Best Blackhat Forum

Here's the virustotal for the first mediafire link. It shows one detection - ClamAV PUA.Script.Obfus. I ran it twice because some of the AntiVirus companies are not responding. Here is the latest:

Here's the virustotal for the second mediafire link under "Download app" - it shows clean:

Anyway direct links for videos.

Video 1 - Create App

Magic Button :

Code:

http://ultimateviralgaming.com/wp-content/uploads/createapp/

Video 2 - Setting up App

Magic Button :

Code:

http://ultimateviralgaming.com/wp-content/uploads/appmain/

Video 3 - Ads

Magic Button :

Code:

http://ultimateviralgaming.com/wp-content/uploads/ad/

Video 4 - Styling

Magic Button :

Code:

http://ultimateviralgaming.com/wp-content/uploads/style/

Video 5 - Flash Site install

Magic Button :

Code:

http://ultimateviralgaming.com/wp-content/uploads/flashsite/

Have a look around the uploads folder there are a couple of other things in there!

Thank you so much for the great share

Ok, I've looked into the ClamAV report above.

That was thrown as there was some obfuscated php code - I've decoded it and left it as plain php, Clam AV is now happy with that.

But upon scanning the new archive, ClamAV threw out a script packed warning, this is due to the way the javascript is written in the theme.

So I've split the share as below:

Magic Button :

Main Package:

Code:

http://uploadmirrors.com/download/71IQ9YTR/uvg-viral_app_game.rar

VT: Clean 0/41

Code:

https://www.virustotal.com/file/f90880478e85d5263ba7ea767ac9d203605067d678b58fe660c088b62e34d9f9/analysis/1336994980/

Theme Folder
(removed from Web Development -> Wordpress Theme -> wp-content folder)

Code:

http://uploadmirrors.com/download/T37KKWS5/themes.rar

VT: 1/41 ClamAV PUA.Script.Packed-2 (read above notes)

Code:

https://www.virustotal.com/file/87eb95de35afd92069e6f74c43a01e96607ca77b87f4d4767fd50e207609c364/analysis/

Remember to thank the OP for the share

Enjoy,
Si

Thanks a lot man!

Hi.. Si

Please share me your ioncube decoder..

BlackHatKnight - you have mail... well, a pm..

Si,

Ok.. I will check it..