[Michael]

Our Honeypots caught this drive-by download from the following site:



Looks like another blog... the word 'porn' is used, well, abundantly.

The site is registered to some guy in Panama.



Other domains sharing nameserver:



They all point to this fake codec site:



The malware file, as with many fake codecs is from exe-xxx-file.com.

A quick Virus Total analysis reveals that this file is pretty much unknown to most AV vendors:



If you happen to be infected with that Trojan, it will not go un-noticed:







Those links are dangerous, stay away unless you know what you're doing.

Jerome Segura

Malware ID: 749ebc5c812c3d26022a4df847b11d09.zip