goorpg.info/75.75.254.144 hosting malicious pdf

[crunchtime]

An infected machine I worked on seems to have been infected by a PDF from goorpg.info. Could not reinfect with this but the timestamps line up on the payload. I thought I would post this because I found zero info on google.
PDF --> hxxp://goorpg.info/page/index.html/s002102317801r0409J07000601R68ae8cfaX164f9e76Y5dd51035Z03001f30

Interesting domains on the same IP that are also hosting malicious pdf:
goorpa.info    A    75.75.254.144
goorewa.info    A    75.75.254.144
goorpg.info    A    75.75.254.144
goorpt.info    A    75.75.254.144

[SysAdMini]

It is a Neosploit kit. Neosploit is typically used for Mebroot distribution.
In the last months we have also seen other payloads like Zeus and fake av.

[CkreM]

payload(fake AV):

Code: [Select]

goorpg.info/page/index.html/n002102317801r0409J07000601R68ae8cfaX164f9e76Y5dd51035Z03001320