gobolook / hotoffer dropper

[Willem Koenings <infsec () gmail com>]

hi,

there's already some coverage in the web about this scam. 

http://www.webhelper4u.com/CWS/CWSdropper_exe_msgs.html

today i found one new dropper, if someone wish to play with it / analyze,
here it is:

hxxp://www.globolook.com/v179/dropper.exe
hxxp://www.globolook.com/v179/dropper.chm
hxxp://www.globolook.com/v179/xxx.html

W.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/