New Trojan through Fake Adobe site

A malicious ad displayed on monova.org is pushing malware:

The so-called Flash Player comes from:

adobe.com-newversion.info/install_flash_player.exe

In fact, the domain itself is a copycat of the real Adobe site, but clearly the domain name looked suspicious to me (especially the .info part).

Another thing is the fact that the file itself is not signed, version number is incorrect etc…

This, in comparison, is the real Flash player:

And this time I can say that the file actually is new. No AV engine on VirusTotal is able to detect this threat!

Upon execution the file drops a known exectuable (smc.exe) which oddly enough was picked by our HoneyPots this morning:

Jerome Segura

Malware ID: 8c2af425f45608f47027833b512a68a8.zip