Every so often we get questions about someone having found malware and wanting to know what it does. Essentially they are asking us to analyze the malware and tell them what it is. The latest one is here, about boring and awful PHP black hat SEO malware.
In my opinion, those questions are mostly useless:
- there is an infinity of possible malware variants, so an answer wouldn't apply to anyone else, unless they find the exact same malware (which is getting rare as crooks use different obfuscators)
- the author won't learn much just by reading someone else analysis. Maybe a canonical question "how to I reverse engineer X malware?", where X being the general category of malware (Windows, Linux, web, etc).
We should probably close those broad questions and only leave those asking more specific questions that could potentially have value to someone else later on (questions about a specific exploit, obfuscation method, etc). What do you think?