BLADE Malicious URL Analysis

Hi malware fighters,

See the evolving list here: http://www.blade-defender.org/eval-lab/

example: 58d250aa7f4ba35217c7d285daf02949 2010-05-17 Eleonore Exploits pack v1.4.1 FF3 11/41 (26.83%) TR/Crypt.ZPACK.Gen Blocked MD hxxp://allnettraf.com/
allnettraf*com
Summary
•Computer Threats: 1

General Info: Web Site Location Ukraine

allnettraf*com
Threat Report

Total threats found: 1

Small-whitebg-red Virus

Threats found: 1
Here is a complete list:
Threat Name: Trojan.FakeAV!gen27
Location: htxp://allnettraf.com/ve5rf/load.php?spl=java_gsb&h=

polonus

I’m not really sure of the benefit of this page as it doesn’t have a searchable list, to say compare a url against the list.

However the home page gives a little more information about Blade and that it may be released to the public, http://www.blade-defender.org/.

Hi DavidR,

You can search the list online. I give an example here, where I entered the hxxp address into google for: hxxp://testforus.com/pdf.php which has: Trojan.Win32.SuspectCRC!IK
with the following search results
http://www.google.nl/#hl=nl&source=hp&q=hxxp%3A%2F%2Ftestforus.com%2Fpdf.php&btnG=Google+zoeken&aq=f&aqi=&aql=&oq=hxxp%3A%2F%2Ftestforus.com%2Fpdf.php&gs_rfai=&fp=a7d7280068b179f4
unmasked parasites: http://www.google.com/safebrowsing/diagnostic?site=testforus.com
http://www.freepcsecurity.co.uk/2010/04/12/malicious-sites-april-12/

polonus

Yes, but what a mess/long winded way to do it, who is going to enter that, I certainly wouldn’t so to all intents and purposes this information is lost to the masses.

Not to mention the search data that you are entering is for a malware name and not for a site specifically, which given the topic title and the blade site we are looking at combating drive by infections at known sites. Given that there is no standardisation/convention on malware naming there is a likelihood nothing would be found for an alias. So for me that site is depreciated if the data is there and you can’t use it.

There are numerous sites that not only gather the data but also allow that data to be searched from their site.

Yeah! A lengthy process…but it might change after they release their software

Hi Chris Thomas,

Another one blocked by blade: http://safeweb.norton.com/report/show?url=tracker.bizrgm.com%2Fvideo%2F&x=11&y=8

pol