국내 J영화관련사이트, B커뮤니티 홈페이지에서 유포중인 악성코드 진단현황

https://cafe.naver.com/malzero/555국내 J영화관련사이트, B커뮤니티 홈페이지등 다수 국내 웹사이트에 iframe태그를 삽입하여 유포중인 악성코드 진단현황입니다.



hxxp://www.handy****.co.kr/***/flv_118879094O_0.011774.flv (Trojan / ANI Cursor취약점을 이용하여 유포)

hxxp://219.***.37.***/download/****/xtd_map_udp.gif (Trojan / MDAC 취약점을 이용하여 유포)



flv_118879094O_0.011774.flv, xtd_map_udp.gif 두 파일은 동일.



      File flv_118879094O_0.011774.flv received on 10.27.2007 05:01:33 (CET)
                                        Current status:  finished
                                         Result: 19/32 (59.38%)



Antivirus Version Last Update Result
AhnLab-V3 2007.10.27.0 2007.10.26 -
AntiVir 7.6.0.30 2007.10.26 TR/PSW.Hangame.FA.1
Authentium 4.93.8 2007.10.26 -
Avast 4.7.1074.0 2007.10.26 Win32:OnLineGames-AV
AVG 7.5.0.503 2007.10.26 PSW.OnlineGames.MHS
BitDefender 7.2 2007.10.27 -
CAT-QuickHeal 9.00 2007.10.26 (Suspicious) - DNAScan
ClamAV 0.91.2 2007.10.27 PUA.Packed.UPack-1
DrWeb 4.44.0.09170 2007.10.26 Trojan.Proxy.origin
eSafe 7.0.15.0 2007.10.22 suspicious Trojan/Worm
eTrust-Vet 31.2.5244 2007.10.26 -
Ewido 4.0 2007.10.26 -
FileAdvisor 1 2007.10.27 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.3.2.48 2007.10.26 -
F-Secure 6.70.13030.0 2007.10.26 W32/Viking.EQ
Ikarus T3.1.1.12 2007.10.27 Trojan-Spy.Win32.Agent.hz
Kaspersky 7.0.0.125 2007.10.27 -
McAfee 5150 2007.10.26 New Malware.ey
Microsoft 1.2908 2007.10.27 -
NOD32v2 2620 2007.10.27 a variant of Win32/PSW.OnLineGames.BX
Norman 5.80.02 2007.10.26 W32/Viking.EQ
Panda 9.0.0.4 2007.10.27 Suspicious file
Prevx1 V2 2007.10.27 Heuristic: Suspicious File With Anti-Debug Technology
Rising 19.46.42.00 2007.10.26 -
Sophos 4.22.0 2007.10.26 Mal/Packer
Sunbelt 2.2.907.0 2007.10.27 VIPRE.Suspicious
Symantec 10 2007.10.27 -
TheHacker 6.2.9.107 2007.10.25 -
VBA32 3.12.2.4 2007.10.26 Trojan.PWS.Lineage.3475
VirusBuster 4.3.26:9 2007.10.26 Packed/Upack
Webwasher-Gateway 6.6.1 2007.10.27 Trojan.PSW.Hangame.FA.1
Additional information
File size: 76028 bytes
MD5: 44241e1a22f7acd759a33009be370710
SHA1: da618557dce01df95b52abd73ee9bb980661391e
packers: Upack, Upack, UPX





VirSCAN.Org 스캔결과 중 일부


백신제품 / 엔진 버전 / 시그니처 버전 / 시그니처 날짜 / 검사 결과

Hauri ViRobot / 20071026 / 2007.10.26 / 2007-10-26 / -
INCA nProtect / 2007-10-26.00 / 1010301 / 2007-10-26 / -
Trend Micro / 8.500-1001 / 4.798.01 / 2007-10-26 / -
JIANGMIN / 10.00.650 / 2007.10.25 / 2007-10-25 / -
KINGSOFT / 2007.6.20.249 / 2007.10.27 / 2007-10-27 / -