Retrospective Malware: SWF.Exploit.Kit.tht.Talos

awaggoner — Sun, 10 Mar 2019 13:31:36 GMT

This morning I received a relatively large number of detections for SWF.Exploit.Kit.tht.Talos . They show as coming from multiple IP addresses within the last several days, with the first one on 12/9.

The file name is listed as adsapi.swf

The Hash shows up as malware on 2 engines on virustotal: https://www.virustotal.com/en/file/59ceffed73c5bb616d78416096c207d4334c91d5c718e82c355766ca9af8aa87/analysis/

Sha256: 59ceffed73c5bb616d78416096c207d4334c91d5c718e82c355766ca9af8aa87

I have used Dig on multiple public IP addresses that show as the source and they all come back as having a PTR to hosts in the 1e100.net domain. That shows up as belonging to Google, and is claimed to be used to identify servers on their network.

Is this retrospective malware detection a false positive, or were a large number of hosts downloading malware over the last week?

Thank You, Alan

False alarm. All addresses

awaggoner — Thu, 17 Dec 2015 15:11:06 GMT

False alarm. All addresses are showing clean now.

<*- Network Based Retrospective at Thu Dec 17 15:08:20 2015 UTC -*>

Sha256: 59ceffed73c5bb616d78416096c207d4334c91d5c718e82c355766ca9af8aa87

Disposition: Clean

Threat name: N/A

topic Retrospective Malware: SWF.Exploit.Kit.tht.Talos in Network Security

Retrospective Malware: SWF.Exploit.Kit.tht.Talos

False alarm. All addresses