New malware spreading over Live Mail

Here is a screenshot of the message spreading:

The real URL is being displayed in the status bar.

I personaly used DynDNS some time ago... anyway.

This malware did trigger an alert from:

- Kaspersky

- IE 9 Smart screen filter

But the thing is, Kaspersky was talking about an EXE packer/wrapper. That drew my attention.

So, here we are, let's have a look at the file:

So, yeah, the file is being protected by PKLite32 v1.1!

That's what KAV was saying, allright. But, to me, it is not because a file is being protected or obfuscated by a specific technology, that this file is a malware for sure...

More details to come, I'm investigating that in deep...

BTW, here are the full VT's results

(see https://www.virustotal.com/file-scan/report.html?id=48a93a6d8384c58d07285826a00ff3e8c553676903e59e1273316b32c4dc9af3-1311421202# ):

As we can see, generic/heuristic/genotype signature technologies tend to prove their efficiency.

ThreatExpert does confirm Kaspersky detects PkLite32 compression: http://www.threatexpert.com/report.aspx?md5=bcd76d2daa826d9737e2d63025ed03fc

More to come...