In Depth checking : Monster Wheels Racing 2, security assessment

[NickTheGreek]

There are two different versions of the following game available for download on InvisionGames

Monster Wheels 2 or Monster Wheels Racing 2

- MonsterWheels2AS3v2TH, converted by Thunder2014

CODE

$config = array(
    'active'            => '1',
    'bgcolor'            => '000000',
    'gcat'            => '18',
    'gheight'            => '600',
    'gkeys'            => 'See in Game',
    'gname'            => 'MonsterWheels2AS3v2TH',
    'gtitle'            => 'Monster Wheels 2',
    'gwidth'            => '800',
    'gwords'            => 'Monsters Wheels 2 continue where the first one left off. Take part in the ultimate monster truck racing contest. Crush other trucks in your path. Buy new car equipments and upgrades to become even more of a monster. When you get rich enough buy a brand new better monster truck.',
    'highscore_type'            => 'high',
    'object'            => 'Monsters Wheels 2 continue where the first one left off. Take part in the ultimate monster truck racing contest. Crush other trucks in your path. Buy new car equipments and upgrades to become even more of a monster. When you get rich enough buy a brand new better monster truck.',
    'snggame'            => '0',
);

- Monster Wheels Racing 2, converted by grimm

CODE

$config = array(

gname                    =>        "MonsterWheels2AS3v2DOT",
gtitle                =>      "Monster Wheels Racing 2",
bgcolor                =>      "000000",
gwidth                =>      "800",
gheight                =>     "600",
active                =>      "1",
gcat                    =>        "1",
highscore_type        =>        "high",

//optional leave blank if not using
gwords                =>      "Monsters Wheels 2 continue where the first one left off. Take part in the ultimate monster truck racing contest. Crush other trucks in your path. Buy new car equipments and upgrades to become even more of a monster. When you get rich enough buy a brand new better monster truck. ",
object                =>      "See in Game",
gkeys                    =>      "See in Game",

);

Both conversions seem similar, although filesizes differ a bit.

What alarms me is that trying to offer both for download here i have no issues uploading the second conversion by grimm [game_MonsterWheels2AS3v2DOT.tar] but while uploading the first one [game_MonsterWheels2AS3v2TH.tar] the server triggers a security alert due to CXS - ClamAV automatic content scanning:

CODE

ClamAV detected virus = [Swf.Exploit.CVE_2014_0581]

both files will be available for downloading but consider yourself warned on the first one

[NickTheGreek]

Thunder provided the original SWF file

CODE

1429895984_monsters-wheels-2.swf

VirusTotal shows it has the same issue with ClamAV

ClamAV Swf.Exploit.CVE_2014_0581 20150425