Forceup.com caught trying to sell a malicious advertisement featuring firstchoice.com

I received an email tonight warning me that a Diane Samuels from forceup.com is contacting web sites wanting to place an advertising banner.  I was contacted by those behind a web site with checks in place that identified the advertising banner as "a virus of some sort".

The creative's name was firstchoise_728x90.swf.

"Diane Samuels" did not respond to emails from the web site's staff once they discovered that the advertisement was bad - a failure to respond is standard operating procedure for the b*stards behind the malicious advertisements - if they get caught by one web site, they just move on to the next one.

Forceup.com is a well known name to those of us who watch and report on malicious banner advertisements - if you search this blog for that name you will find that forceup is mentioned nine times.

First, I am *very* pleased that the intended victim site's checks and balances alerted them to a problem, aka "a virus of some sort".

Second, I am *very* pleased that the creative was detected as a virus.

Third, I have a copy of the actual creative that I can analyse it and report on, and provide screenshots.

An analysis of the creative at adopstools reveals that the creative contains "a sprite/movieclip which is containing Malware actionScript code".

Here are screenshots of the advertisement provided by forceup.com - you have been warned. 

If I receive further information I will blog again.

image

image

image

Comments

# re: Forceup.com caught trying to sell a malicious advertisement featuring firstchoice.com

Thursday, February 28, 2008 3:14 AM by Conrad Longmore

Ahhh... adopstools.net. Now that *is* a useful looking site. It looks a lot more useful than Trillix for this type of analysis, that's for sure. Thanks!

# re: Forceup.com caught trying to sell a malicious advertisement featuring firstchoice.com

Wednesday, March 19, 2008 10:34 AM by James Smith

Forceup.com seems to be at it again.  Eric Gordon contracted my company to run a dating offer. 6MM impressions later...no response.