Network Shield detects download as JS:Downloader-All[Trj]

Viruses and worms
1

I tried to download Revelo from here: http://www.kahusecurity.com/tools/Revelo_v0.5.1.zip
MD5: AEA8185AE1C0292B757EC8D086F1D7FF
last update Last Update: 02/24/13
Description of revelo: Deobfuscate Javascript using a variety of different methods; includes a built-in JS beautifier, DOM walker, firewall, packet sniffer, and proxy. Note: If analyzing malicious content, please use in a virtual machine. If the script calls Java, Acrobat, or some other plug-in, Revelo won’t protect you.

Is this riskware. Why is avast blocking the download?
See: https://www.virustotal.com/nl/file/c6b23e2a3a458dd8d8b8bf431d1bef22bc546b0b83a799cb14da0e65c05e8c71/analysis/1367778723/

polonus

2

Also see: http://www.malwarepatrol.com/cgi/search.pl?id=VHJvamFuLkpTLklmcmFtZS55dQ==

pol

3

Hello,
there is some obfuscated javascript.

Milos

4

Hi Milos,

Strange as this all-in-one- tool is used by a Panda AV analyst, see: https://www.security.nl/artikel/46658/1/Security_Tip_van_de_Week%3A_onderzoek_malware_in_je_eigen_lab.html (link article author = Bart Blaze)
Found the info stumbling on that link…

polonus

5

Hi Polonus,

http://online3.drweb.com/cache/?i=9eca9a209add13ce935063c22ec77e5f

6

Hi Dimitrij,

Seen that as I have DrWeb extension inside Google Chrome → verdict suspicious…
see: http://anubis.iseclab.org/?action=result&task_id=11e816a483f1d6d14914e2b33520597e8&format=html
Some code spoofing goin’ on and resetter software…

Damian