Netformfillerfree.exe / Possible Fp

Malekal_morte

Hi,

Source : http://forum.malekal.com/viewtopic.php?f=3&t=11550

Possible FP.

File attached, passwd = infected

VT Scan :

Fichier inetformfillerfree.exe reçu le 2008.05.27 19:08:59 (CET)

Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE

Résultat: 2/32 (6.25%)

Antivirus Version Dernière mise à jour Résultat

AhnLab-V3 2008.5.28.0 2008.05.27 -

AntiVir 7.8.0.19 2008.05.27 -

Authentium 5.1.0.4 2008.05.26 -

Avast 4.8.1195.0 2008.05.27 -

AVG 7.5.0.516 2008.05.27 -

BitDefender 7.2 2008.05.27 Backdoor.Bot.15009

CAT-QuickHeal 9.50 2008.05.26 -

ClamAV 0.92.1 2008.05.27 -

DrWeb 4.44.0.09170 2008.05.27 -

eSafe 7.0.15.0 2008.05.27 -

eTrust-Vet 31.4.5826 2008.05.27 -

Ewido 4.0 2008.05.27 -

F-Prot 4.4.4.56 2008.05.26 -

F-Secure 6.70.13260.0 2008.05.27 -

Fortinet 3.14.0.0 2008.05.27 -

GData 2.0.7306.1023 2008.05.27 -

Ikarus T3.1.1.26.0 2008.05.27 -

Kaspersky 7.0.0.125 2008.05.27 -

McAfee 5304 2008.05.27 -

Microsoft None 2008.05.27 -

NOD32v2 3135 2008.05.27 -

Norman 5.80.02 2008.05.27 -

Panda 9.0.0.4 2008.05.27 -

Prevx1 V2 2008.05.27 -

Rising 20.46.12.00 2008.05.27 -

Sophos 4.29.0 2008.05.27 Mal/Packer

Sunbelt 3.0.1123.1 2008.05.17 -

Symantec 10 2008.05.27 -

TheHacker 6.2.92.320 2008.05.26 -

VBA32 3.12.6.6 2008.05.27 -

VirusBuster 4.3.26:9 2008.05.27 -

Webwasher-Gateway 6.6.2 2008.05.27 -

Information additionnelle

File size: 436507 bytes

MD5...: 051dff8290752a520844511467db7d48

SHA1..: ebfa5cb010c17236198ccbd34e4eca06483e9c62

SHA256: 578e21382f327b53494fc04392e657b477c5fc39664dea5b35dd6c60f84c41d1

SHA512: 1fd597a5590408bafa93308a9dbc8e4c50432c87ab6cdafa350077bde7c272ac

2ad11a07f83490e6bad2bd6c142dd95cbf34e017cccf5698c69717a3097e8300

PEiD..: -

PEInfo: PE Structure information

AndreiASM

Please attach the file on a new post, in an archive protected with the password infected. If it`s a fp indeed, detection will be removed.

Malekal_morte

Please attach the file on a new post, in an archive protected with the password infected. If it`s a fp indeed, detection will be removed.

/applications/core/interface/file/attachment.php?id=2085" data-fileid="2085" rel="">inetformfillerfree.exe.zip

rootkit

Thank you for the sample !

The guys from the Lab will take a look

Malekal_morte

Thank!