[Michael]

It's late at the office, but I'm still here finding some bad stuff. The wife is out for dinner with a friend, and I get bored at home.

Anyway, our HoneyPots just picked up this drive-by from homemortgagenetwork.com

This is what the site looked like before it was owned:



This is what it looks like now:



Yes, a lot of blank space too!

But the interesting part can be found in its source code (click to enlarge):



It pushes a PDF exploit and the final download comes from:

mefa.ws/1/cjms1.exe

The file is, shall we say, poorly detected right now:



Warning, these links are live and may infect your PC!

Jerome Segura

Malware ID: 048346308777edf94dd4788dac20be54.zip