Wepawet issues

[MysteryFCM]

Good to hear, cheers

[SysAdMini]

Code: [Select]

210.51.187.45/lib/whichDont.pdf
210.51.166.239/lib/someS.pdf
Wepawet fails to decode it. It contains multiple javascript sections and has an interesting obfuscation technique.

[SysAdMini]

PDF decoding fails.

http://wepawet.cs.ucsb.edu/view.php?hash=59f5b3f049e01cad2137a899da355625&t=1250603399&type=js

[mercutio]

Mmmh, I had missed these posts, sorry.

On the good side, I have rolled out a better domain summary page. For a given domain, it now reports:
- the IP/ASN it was found on (and links to the FIRE report for the given ASN)
- other domains found on the same IPs
- registration information (registrar, registrant, creation date) [for registrars that are supported]
- a list of the malicious and suspicious URLs detected on the domain
- a list of the exploits detected
- the latest URLs that were analyzed
- other domains that are reachable by visiting pages on the given domain
I find that this page generally gives a good overview of what is going on with a certain domain/server.

See for example the summary for findhereandnow.com, a well-known koobface domain:
http://wepawet.cs.ucsb.edu/domain.php?hash=e5f1e528c0b5656e62af4a049ecc9d6a&type=js

To reach a domain summary page, just click on the link "See the report for domain ..."  at the beginning of an analysis report.

Of course comments and suggestions are welcome!

[SysAdMini]

Wepawet is unable to decode some YES exploit kits.

examples:
http://wepawet.cs.ucsb.edu/view.php?hash=e8a0395e61f8f18ac10a5ae46b5884c8&t=1255454757&type=js
http://wepawet.cs.ucsb.edu/view.php?hash=37c330fe7b6b3f5b58820c8376f8b2d6&t=1255451348&type=js

[SysAdMini]

fails decoding Liberty exploit kit

http://wepawet.cs.ucsb.edu/view.php?hash=b4c57b7cdeabcf7681660af8410bd6f4&t=1256321923&type=js

[SysAdMini]

fails decoding Eleonore exploit pack

http://wepawet.iseclab.org/view.php?hash=10761052023e28a57530712aa23288c7&t=1256237119&type=js

[Mr Clean]

Check this out,

wepawet reports that this is benign text/html as output.  The malicious server sent a content-type of text/html but the payload was really application/x-msdos-program, wepawet assumed the content was text and went no further

http://wepawet.iseclab.org/view.php?hash=a0db8a069663259f5e60b42a78668278&t=1256571703&type=js

Code: [Select]

GET /default.aspx?a6HIAYORwQ2Co-NWhqfRDIaWlQWBx8YF1ceUBdeSxg2BkJIHh5KXVoOXkFOCwMcysNCDBYek0VGExMYGhp-FVoaSwQSFwpQN15-CB4SWwQOHwJdT0sCXPbGXwgyNkPIzhpbBBYKV9zeFn-g82s2HQYSWwQWGovsEhpPHAIKfxQCE HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0) WinNT 5.1
Host: 82.98.231.98
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Mon, 26 Oct 2009 15:04:15 GMT
Content-Type: text/html
Content-Length: 166400
Last-Modified: Mon, 26 Oct 2009 14:53:03 GMT
Connection: close
Accept-Ranges: byte

MZ......................@...............................................!..L.!This program cannot be run in DOS mode.
$.......................................................................Rich............PE..L......J...........!...
.r...........n......................................H


http://www.virustotal.com/analisis/159651a11584976aab194b7162bf01baccf2585cea4dd6511b145800b4c38ea2-1256572210  5/41

[SysAdMini]

YES exploit kit, fails decoding

Code: [Select]

maghdfun.cc/

[cleanmx]

wepawet is back online again

--gerhard