Malware via Adbrite

[Irongeek]

An interstitial ad running on my site for IOSCO (oicu-IOSCO.com) seems to be causing the web browser to ask to download a file from lawcons.info called c.wmf that contains malware. I fear this is trying to use the previously know Windows WMF vulnerabilities. I've contacted Adbrite to get the ad campaign paused. Just wanted to let you know that this malware is not from my site. My guess is someone defaced the "International Organization of Securities Commissions" website and inserted the malware.

[westin]

Just wanted to let you know that this malware is not from my site. My guess is someone defaced the "International Organization of Securities Commissions" website and inserted the malware.

A likely excuse

[ric-o]

Yep, that's a nasty critter: shows up as WMF exploit trojan downloader from most of the AV vendors on VirustTotal.com.

I downloaded and ran it on a test PC and didnt do anything other than bring up empty picture in Picture Viewer. Packet sniffing shows no traffic. Hrm...what the heck is it supposed to do?!?

[thehorse13]

When it's active, it's supposed to serv up advertisements that will lead you to more sinister malware sites. It will DL content then pitch it at you right between the eyes. If you follow some of them, you'll find yourself part of a botnet faster than you can say, ho, ho ho!

I've played with several variants of this nasty, all did about the same thing. The differences between them was the download locations for the dropper.

By the sound of it, someone nuked the DL servers where the content was being served. Also, many times these things are abandoned by criminals once they are deemed ineffective and you may be seeing the remnants.

--TH13

Note to self. Iron Geek == Malware King.