Spa site gets `rootkited`

I came across this spa’s website today, which is hosting a rootkit.

The full URL is: www.landmarkspa.com/pdf/wq.exe

The file itself came up as clean as soap on VirusTotal:

Upon running it though, the file immediately deleted itself and created a Service.

That service, or rootkit, is detected by a few AV Vendors:

Playing with the new (free) version of McAfee FileInsight:

The screenshot below shows the rootkit name and… a lot of padding… an easy way to bypass signature detection.

Jerome Segura

Malware ID: f535708ce6190267e16ee8e22d5d4917.zip