hxxp://hot-adulttube08.com
--> hxxp://hotcodecstars.com/soft/zafoffmkldg/5027d04bbb1/MediaTubeCodec_ver1.486.1.exe

hxxp://hot-porntube.com
--> hxxp://bigcodecadult2008.com/soft/zafoffmkldg/502d6723e70/MediaTubeCodec_ver1.1095.0.exe


av detection: 9/32 (28.12%)

AhnLab-V3 2008.4.12.0 2008.04.11 -
AntiVir 7.6.0.85 2008.04.11 -
Authentium 4.93.8 2008.04.11 -
Avast 4.8.1169.0 2008.04.11 -
AVG 7.5.0.516 2008.04.11 -
BitDefender 7.2 2008.04.12 -
CAT-QuickHeal 9.50 2008.04.12 (Suspicious) - DNAScan
ClamAV 0.92.1 2008.04.12 -
DrWeb 4.44.0.09170 2008.04.12 -
eSafe 7.0.15.0 2008.04.09 Suspicious File
eTrust-Vet 31.3.5692 2008.04.11 -
Ewido 4.0 2008.04.12 -
F-Prot 4.4.2.54 2008.04.11 -
F-Secure 6.70.13260.0 2008.04.11 -
FileAdvisor 1 2008.04.12 -
Fortinet 3.14.0.0 2008.04.12 W32/PolyZlob!tr.dldr
Ikarus T3.1.1.26 2008.04.12 Trojan.Win32.Tibs.G
Kaspersky 7.0.0.125 2008.04.12 Trojan-Downloader.Win32.Zlob.kzt
McAfee 5272 2008.04.11 -
Microsoft 1.3408 2008.04.12 Trojan:Win32/Tibs.gen!G
NOD32v2 3020 2008.04.11 -
Norman 5.80.02 2008.04.11 -
Panda 9.0.0.4 2008.04.11 -
Prevx1 V2 2008.04.12 Generic.Dropper.xCodec
Rising 20.39.50.00 2008.04.12 -
Sophos 4.28.0 2008.04.12 Mal/EncPk-DA
Sunbelt 3.0.1041.0 2008.04.12 -
Symantec 10 2008.04.12 -
TheHacker 6.2.92.275 2008.04.12 -
VBA32 3.12.6.4 2008.04.06 suspected of MalwareScope.Worm.Nuwar-Glowa.1 (paranoid heuristics)
VirusBuster 4.3.26:9 2008.04.11 -
Webwasher-Gateway 6.6.2 2008.04.11 -

weitere Informationen
File size: 104960 bytes
MD5...: df35e5395f4f2fcffaf692a76c0dd2a4
SHA1..: 2c8705e6346c1b35ea56c8cc6bb68d4366e28969
SHA256: ce4ef7f26ad509dd61a50be2b6c7d4adb8dce4d229df2fd7cbc28de6b9894417
SHA512: 94c7774517d11c849fdd04c90552b721b6cabe4a45bc73dad009bee1509e72e9
72914f8b83415951d719c7626c9efa3e590a2058db9fc786ebb6e99be43237f3
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4010ef
timedatestamp.....: 0x47ff6392 (Fri Apr 11 13:11:46 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x184c3 0x12200 8.00 0f8d0955c798fb78c21034ca6e652719
.rdata 0x1a000 0x658c 0x3800 7.99 91c299785e57631e134ef92b4ee81944
.data 0x21000 0x4000 0x3000 6.37 55c4a81cf2eac4f88ab8413d7f8eaa39

( 2 imports )
> kernel32.dll: SetEvent, SetFilePointer, SetStdHandle
> user32.dll: EnumPropsW, FillRect, GetClassLongW, EndDialog

( 0 exports )

I've added the file to the malware listserv.

/t219469-MD5_df35e5395f4f2fcffaf692a76c0dd2a4.html