Samples missed by avast (VirusTotal links only!)

system · June 13, 2013, 12:49pm

Good find Pol,show how fast these things spread

system · June 15, 2013, 9:56am

Again FUD autorun sample >:(

https://www.virustotal.com/en/file/3ff323e2bd69cab9f2a015f1df6402c96477c6591625bcb73c6defa597f0d6e7/analysis/1371289602/
https://www.virustotal.com/en/file/a293e9a0edb0c34de2b348ffa053a2ee4c965a5b678fd545a81ea16414494dc4/analysis/1371289603/

submitted to avast.

EDIT: WTF one of the sample is 4 days old and still FUD,no AV vendor see’s it yet :o :o :o

First submission 2013-06-11 08:24:31 UTC ( 4 days, 1 hour ago )

polonus · June 15, 2013, 11:53am

These samples were found here: http://forums.malwarebytes.org/index.php?showtopic=127787
and also sunmitted here: http://support.emsisoft.com/topic/11569-true-indians-submissions/
i04040.js for instance should be detected by avast as HTML:Iframe-MS [Trj]

polonus

system · June 24, 2013, 3:32pm

Bad Boys gathered from USB

https://www.virustotal.com/en/file/c379ef4ffe8bd8abd5a3cb31a76c55de6946a1756a62d26398d27c3222f54e5b/analysis/1372086166/
https://www.virustotal.com/en/file/96b11e12f04062130ae4155d7dc6395735f61d829fa3b4eaf371af89e4acf944/analysis/1372086268/
https://www.virustotal.com/en/file/42257f704c68bb9bb4b10e3a670d859551d971c9addc1e126a8543daebcb5595/analysis/1372086319/
https://www.virustotal.com/en/file/c7bd252296272693d8ad658295de6ca89c6c0dd42c054ebb58f571aad1d8cc1f/analysis/1372086748/

Sent to avast and reported to MBAM.

DavidR · June 24, 2013, 4:15pm

There should be no distribution of samples via this forum, it is a support forum and not a quasi malware distribution service.

system · June 24, 2013, 4:19pm

Oops! many apologizes david…I have removed that from my reply I was only saying that because if anyone else wants to circulate the samples to some other AV vendors but I will take a note of that.

system · July 8, 2013, 5:12pm

https://www.virustotal.com/de/file/55719cc99fcc00e38a00e67c1b34cc031f37dae73094b188627189559aca056f/analysis/

https://www.virustotal.com/de/file/a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb/analysis/

https://www.virustotal.com/de/file/78c3b546d51b60c014764681feba004bee69c2bec1531667117adf2a823fd4d2/analysis/

https://www.virustotal.com/de/file/bab2f1e61b9dacabd4cb0e51238af7418a23499626a4ed005db7bd818fc00cf1/analysis/

https://www.virustotal.com/de/file/60c722ed7e6f15ad5bf55ca4a8f9c83e127001021fef93651c71e0dda84f270c/analysis/

https://www.virustotal.com/de/file/4a23542d116fc351f8016e5f24146c0256ffea910393f80ffac71e90b9d2152b/analysis/

https://www.virustotal.com/de/file/3c26ac826b462b67f7eb81dde234e74acbd59335512a1de038f49c10c1fa0668/analysis/

https://www.virustotal.com/de/file/a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb/analysis/1373298617/

https://www.virustotal.com/de/file/1ab214bcb937d9baa981ccd9f9b13661c758ffe081b44b437db7aeb9fa7b3ca1/analysis/

system · July 8, 2013, 5:17pm

system · July 8, 2013, 5:29pm

https://www.virustotal.com/de/file/f0f903dcbd8df45681478cf11b8a5ae405b9705350dc3b94130eccdb12e46216/analysis/
https://www.virustotal.com/de/file/de19110db290c4bcb94d0d9302a6c44c976bde1389c75cecd245363627e16123/analysis/

system · July 10, 2013, 4:17pm

TheBeateMaker,Are you sending all samples to avast via virus@avast.com through e-mail,if not then posting links here will be of no use.

polonus · July 10, 2013, 5:50pm

See for various posted there is avast detection now, e.g.
https://www.virustotal.com/de/file/164864255d356996cd8111dd74b5b2733fa578a60081a433eb6ff8ee70315281/analysis/
https://www.virustotal.com/de/file/83eac1bc7aa643e82215911f7fc5bbae1e9c0bf290d02f1ba2783c264891d60a/analysis/

polonus

avastuser3796 · July 11, 2013, 12:34pm

https://www.virustotal.com/en/file/1a7f702a9b5a88d2f0e1047f4be6a37a52b8c3a95ab156db389e6a509c409277/analysis/1373544700/

PUP-File. deemed Safe by Essex

polonus · July 11, 2013, 12:54pm

IDS flagged it here: http://urlquery.net/report.php?id=3533128
loaded will be kernel32.dll (where IsDebuggerPresent is located)
The circumvention is for a particular code example !
mov eax,dword ptr fs:[18]
mov eax,dword ptr ds:[EAX+30]
mov byte ptr ds:[eax+2],0

This will patch the IsPresent flag, ensuring IsDebuggerPresent always returns 0
(credits go to kuba on reverse engineering)

Adware - two detect in latest scan: https://www.virustotal.com/en/file/411240f7d25a1a63a68b0874eb8d122c3b2c2e0bddb94eee55818b6a535b6915/analysis/ (installer detection → Global\Phoenix_Installer (failed) & RasPbFile (failed), this issue is a class of bug called a “Token Leak”…

polonus

avastuser3796 · July 18, 2013, 10:37am

https://www.virustotal.com/en/file/619531aa8bf0000586f23549475d523b36ac70a0f916ba17ddf9586137d532f4/analysis/1374143415/

Adware. It was “Supposed” to be a movie. I noticed the .exe part at the end. I figured it’d be malicous, thought I’d see what I could do to help. This seems like a good place.

system · July 18, 2013, 10:41am

send the file to virus@avast.com via mail,dont report it here it is not going to help avast in anyway

avastuser3796 · July 18, 2013, 11:07am

True Indian, I tried to do that. But gmail is being a * today and is saying it won’t allow me. Virus obviously. Any other way? I’ve tried compressing it, renaming the Extension from .exe to .part.

Any help is awesome.

Thanks
Michael

system · July 18, 2013, 11:11am

Hi Buddy,
You can simply archive your sample using 7-zip and password protect it.Password should be : infected

Be sure to mention the password in mail body and provide some additional info of the source of the sample eg: site address,IP,virustotal scan link etc

avastuser3796 · July 18, 2013, 11:16am

Will do. Thanks

polonus · July 18, 2013, 3:59pm

Hello true indian and alan1998,

Good you two reported here.
It is the installer that is involved and that installer (wrapper) should be detected as junkware laden.
See the Sophos analysis here: http://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/InstallRex/detailed-analysis.aspx

This is something we see happening more and more and it is really frustrating for those users,
that download a legit program and are troubled by nasty and very hard to uninstall crap- and junkware.
CNet downloads also come with this uninvited junk installer for their downloads.
Just google this combination: installmate adware and you get many interesting info, my good friends,

dware InstallMate
SHA256: ecf7e1de8ef7a049a1abb3fb36e8b47786b7d96aa5123a4e86e2a3a44bbe11b0
SHA1: b87fe0346097f3b49b7fb01b85ef0004162bfc5a
MD5: 5192e5dcdbfc466042f55386a03f89a3
File size: 305456 bytes
Created files:

%WinDir%\TEMP\Tsu6193197D.dll – Adware InstallMate
%WinDir%\TEMP{5CF5495C-FB77-790F-9BE4-B35587166BAA}\Setup.exe – Adware InstallMate
%WinDir%\TEMP{5CF5495C-FB77-790F-9BE4-B35587166BAA}_Setup.dll – Adware InstallMate
%WinDir%\TEMP{5CF5495C-FB77-790F-9BE4-B35587166BAA}_Setupx.dll – Adware InstallMate

polonus

Tonanet · July 26, 2013, 1:08am

Already submitted this file 2 times but it’s not detected yet:

https://www.virustotal.com/pt/file/931d08a2c2ea526ac631a2d03fd8fb916d724b7e0e74bd6e82ef53ad6bb4074a/analysis/1374800638/

Samples missed by avast (VirusTotal links only!)

Announcements