[Community-sigs] HTML.Iframe

[Angel Villegas]

Arnaud,

Thank you for the signature. However, there are valid use cases and benign
HTML with iframes this signature will alert on.

Thanks,
Angel M. Villegas

On Sat, May 23, 2015 at 3:34 AM, Arnaud Jacques / SecuriteInfo.com <
webmaster at securiteinfo.com> wrote:

> Hello sigmakers,
>
>
> HTML.Iframe:3:*:3c696672616d65207372633d22{-50}22206865696768743d2230222077696474683d223022207363726f6c6c696e673d226e6f223e3c2f696672616d653e
>
>
> Virustotal of a sample detected by the signature :
>
> https://www.virustotal.com/fr/file/20cc6613e3ee794155ff9703bf645ced0db7e8e9208818d256de971308dd27d6/analysis/
>
> Number of samples detected by the signature : 1457
>
> MD5 of detected samples :
> 0e3bfebc8e603c7e9ab933b539f85794
> f8329935c94f5819c40ca4fd25937c54
> 8b00fca226110e685c3155f9535e4279
> 313176a2c7536d8e6912a09ae0670517
> 19d952b2283c9d75f39ceeebc944a374
> fcfbcfe7b05b5d3643c27393c16b45f7
> 998b4745488fe8bbc84d67989eda17d3
> 95aedb6f5941cf072558941f0d52cad1
> e57cb27b778e473816b9fc81b4bf491e
> 207669c701f74400e3886981b87d8d86
> c1638ba9e413aa961bdb1566ac5fe912
> 3f85df08335e2cf9afdcf198aa83197f
> cb8c624024ace7bd324071a05bdcfbc6
> 8351337a57e4791276bf51a116faeb7a
> ff9430c907a1ee57fe743358ed51cd11
> 5b08eb4cc16fac2698f903185cdf3535
> 8283c2f6f0e8dd76c6d293107c86ddd9
> b7ded8afe125cd30662c0ea2bfddbb6c
> c7cc6f9a003916a2f8c0bd47ff53a35c
> a98bc746d066fbff83ff612c04db7c8b
> a3394ce7054062ab2f46c87b5fe3944c
> c2047332d227b65785cb6d5cad7d9d72
> 1b46fd5cd8cb06bb0dafd5a90d74e09a
> bfb93886be47606df046d2931d8850ba
> ab9dbdb9e3c37bb277ac2ac915451c71
> 78c645ae164a65aaa05bff3855b32c99
> 58f21a522c07beb8ab345bd5c9f7898e
> 1175f18c21b840c22cdd7eaefcd07aa2
> ab3150caf18d304cb67ea837a2c60d3a
> 7acc5937ef48941177b40347d5f4853d
> 929a635caf43d376d2017a8bb0cc8936
> 203f4de3f674ef09c398fb87252c6581
> 45562d9b9cc4fa0c1c35ae024651c194
> 430c2f505c9c78336bb2a265a2eae9e2
> d3b0a8383c23b6cc902ba853697cf258
> d09720a0dd9cd91a6fd6e89f61cdb6bc
> 8a4938352f990b3502623bb9e1d79a05
> 420ea2bb1fc4c94b52ebb83e2230151c
> 93586942ce20af46d4c06c4f4e3102f5
> cf191697fda92eac61b8dd440dbdecc8
> a085db57808d5a6e18b4a6aa13bc806c
> db17023203e83ce7424be1cc9d74397d
> 43fc8f53b05b9e171fa8265f6c5891e3
> 393d3c94e69c399f5ad2289e154c8fa2
> f91f1a365898dc1128451dbeb7018bc4
> 1551bf47b14f95593602cfbd762f99f1
> 35454abacafcc7cb1890f3fdabb30c05
> b9af49d367b9e0144b8ea08ca842c6b5
> d8f014cf4d248ff0f9e6ee52c2705f5d
> cfd62eced88a2490c9f048073716dbc6
> c0d7b6bc79850bc739f4bfbdb9ff7921
> e4cd60d9499550be3e2fda57ce4b408a
> b020f0c81134a5c066287bb56433dcf1
> 6dc1680cc7df29d57e7e0382ad2c66da
> 946dceaa076f2979ece7220dc77a3f8d
> 2debc66b8a5d2fe08ae01bb33bd1b4d4
> 81cdb54614947e5b09992eee7d6e4d15
> 904c472c050ec88b86103e1b9a800731
> 960d397ca990989cfc2168bdac183189
> e19c20b395c557472ce8f0123fddc476
> a22989b224cb91e0dee031665aa652d0
> 0fc589cb4b58b3baf1fc8f58204e3af0
> efe6e3e5641eef54ea48d53e39f80738
> a585fef74a5d70447d0110bfcc8c6c89
> 9327c02e05898da68e5ab89b1bbef4a1
> 5f744c41889954e08fabb6a3120b4d29
> 33cfcfbec88c18c8a8da7b356cb1058e
> bc32b60742315a003262b1417c127518
> c3bd7ccad320b974a9ae8c6e175922b9
> 2c7bf91e19f4b8329cdf6005484b9ee1
> bf83eedd18503797911632f929499d26
> f68eb607929e4c201b1602026e31aa8e
> 543107d64053fa34b99cd7ec283d1df7
> 3d75b8348278bf2c45b02ad5528167fc
> 1b697ce8902822904a58dbca73619683
> 09e38a2c9d59e6d3dfd2b4cba55c3980
> 335f6bf607dcbd711deba299de3cb338
> 2a50c80572e37af93cbb9742a394e615
> 73d02192778bc1ceb024ad383daa822d
> 54791e0553eeaf7f090ab215ec2884a0
> eaa3d3658c406e395eeb8eac3036eab2
> 9bc92b4ee2d2e1e3093901d89b579402
> 026f5402700fc4670f4e9ad22901501b
> bab907e51e71b0fbf00a64f909510d41
> 39b14dc7488aeb7ebc5f37dab9a964d0
> ecb48e828969f3a8a225d53ac2d18980
> 93418f37cdc7609d90d2a2689e897b14
> 09e27ca24bb5074954b7c01c6538646d
> 0ff7928492fee07ce2732116591ffbf9
> 0fb426ed35d88c7de1c2f1f4b6fe37ae
> 3ceeb1905cf7e0359f9e206ea7a9c423
> ef84d424c9bc4f4c6291d9ca726cdb42
> 04e93f4d1d4004d9fbefc7a53ecb87fd
> 5e5634c29e436f8b8422ffe9a0d54577
> 0f68f9368c0bb8d066ea3a20da463d95
> 1c34ae025bb0cf04fb32fb42a2af0429
> bd49e3ad126e8b67a5d58afa383fb910
> fabf47891529bbea5aba264e95f2dfe6
> 83bf33b2dd873fd6fee02e7c6f9265b7
> 542190bf1b61a566eb5c369fdfddd149
> 432c6b097333e1e11ed5a6fd8185fe74
> 010218f6e8b0048185452b98649fac87
> 49489e078b024b83db062d3cec5fef2d
> a362a0f8393d56aaeddbdc99f110e724
> 5d208cc41aab07cda7c13be9e7883fd1
> dbbf5f5a40b49173f76c060c28c3f20f
> 81d8344f79b924965c838a11337736e7
> 30cdf8c8b5a0ff386fee6346183ea068
> 61113990e25d275962d2466d64ac04aa
> 1c69a7ca0012db6288e65e8e65df6fcc
> e6029c21dde6e451226da9c52e50c1d7
> 706974246aeef39c1d0cb9d61b88c9ea
> 31be66483cad3e1fcfe1cab2aa89f7b5
> 373c46b110a9c81c126d04e3d95e3733
> 3a6f747e462912ce9f62cae2e4f24947
> b6f1960511c22b7df5acb51ca44cba16
> 25859af0a9f0c6b4a48a820a3bf96102
> c8df8ea004ff1071b64bdf559cfe3ed5
> f9985a7f40e98e42e64380f44ef687fa
> 17d782613ab1cb58339e9a6d8f53eaa8
> 9ac455bcec66e5ebb743a8656ced97f8
> fa093d7b6d15ccf6fde8ce7de73cb0fb
> 578a9edbc8efaefb7392f5a1067bb652
> aaa1f8acaad1f0f4c06297f6580379ae
> 6a2bb4dc8331df75d081e296ddca99dd
> ba5908f9f534719e33f6f191d0cf999c
> 67a6ef207bc548545f7312a3f637284c
> 3c54b0812d9cbf768150448eca84ca54
> 4d01d7d0d1ea955c9094751fc9322b66
> fe0b36cec568c47cdc6ef6ad4b72d3cd
> fdd00c0c879b6e7ba2fb2297a89f3230
> ce23c74561707339214bfe8db33c87b6
> 803f15e4a00f49e59faaa82377397425
> 5d9c91fa970f8620eb36e5a93e3d33c8
> 86156d7b6d401ded269d38b6be9638ff
> ca262756bd67ea1e72528db0974f0f23
> 773cb09871e89088f3a636aacbc3cb63
> 2793f648b3a42b4811d933433e090c9c
> 247f8bbcc07f954a867c1de2f55db5b5
> db7b21ed4ed8a4fbfbf3c3e119cfb410
> 8c03fbffb202a646687e899392cee077
> 2c63a1d1e8460fdacacd75572295ca03
> 296c798ff05199483e5a2c2d3e7d719d
> 72c42f75498e9d5f27d9a6f81d21f037
> 9a72637b578a0187c702ae046e36df6a
> 8d73d520fe6d7360e63dbc6531b60239
> 25891dd2b574f58d8d1c14b61d4f82ae
> 118039e56fdd121f00093814137f1a2c
> 3c6d8e467d9c917db8e50cd217de5678
> 5b4be7c23b207f0eb31a6fac09f78bcc
> 69fc1af9853bab4e239dcdf37407eae2
> 7f4738a132a3398f14389aa1e97600c3
> 5e5b58a652fe5a8bdc45aaf27af47389
> 2c98d73a1bf2c921dc6b9bdaa7c94593
> 44ca0abdac068cc612e37c8cc1386106
> 8302a8b4cccea805201f45d8df5d7a19
> 56132affb7e67ce6eedfcfc590a74eca
> 83d357eac6dfef7189775185259d0b73
> 593ac875ec8b30fb51883c34ec2bcb0a
> 502ac5ad2ed288f7ff15eb2ff7da8d09
> 726618c9e4b5a38733a18939b1426107
> 04326494fbe812385910f53f78874e48
> f2fc0c21b98346e09adf75e7fd6b2b7f
> 3e6cc539fe9ec0fd11435adf0cddaafc
> 041d1e6f0eb1fb7c40320e58d9b0a3e6
> a42a0d907b181dd14f85a3d3cd2a878a
> ca53a1410b4766b7f1c55b675df48dd0
> bef40fc8e6fec2ce195ab2178c026108
> efa7e7b795369efe7d62f358634ee3c5
> 9c17a17261fbdd2fed0a19dd6d9cb56d
> b71cd0c4a1d829370c6fdc636e905b03
> dd0a21a7f01f2009f75b5a10238e02ec
> e6c764e51df1fdf43a78c408a882026f
> d2a5f30d0a3fb989700661b23a70fed5
> 6d4360650e7e186cc9a7c9def91ae629
> f582ec73b7cad8fb648d408a70a4c3d2
> 441c711f80ed080d5c3cc3ff21958bb1
> 644e37a5468cce8fecb439a9a5d9711d
> fa305352d6aa4176b49425bdb55978b5
> 321053f087eddb4be037baa5fe55319c
> 8ee8e6d210aec61bc2c63ea20abccf7f
> 44a4f951d12c57901bcc29e53ff69f35
> cc1f57057bb0eeebc416ad6f898a48c1
> 451370bb09d04fe4df74a7c2c32bf0cb
> 0f9d80482064d638a2d1176b311eea39
> 7648bdd2c298f41945116590b04168e5
> 282f4c0adb5bba0cb719bc74326bdd14
> 79b765c4852bd3aa9bfb6fcf6aebb2ce
> 7e999fed1b6d9f78dcf0a9328e5ba124
> 36deca2bbf28610de519562b1e131c23
> 6e54ba1ab3884b3c818c0d7494a3a9e4
> 7c3bb88eecce9b0afd1c403e268b9687
> e00161fcdf3dd3cc85f794985022abd8
> ec2900da8dd524b6118f02ffb1a63a50
> 1414480710e8a63156748721cc88ef17
> 37d7238a10e5996822d62b4f6aed8789
> b61ac1f7bf0efea8bcdcc24a099fe1be
> f68630b8498790d5130bccc561ce20f8
> a49c13d7a9c77bdd03e39a9e2f880e23
> 2fd7a212e1a3f1935c5a571d8332a03e
> 03e1cbc6a369a374d5c649ed04c34680
> 6ac63252e733c9bb20c60aa25dbe2286
> 1aa0b677a49cc1df12bfbb4ff62d96c2
> 0aa45ca052205512c26263c8f9297dab
> 422b627a565b8acc88fb06e39d59f5fa
> ac2992ca8359415aafad7ba02f5516b0
> 24d72d11a2347fc0cc689964513099be
> 4437e0a55c46aa3946214a0f643e9b27
> 2033df6eeb82557d94c088eae15bf74a
> aa9b7485809a6c74c46089139ca8d333
> 08a98fa040d374a418576173510046d9
> 9f6d1f274dea2e8b362f2b8ccd7d81fb
> 4d19ee9ffd5bd6391490bc93198f5107
> e731cf228a093fe6875155024cdbce2e
> bfbfc8818429ede8302336e3b2a2b562
> 79b727913449f953e8e11533c879cbfd
> 70e63bc6f21e83e41d7da3713b627d44
> ef9779962aa9d14296d0227ece333c33
> b0267d3f18296ba0215ab387950ca703
> 802cebc61973422ecb009b2be82d901a
> fdc5f8251f617151ce3da9303882f5ea
> ade8460c9cfaae8368b8bbac42cd100b
> f3ea843517e6f5bbdd04daebb7485693
> 05e4b165aac34c1f6cf4003701c57bd0
> 16aa91c4caaef0f3bf86c5f7878891bc
> de1c8464d66d58eb650c55166c6dc724
> fd199d5bf92aaac97a49372c093943a6
> 5587ce9c3b0f4d2b75262eca6591150e
> b053f316aef858dea369e2cf77348c5d
> 4b92ea458bc5dcb4a16b33698ff7117c
> 556078a37f25135b7b73e4a0edb1522a
> 445d63e4d2e3bf09a3f8d10efef40910
> b905797e336a7573cc0cf056540494a0
> e475645a59ff5940734229e5595e3cc2
> dd193bc38c9a00ff62ad2e370842f5b9
> 9d2a60ed48d072d1dbfb1c216e924445
> 30d453b70c5cc41a166c8323184bfb3d
> 83d4c42df0384e19989dba7f7a30bd8e
> 3804c4ca69066e89ecfd7c4b9736e3a3
> 19f6c5acdb4a7ed5977a9da622a0cce8
> 0e40898f1c3601631a1b906a9183ea16
> 62159d8beee2c6d47b42c212eb030f68
> 333b9282dcb77fc7cd7399c2b5f0d21c
> 6da6eeb46c33a64a20afc23c9d92294b
> 7afe6a6eb64b1158d09b8e8d9dd47b29
> 0d5317349fc15ae4b863bf7ef1dfbb3b
> 4ffeb36fae4600e68daadf58c4b279bb
> ecdefef2020175514dcbff943e5b215e
> 50964533f85fc56d47d4a3bfae4bfcea
> 5e78914d3103ac996c3311fa392086fb
> 833fa5bf0ec60f534006e17a75b1f5e5
> e0c96b55647bbfc449a3bdef0970ddbc
> 2072895b03a017bbd6e455e4804d2df3
> 79e540bdeebf73ffe4da9c2104f01e0e
> 8b637fd5c6d84493f2cd302180aae333
> b5b15dac21b4a4ded00ffc7fe841d87f
> c4f3240c1198513bf2c0c2d8ed16a4ab
> 41a3cb22e8fc881b161fe5a946f68dbb
> ccc40799517ae5ca2c490fc5bd3cb26f
> 2fc737e1a5ae7c6bf5a9a8a01980d155
> 1e219ad4ef783c2b81728ff5c533b79f
> 33e093b7504d460191aaaa4f924de3ba
> 8afbe7adaa54b7cbaac8566817f4f067
>
> --
> Best regards,
>
> Arnaud Jacques
> SecuriteInfo.com
>
> Facebook : https://www.facebook.com/pages/SecuriteInfocom/132872523492286
> Twitter : https://twitter.com/SecuriteInfoCom
> _______________________________________________
> Community-sigs mailing list
> Community-sigs at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs
>
> http://www.clamav.net/contact.html#ml
>