Why malware does not download?

Viruses and worms
1

Trying to go here: http://zulu.zscaler.com/submission/show/e45a8afcd865c320d7c150df730c6bb2-1343157141
and http://urlquery.net/report.php?id=102002

I get 509 Bandwidth Limit Exceeded
Bandwidth Limit Exceeded
The server is temporarily unable to service your
request due to the site owner reaching his/her
bandwidth limit. Please try again later.
Apache Server at wXw.asempa.org Port 80 (address)
What should have been out there, can be grasped from this analysis:
see: http://www.threatexpert.com/report.aspx?md5=b9f2e264ea63ac13330e5f8479d544e9
Bitdefender TrafficLight gives the main site as unsafe, warning for site: http://sucuri.net/malware/web-site-disabled
IDS flag"ET CURRENT_EVENTS Possible Kelihos .eu CnC Domain Generation Algorithm (DGA) Lookup Detected on IP
Walker running for htxp://smeta-zhkh.ru/primery_smet/krovlya.exe → https://www.virustotal.com/file/bad7c6abe67db4c243b0114f91bb30dd73706dc55ce8d9596f1a71c396c212e6/analysis/
avast detects!

polonus

2

That could be a possibility on a hacked site on a limited hosting account, if there is a limited bandwidth then any hack could easily exceed that.

3

Hi Pondus,

Remember the IDS alert and stumbled upon another similar site with the same IDS alert: http://urlquery.net/report.php?id=169648
Here nothing is being detected: http://zulu.zscaler.com/submission/show/0826dd61e6eb9f49938239d6a8cb62f5-1347222121
First: The location line in the header above has redirected the request to: hxtp://www.finalta.eu/
then we get: the location line in the header above has redirected the request to: home/home.asp
undefined function document.observe
document write %3Cscript src=‘" + gaJsHost + "google-analytics dot com/ga.js’ type=‘text/javascript’%3E%3C/ sc​ript %3E" benign
this code being used in tracking buyers that use Google Wallet Orders…

polonus