This morning I received a relatively large number of detections for SWF.Exploit.Kit.tht.Talos . They show as coming from multiple IP addresses within the last several days, with the first one on 12/9.
The file name is listed as adsapi.swf
The Hash shows up as malware on 2 engines on virustotal: https://www.virustotal.com/en/file/59ceffed73c5bb616d78416096c207d4334c91d5c718e82c355766ca9af8aa87/analysis/
Sha256: 59ceffed73c5bb616d78416096c207d4334c91d5c718e82c355766ca9af8aa87
I have used Dig on multiple public IP addresses that show as the source and they all come back as having a PTR to hosts in the 1e100.net domain. That shows up as belonging to Google, and is claimed to be used to identify servers on their network.
Is this retrospective malware detection a false positive, or were a large number of hosts downloading malware over the last week?
Thank You, Alan
