what is this? new malware?

Article View: alt.binaries.comp.virus

Article #2

Back to alt.binaries.comp.virus Previous Next

From: kreepz
Date: Thu, 21 Feb 2008 22:44

33 lines
3187 bytes

is this new malware?

hello, i was checking my email yesterday @ hotmail.com and while there i got
an email from a nicole smith.  in the email was a attachment of what
appeared to be a valid jpg file "nicole256.jpg" however when put my mouse on
the image i noticed the link on the status bar was not to a jpg file but to
another site "http://xxx.241.xxx.30/pics/nicole256.php".  needless to say,
it was a spoofed link to an "exe" file.  i downloaded the file and scanned
it with avp kav 7.0 with the very latest definitions and it found nothing
wrong with the file.  not even as suspicios.  i have included 3 screenshots
and what appeared as a suspicious string of the source code of the hotmail
page (see below).  i also included an image of the scan from virus total,
several scanners did register it as malware and a couple as suspicious.
this is a new thing for me because hotmail always restricts executables as
attachments but this one seemed to get by with no problem.

when i submitted the file at KAV site for a scan and it told me the file was
ok.


i also included the source code of the hotmail page at the time of recieving
this.


the email itself.
http://img141.imageshack.us/img141/3420/nicoleey4.jpg

the script in the email page
http://img299.imageshack.us/img299/9241/suspiciousscriptkz0.jpg

virus total file scans
http://img297.imageshack.us/img297/885/19233463di3.jpg
http://img522.imageshack.us/img522/5752/98914782at9.jpg

Technical Details

Message-ID: <Z8nvj.11921$J41.6478@newssvr14.news.prodigy.net>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!out02b.usenetserver.com!news.usenetserver.com!in04.usenetserver.com!news.usenetserver.com!newscon02.news.prodigy.net!prodigy.net!newsdst01.news.prodigy.net!prodigy.com!postmaster.news.prodigy.com!newssvr14.news.prodigy.net.POSTED!8a905781!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Thread: 111298,7d5b511836d199ea,start
X-Google-Thread: fcd68,7d5b511836d199ea,start
X-Google-Thread: 113a80,7d5b511836d199ea,start
X-Google-Thread: 108f9a,7d5b511836d199ea,start
X-Google-Thread: 115dc1,7d5b511836d199ea,start
X-Google-Attributes: gid111298,gidfcd68,gid113a80,gid108f9a,gid115dc1,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!out02b.usenetserver.com!news.usenetserver.com!in04.usenetserver.com!news.usenetserver.com!newscon02.news.prodigy.net!prodigy.net!newsdst01.news.prodigy.net!prodigy.com!postmaster.news.prodigy.com!newssvr14.news.prodigy.net.POSTED!8a905781!not-for-mail
From: "kreepz" <(remove" _-" to reply)kreepz86_-_-_@gmail.com>
Newsgroups: alt.binaries.comp.virus,alt.comp.anti-virus,alt.comp.virus,free.it.norton.antivirus,microsoft.public.scripting.virus.discussion,microsoft.public.security.virus
Subject: what is this?  new malware?
Lines: 39
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
X-RFC2646: Format=Flowed; Original
Message-ID: <Z8nvj.11921$J41.6478@newssvr14.news.prodigy.net>
NNTP-Posting-Host: 76.195.145.146
X-Complaints-To: abuse@prodigy.net
X-Trace: newssvr14.news.prodigy.net 1203633849 ST000 76.195.145.146 (Thu, 21 Feb 2008 17:44:09 EST)
NNTP-Posting-Date: Thu, 21 Feb 2008 17:44:09 EST
Organization: SBC http://yahoo.sbc.com
X-UserInfo1: TSU[@I_AO@SYB_\Y]ZHHOFXBWR\HPCTL@XT^OBPLAH[\RZ]CDVW[AKK[J\]^HVKHG^EWZHBLO^[\NH_AZFWGN^\DHNVMX_DHHX[FSQKBOTS@@BP^]C@RHS_AGDDC[AJM_T[GZNRNZAY]GNCPBDYKOLK^_CZFWPGHZIXW@C[AFKBBQS@E@DAZ]VDFUNTQQ]FN
Date: Thu, 21 Feb 2008 22:44:09 GMT