국내 C언론사, S언론사 홈페이지에서 유포중인 악성코드 진단현황

https://cafe.naver.com/malzero/554C언론사, S언론사 홈페이지에등 다수 국내 웹사이트에 iframe태그를 삽입하여 유포중인 악성코드 진단현황입니다.



hxxp://221.***.51.***/help.htm (MDAC exploit)
hxxp://221.***.51.***/T.exe (Trojan)



File T.exe received on 10.27.2007 04:45:48 (CET)
Current status:  finished
Result: 13/32 (40.63%)

Antivirus Version Last Update Result
AhnLab-V3 2007.10.27.0 2007.10.26 Dropper/KorGameHack.58444
AntiVir 7.6.0.30 2007.10.26 TR/Crypt.NSPM.Gen
Authentium 4.93.8 2007.10.26 -
Avast 4.7.1074.0 2007.10.26 -
AVG 7.5.0.503 2007.10.26 Obfustat.UKL
BitDefender 7.2 2007.10.27 Packer.Malware.NSAnti.J
CAT-QuickHeal 9.00 2007.10.26 (Suspicious) - DNAScan
ClamAV 0.91.2 2007.10.27 -
DrWeb 4.44.0.09170 2007.10.26 Trojan.Nsanti.Packed
eSafe 7.0.15.0 2007.10.22 suspicious Trojan/Worm
eTrust-Vet 31.2.5244 2007.10.26 -
Ewido 4.0 2007.10.26 -
FileAdvisor 1 2007.10.27 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.3.2.48 2007.10.26 -
F-Secure 6.70.13030.0 2007.10.26 -
Ikarus T3.1.1.12 2007.10.27 Packer.Malware.NSAnti.J
Kaspersky 7.0.0.125 2007.10.27 Packed.Win32.NSAnti.r
McAfee 5150 2007.10.26 -
Microsoft 1.2908 2007.10.27 -
NOD32v2 2620 2007.10.27 -
Norman 5.80.02 2007.10.26 -
Panda 9.0.0.4 2007.10.27 Suspicious file
Prevx1 V2 2007.10.27 Heuristic: Suspicious Self Modifying EXE
Rising 19.46.42.00 2007.10.26 -
Sophos 4.22.0 2007.10.26 -
Sunbelt 2.2.907.0 2007.10.27 -
Symantec 10 2007.10.27 -
TheHacker 6.2.9.107 2007.10.25 -
VBA32 3.12.2.4 2007.10.26 MalwareScope.Worm.Viking.3
VirusBuster 4.3.26:9 2007.10.26 -
Webwasher-Gateway 6.6.1 2007.10.27 Trojan.Crypt.NSPM.Gen


Additional information
File size: 58444 bytes
MD5: 3871000663e711b870b5e8e99750c750
SHA1: 650791320d8a66ab27e3f25de67645bcd15aec3a







VirSCAN.Org 스캔결과 중 일부


백신제품 / 엔진 버전 / 시그니처 버전 / 시그니처 날짜 / 검사 결과

Hauri ViRobot / 20071026 / 2007.10.26 / 2007-10-26 / -
INCA nProtect / 2007-10-26.00 / 1010301 / 2007-10-26 / Packer.Malware.NSAnti.J
Trend Micro / 8.500-1001 / 4.798.01 / 2007-10-26 / Possible_MLWR-1
JIANGMIN / 10.00.650 / 2007.10.25 / 2007-10-25 / -
KINGSOFT / 2007.6.20.249 / 2007.10.27 / 2007-10-27 / Win32.Hack.NSAnti.ge