X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:subject:to:references:from:message-id:date
	:mime-version:in-reply-to:content-type
	:content-transfer-encoding; q=dns; s=default; b=RxuGLtML3yEgf4mz
	VEyopx3dNyXc5Xt19tK49umfDxPQMmI1xTX65nj23krlK2UpKbXn2BUcNx9LDmMA
	zNNgRh2N7F/97PLuo+5EMxGizp3+rAQ+zbScDkXWNTK3eIByoRdkPOBUMWnicWKI
	qj9pJO3etYd4IIsDJWC/Evb2ih0=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:subject:to:references:from:message-id:date
	:mime-version:in-reply-to:content-type
	:content-transfer-encoding; s=default; bh=WfsyM3ueUMrMOKL0r2imky
	zFOHc=; b=YycgN+dC4aV4HzrlQrC9XzinPo5L+hG0DtQnT8aibTKDjrHV/EshBy
	KeywpKLex/0UbqIta57ld+1LGykzZif89oieK+aaqX30NbRT4mIkRJXe5Ur2SyMc
	FyqIEQZNLf6VA/U9OFDRR15OwVXiTK2YmbUiUZKRMKbZ1ssLDLChA=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Spam-SWARE-Status: No, score=-1.0 required=5.0 tests=AWL,BAYES_00,FREEMAIL_FROM,KAM_COUK,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=no version=3.3.2 spammy=PDF, UD:co.uk, unsolicited, Hx-languages-length:790
X-HELO: smtp-out-1.tiscali.co.uk
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tiscali.co.uk;	s=1605; t=1530374968;	bh=UIaVpjb23nkVwAjGjWAZ4U5ro9UxSPn9KYC9E6C0JtE=;	h=Subject:To:References:From:Date:In-Reply-To;	b=jVUVCgUU2RUogml6kMqeOeugjkagfD47ecT7ZRWQmBZfpS7EfSZpMkr3d3AhP/9gE	 vxe5nS7r22UNdvl7GsgGNqxGMgsaGrdiGcUNmPq4HKOocqND6WxDC+ttSEgFw33W9X	 5WDY9i85/Lq0S1M1VS3OBYjOZMIEPuU/00z8R25k=
Subject: Re: cygwin Digest 25 Jun 2018 00:46:06 -0000 Issue 10882 - virus alert
To: cygwin AT cygwin DOT com
References: <d474d3c7-1b31-f290-5f57-693635c9aef9 AT familywatt DOT co DOT uk>
From: David Stacey <drstacey AT tiscali DOT co DOT uk>
Message-ID: <2a0f4eac-9a37-0196-d072-4f5483557862@tiscali.co.uk>
Date: Sat, 30 Jun 2018 17:09:20 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0
MIME-Version: 1.0
In-Reply-To: <d474d3c7-1b31-f290-5f57-693635c9aef9@familywatt.co.uk>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes

On 30/06/18 13:19, Richard Watt wrote:
> Did anyone else get a virus warning from the cygwin Digest 25 Jun 2018
> 00:46:06 -0000 Issue 10882?

It's an unsolicited invoice from someone you've never heard of. Of 
course it's malware :-)

It's an attachment to this post [1], compressed with gzip. The 
compressed version passes through VirusTotal cleanly. If you unpack the 
file, though, you discover that it isn't a PDF at all (surprise, 
surprise) but a .NET executable. And quite a few anti-virus tools flag 
it as something unpleasant [2].

Dave.

[1] - https://cygwin.com/ml/cygwin/2018-06/msg00264.html
[2] - 
https://www.virustotal.com/#/file/06c5c0701c5702dbe126ca2918e3ffdec8337f2a98b80939fdd0518e44fbffa6/detection


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple