As you can see, the file (a 5kb MS-DOS application) is downloaded to the Temp files. The interesting aspect about this file is its strange behavior.

In fact, it doesn't seem to do much of anything, which simply makes me all the more suspicious. Closer examination of the file reveals some interesting findings. Usually inside the code of a malicious application reveals all kinds of things - additional download links, clues with regards what the file does, passwords, the name of the creator...you name it, we've found it on our travels. However, this is the first time I've looked inside a file like this and found what appears to be the HTML for a webpage telling you "this account has been suspended". Even stranger, there's a number of links to various webhosting companies (but not specific download links, as you would expect), an advert link and a reference to Elitemediagroup.

As a parting thought, it's worth noting that if you go to websites such as Zone H to view the latest archived webpage defacements, they do indeed include the above hacks by SnIpEr_SA. However, they also include the infection file, which raises the interesting question of how many people over the last however many years have been infected by viewing archived defacements.

Suddenly, checking out all those cool hacks doesn't seem quite as appealing...

Research Summary Write-Up: Chris Boyd, Director of Malware Research
Technical Research and Discovery: Chris Mannon, FSL Senior Threat Researcher