Michael Jackson Malware

Only a few hours after Michael Jackson’s death, we are seeing malware using his name to propagate:

The file’s extension is .scr (normally used by screensavers). The icon looks like an old Windows Media Player file:

Upon running the file, the following web page opens up:

The malware opens up two new files:

And this is how it hooks into the system:

Jerome Segura

Malware ID: 664cb28ef710e35dc5b7539eb633abca.zip