In the past month or so, I have observed some strange Shockwave files
that surprisingly, contain 2 other files attached inside the end of the
file. First, an EICAR test file is found at the end of the Shockwave
file portion which is immediately followed by a Window executable. Most
IDS would trigger on that window binary transfer, including Snort. The
shockwave file portion did not contain any malware.
The EICAR test file found X5O!P%@AP[4PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* is a typical ANTIVIRUS test file. [1]
However, after carving the Windows binary and submitting its MD5 for
analysis to VirusTotal, it returned some surprising results. The MD5 of
this file is 22a0c9e8f8c83f70caf04d757732eb21 and shows if this file manages to run, it could compromise to the client.
Have you seen anything like this? Let us know via our contact form.
[1] http://www.eicar.org/anti_virus_test_file.htm
-----------
Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu