Is this a fly-code packer FP detection for Trj/Xpacked.A, avast does not flag?

Viruses and worms
1

See: http://urlquery.net/report.php?id=85294
IDS snort alert: FILE-IDENTIFY download of executable content (Could this be a bad pcap alert)
Is this a “packed by FLY-CODE” generic detection?
See: https://www.virustotal.com/file/d876fcfb91b43266ed8dcbf5401b1779a887def385da7ae2b5e996afd1ca9f56/analysis/1341753791/
http://vscan.urlvoid.com/analysis/a797314fd71d6c2ecd8931a6629eab90/cGxheS12aWRlbzMyODQtY2xpY2stcnVuLWV4ZQ==/
See: http://anubis.iseclab.org/?action=result&task_id=11edc621b9eb411e4a9481fbca7eb416b

polonus

2

Hi Polonus,

Your request has been analyzed by an automatic system. The corresponding entry is added to Dr.Web virus database and will be available in the next update.

Threat: BackDoor.Maxplus.6135

Original file name: play_video3284_click_run.exe
File size: 216 064
MD5: a797314fd71d6c2ecd8931a6629eab90

3

Hi Dim@rik,

Again thanks for reporting and cooperational analysis, reported backdoor to virus AT avast dot com for adding to detection.
As I stated at many occasions before avast and DrWeb’s are additional software par excellence where detection is concerned.
That is why in doubt I use the avast residential av solution and then use DrWeb’s CureIt for a second op.
Also I am a satisfied and long time user of DrWeb’s online check service and also use it as an extension in my browser of choice,

polonus

4

ThreatExpert