/

captcha7.dll
Result: 6/41 (14.64%)
MD5: ee1f766d6c955e426d24c72f3e3c9463
VirusTotal
ThreatExpert Analysis

ms.19.exe or mstre19.exe
Result: 15/41 (36.59%)
MD5: 58270dfd18b345176026ff089ca42352
VirusTotal
ThreatExpert Analysis
hxxp://liesbethmilan.be/1/

load.exe or owner.exe
Result: 29/41 (70.74%)
MD5: 076e74cf244e1f7fbf11159b08c576ba
VirusTotal
ThreatExpert Analysis
hxxp://109438129432.cn/load.php

TubeViewer.ver.6.40000.exe
Result: 4/41 (9.76%)
MD5: 5aeb5ee2dccfb029b865fe30aa7ebb26
VirusTotal
ThreatExpert Analysis
hxxp://load-exe-soft.com/

a.exe
Result: 1/41 (2.44%)
MD5: 49da0a5577c17cca87ffc0115c7da574
VirusTotal
ThreatExpert Analysis

b.exe
Result: 11/41 (26.83%)
MD5: 00baaab086f7d8ec463b074a1ab46bb9
VirusTotal
ThreatExpert Analysis

c.exe or msa.exe
Result: 9/41 (21.96%)
MD5: df7ce58468b46bb5f71a2720166caf16
VirusTotal
ThreatExpert Analysis

msxml71.dll
Result: 2/41 (4.88%)
MD5: 7b0ebaaed7e77e0532140e59e0406d60
VirusTotal
ThreatExpert Analysis

1.exe
Result: 21/40 (52.5%)
MD5: a4c944246ed2138959275b9dd8770bf0
VirusTotal
ThreatExpert Analysis
hxxp://ztb.cztv.tv/360/

2.exe
Result: 32/40 (80%)
MD5: 58e94a21fa5a7100b97c1ccbd091c835
VirusTotal
ThreatExpert Analysis
hxxp://ztb.cztv.tv/360/

7.exe
Result: 34/40 (85%)
MD5: b96716771808bbbb12c17de3de30f04f
VirusTotal
ThreatExpert Analysis
hxxp://ztb.cztv.tv/360/

88.exe
Result: 36/40 (90%)
MD5: b14f3467f24d5eb5d97033da30f5e47c
VirusTotal
ThreatExpert Analysis
hxxp://ztb.cztv.tv/360/

9.exe
Result: 27/40 (67.5%)
MD5: eef2b225fe9b1490fc40e964086238c5
VirusTotal
ThreatExpert Analysis
hxxp://ztb.cztv.tv/360/

wr.exe
Result: 37/41 (90.25%)
MD5: 69749483bb3ed0801e5e888be4321aee
VirusTotal
ThreatExpert Analysis
hxxp://zief.pl/

AXObject.exe
Result: 20/41 (48.79%)
MD5: e55cbcb959b0099e6d151d3e92791daa
VirusTotal
ThreatExpert Analysis
hxxp://go-file.ru/

codec.exe
Result: 20/41 (48.79%)
MD5: 8df3e47e38c8c33f45593437557b6e7c
VirusTotal
ThreatExpert Analysis
hxxp://pornotube915.com/codec/145.exe

Jun

Database Update: 23 files (Low/Moderate Detection)

By djpnuemo 0 Comments

Categories: Database Update, Infection, Low Detection, Malicious Links and Malware

Files added to database.

WARNING: URL’s may still be active. Proceed at your own risk.

sdra64.exe
Result: 7/40 (17.5%)
MD5: 02e2ce182e9359efe5f6e1d79cd78e16
VirusTotal
ThreatExpert Analysis

djellow.exe
Result: 15/41 (36.59%)
MD5: b68e23e9c835eb1b4a0105e84ce14011
VirusTotal
ThreatExpert Analysis

sdra64.exe
Result: 11/41 (26.83%)
MD5: 87b0742c3b641546becb77b61ffcae40
VirusTotal
ThreatExpert Analysis

officexp-KB910721-FullFile-ENU.exe
Result: 10/41 (24.4%)
MD5: abadbbb846c07f71d4fb16dbde1cb561
VirusTotal
ThreatExpert Analysis

sdra64.exe
Result: 7/41 (17.08%)
MD5: 8333a17a7016b0caf7f2178ecd940fa8
VirusTotal
ThreatExpert Analysis

file.exe
Result: 4/41 (9.76%)
MD5: 18bd1982d5f3e28a58b56b564f962b8c
VirusTotal
ThreatExpert Analysis
hxxp://fanus.ru/bonbon/load.php?s=4

install.exe (Rogue: System Security 2009)
Result: 15/41 (36.59%)
MD5: cd497ff449aadb1efcc4f44797ec8732
VirusTotal
ThreatExpert Analysis
hxxp://kuprotect.com/download.php?affid=02909

13554534.exe
Result: 10/41 (24.4%)
MD5: 41f3f00137aa389428b92dfc2fa76209
VirusTotal
ThreatExpert Analysis

installer_70157.exe (Rogue: Antivirus Plus)
Result: 21/41 (51.22%)
MD5: f665e70a05ee55aa9b179cc80900b196
VirusTotal
ThreatExpert Analysis
hxxp://akipahu.cn/

AntivirusPlus.exe or rundll32.exe
Result: 11/41 (26.83%)
MD5: eb36d6b1a90451a7dc6251fc26ba251b
VirusTotal
ThreatExpert Analysis
hxxp://antivirusplus-ok.com/install/

InternetExplorer.dll
Result: 10/41 (24.4%)
MD5: ddc43cafed98331d5e3cc115d2cf48a4
VirusTotal
ThreatExpert Analysis
hxxp://antivirusplus-ok.com/install/

se.exe or svchost.exe or dop.exe
Result: 19/41 (46.35%)
MD5: 032dd14816ee4c9bac778c745017e9e6
VirusTotal
ThreatExpert Analysis
hxxp://antivirusplus-ok.com/

readme.pdf
Result: 13/41 (31.71%)
MD5: 9024f01f1a79f1851d203c340809322f
VirusTotal
Wepawet Analysis
hxxp://765admins.cn/forum/cache/

load.exe
Result: 7/41 (17.08%)
MD5: 426bfc598ebb325720ebc992bf482bd6
VirusTotal
ThreatExpert Analysis

http://765admins.cn/forum/load.php?id=4

sdra64.exe
Result: 5/41 (12.2%)
MD5: 85b3112950ed814ff4c964336a64b1d8
VirusTotal
ThreatExpert Analysis

install.exe
Result: 15/41 (36.59%)
MD5: b475950d6c1f115a46b96f61937dfb1b
VirusTotal
ThreatExpert Analysis
hxxp://thesecuritytools.com/download.php?affid=20900

12552964.exe
Result: 10/41 (24.4%)
MD5: 6389dd444884eed6a1621a24ad244046
VirusTotal
ThreatExpert Analysis

install.exe (Rogue: System Security 2009)
Result: 10/41 (24.4%)
MD5: a0499193519aba03a9508e72338ddf08
VirusTotal
ThreatExpert Analysis
hxxp://howtosecurepc.com/download.php?affid=08003

13202504.exe
Result: 10/41 (24.4%)
MD5: adc0c1074ee222f9840b80a4cbacff92
VirusTotal
ThreatExpert Analysis

Invoice_8384883.exe
Result: 11/38 (28.95%)
MD5: 984ec3946b7244c8fff631e202fc2f8a
VirusTotal
ThreatExpert Analysis
hxxp://istitutomicoterapico.it/

sdra64.exe
Result: 9/41 (21.96%)
MD5: d859e447ac9dbd8f6c26cc1862df9942
VirusTotal
ThreatExpert Analysis

movie.avi.exe
Result: 17/41 (41.47%)
MD5: 0029a989eb18e4215b122a3d565c7b3a
VirusTotal
ThreatExpert Analysis
hxxp://ad-videozz.com/

wmpcodec.exe or windows.exe
Result: 17/41 (41.47%)
MD5: f028c315649b7319e8ef2cc22dc67690
VirusTotal
ThreatExpert Analysis
hxxp://youtorube.com/Codec/

Jun

New malware domain: best-filecenter.com

By djpnuemo 0 Comments

Categories: Database Update, Infection, Low Detection, Malicious Domains, Malicious Links and Malware

hxxp://all-in-tube.com/xplays.php?id=40014&name=weeds+season+5+episode+3

Whois entry for best-filecenter.com 64.20.38.171
PrivacyProtect.org
Domain Admin
P.O. Box 97
Note – All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

Whois entry for all-in-tube.com 216.240.143.7
PrivacyProtect.org
Domain Admin
P.O. Box 97
Note – All Postal Mails Rejected, visit Privacyprotect.org
Moergestel
null,5066 ZH
NL
Tel. +45.36946676

streamviewer.40014.exe
Result: 1/41 (2.44%)
MD5: e9e4a276ad0c46c35b65d8113e6e4378
VirusTotal
ThreatExpert Analysis
hxxp://best-filecenter.com/