McAfee and sample submissions

This morning a co-worker received an email from DHL with an attachment. The attachment was titled "UPS_Print_Label_912.zip" and inside was an executable with an icon of a MS Word document. At the time neither Prevx 3.0, MBAM, or Panda Cloud was detecting anything malicious. I uploaded to Virus Total and someone else had already uploaded it a few hours ago. At the time only 15/40 were able to detect it. I decided to submit the sample to several companies, one of them being McAfee, as a password protected zip renamed to .zi_p in order to pass thru Gmail. I even tested the file before submitting to make sure you would be prompted for a password upon opening the file.

McAfee Labs - Beaverton replied:

I can only assume the "bot" was unable to process the file since the extension was renamed. Even then it should be passed on to a real analyst for further inspection. Has anyone else had issues submitting samples to McAfee?

 

I usually submit samples via website, WebImmunize.

Far more easier that way

https://www.webimmune.net/

 

can send sample via e-mail

Virus_Research @ avertlabs.com

zip the file,and use "infected" as pass.

 

Hi Elite,

MBAM wont unpack zipped folders to sniff the file inside,

If you custom scanned the extracted file and we did not detect the malicious code can you please upload @ the MBAM research center and i will make sure its attended too quickly.
http://forums.malwarebytes.org/index.php?showforum=51

Thanks in advance

 

Sorry for not clarifying in my original post, but that is the address I sent it to.

Howdy. I unzipped and scanned the actual .exe Tuesday morning with MBAM and which came up clean. I uploaded the .zip to
http://uploads.malwarebytes.org/ (which is now offline) and scanned it a few minutes ago.

Malwarebytes' Anti-Malware 1.44
Database version: 3721
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

2/11/2010 12:40:26 PM
mbam-log-2010-02-11 (12-40-26).txt

Files Infected:
c:\documents and settings\texascom\desktop\ups_print_label_912\UPS_Print_Label_912.exe (Trojan.Sasfis) -> Quarantined and deleted successfully.