국내 S쇼핑몰, M영화관련 홈페이지에서 유포중인 악성코드 진단현황

https://cafe.naver.com/malzero/556국내 S쇼핑몰, M영화관련 홈페이지등 다수 국내 웹사이트에 iframe태그를 삽입하여 유포중인 악성코드 진단현황입니다.



벌새님께서 작성하신 글 https://cafe.naver.com/malzero/533 에 언급된 악성코드와 동일한 것 입니다. 해당 악성코드가 업로드된 URL이 하나 더 늘어 났네요.



hxxtp://www.ca**.or.kr/***/main.htm (MDAC exploit)
hxxp://www.sem***.com/******/js/ow.htm (MDAC exploit)


hxxp://www.ks**.or.kr/one/****/h.exe (Trojan)



                          File h.exe received on 10.27.2007 05:21:31 (CET)
                                            Current status:  finished
                                             Result: 18/32 (56.25%)



Antivirus Version Last Update Result
AhnLab-V3 2007.10.27.0 2007.10.26 Dropper/OnlineGameHack.62464
AntiVir 7.6.0.30 2007.10.26 TR/PSW.Gamec.CK.1
Authentium 4.93.8 2007.10.26 -
Avast 4.7.1074.0 2007.10.26 -
AVG 7.5.0.503 2007.10.26 PSW.OnlineGames.MHT
BitDefender 7.2 2007.10.27 -
CAT-QuickHeal 9.00 2007.10.26 TrojanPSW.Gamec.ck
ClamAV 0.91.2 2007.10.27 -
DrWeb 4.44.0.09170 2007.10.26 Trojan.PWS.Gamania.4449
eSafe 7.0.15.0 2007.10.22 Win32.Gamec.ck
eTrust-Vet 31.2.5244 2007.10.26 -
Ewido 4.0 2007.10.26 -
FileAdvisor 1 2007.10.27 High threat detected
Fortinet 3.11.0.0 2007.10.19 W32/DelpDldr.B!tr.pws
F-Prot 4.3.2.48 2007.10.26 -
F-Secure 6.70.13030.0 2007.10.26 Trojan-PSW.Win32.Gamec.ck
Ikarus T3.1.1.12 2007.10.27 Trojan-Dropper.Win32.Delf.aho
Kaspersky 7.0.0.125 2007.10.27 Trojan-PSW.Win32.Gamec.ck
McAfee 5150 2007.10.26 PWS-Lineage
Microsoft 1.2908 2007.10.27 -
NOD32v2 2620 2007.10.27 -
Norman 5.80.02 2007.10.26 -
Panda 9.0.0.4 2007.10.27 Trj/Lineage.BZE
Prevx1 V2 2007.10.27 -
Rising 19.46.42.00 2007.10.26 -
Sophos 4.22.0 2007.10.26 Mal/DelpDldr-B
Sunbelt 2.2.907.0 2007.10.27 -
Symantec 10 2007.10.27 Infostealer.Gampass
TheHacker 6.2.9.107 2007.10.25 Trojan/PSW.Gamec.ck
VBA32 3.12.2.4 2007.10.26 Trojan.PWS.Gamania.4449
VirusBuster 4.3.26:9 2007.10.26 -
Webwasher-Gateway 6.6.1 2007.10.27 Trojan.PSW.Gamec.CK.1
Additional information
File size: 62464 bytes
MD5: ded1627cdb3476687e200a284cf98bcc
SHA1: 8d64d69733c5a0d6c8edf50890f232919a40cfb6








VirSCAN.Org 스캔결과 중 일부


백신제품 / 엔진 버전 / 시그니처 버전 / 시그니처 날짜 / 검사 결과

Hauri ViRobot / 20071026 / 2007.10.26 / 2007-10-26 / Trojan.Win32.PSWIGames.62464
INCA nProtect / 2007-10-26.00 / 1010301 / 2007-10-26 / -
Trend Micro / 8.500-1001 / 4.798.01 / 2007-10-26 / TSPY_ONLINEG.JIZ
JIANGMIN / 10.00.650 / 2007.10.25 / 2007-10-25 / TrojanDropper.Delf.avp
KINGSOFT / 2007.6.20.249 / 2007.10.27 / 2007-10-27 / Win32.PSWTroj.Gamec.ck.62464