The Christian Bale Trojan – Further details

Some have speculated as to the exact cryptor or packer used in the get_flash_update.exe (false codec) found in a number of different spam campaigns – the latest being used with subject lines concerning the latest Batman movie starring Christian Bale. After running several PE signature scans against the executable it doesn’t appear to be packed or protected with anything that is commercially available, rather it appears to be using something else (possibly PCX graphics format);

Furthermore, all of the get_flash_update.exe binaries from different URLs share a common PE signature.