[Community-sigs] new sig Win.SWF.Obfuscator (Exploit.Angzia - used by Angler EK)

Ben Baker bbaker at sourcefire.com
Thu Jan 22 12:13:46 EST 2015


Roger that. Both SWF signatures have been taken care of now.

On Thu, Jan 22, 2015 at 11:55 AM, <andreisaygo at live.ie> wrote:

> Thanks, please send the other one as well as it's a bit more generic :)
> > Date: Thu, 22 Jan 2015 11:51:26 -0500
> > From: bbaker at sourcefire.com
> > To: community-sigs at lists.clamav.net
> > Subject: Re: [Community-sigs] new sig Win.SWF.Obfuscator (Exploit.Angzia
> - used by Angler EK)
> >
> > Thanks Andrei!
> > I've queued up this signature for FP check. It should be published
> shortly
> > after it clears testing.
> >
> > On Thu, Jan 22, 2015 at 10:35 AM, <andreisaygo at live.ie> wrote:
> >
> > > Signature:
> > >
> > >
> Win.SWF.Obfuscator:0:0:465753*6C656E677468*666C6173682E7574696C732E427974654172726179??6C6F28{-50}706F736974696F6E??777269746542797465??77726974655F42797465??5B302D395D2B??4D756C7469{-30}69736F2D383835392D31{-70}7265706C616365??4576656E74??4C6F61646572??537472696E67*4D6F766965436C6970??52756E
> > >
> > > Hashes:
> > > MD5: a956021a2a8b6351e94f11e4b799c97e
> > > SHA1: 392ed7aaedbc0d682692cb9c40eb12363eb8b111
> > > SHA256:
> f5458eb4b0d7c18519bbf5fd92437485bff31f9abc6870beb4e8dc327cd24192
> > >
> > > Regards,
> > > Andrei Saygo
> > >
> > > _______________________________________________
> > > Community-sigs mailing list
> > > Community-sigs at lists.clamav.net
> > > http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs
> > >
> > > http://www.clamav.net/contact.html#ml
> > >
> > _______________________________________________
> > Community-sigs mailing list
> > Community-sigs at lists.clamav.net
> > http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs
> >
> > http://www.clamav.net/contact.html#ml
>
> _______________________________________________
> Community-sigs mailing list
> Community-sigs at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs
>
> http://www.clamav.net/contact.html#ml
>



More information about the Community-sigs mailing list