Thursday, September 27, 2012

Analyzing the Blackhole Exploit Kit 2.0 with JSDetox

With the release of the new Blackhole Exploit Kit version, I wanted to check if JSDetox is still able to analyze it. As it turns out, the process is not much different from the last version (shown in this screencast).
I checked to find a current sample. Of course you should not visit those URLs with your normal browser as they contain malware - I will not "hide" those URLs here as they are publicly documented (and seem to be taken offline by now). The same applies for the tool JSDetox, you should run it in an isolated environment.

The obfuscated iframe leading to the exploit kit sounds interesting, so lets use that one:
wget -O pho.htm ""
The downloaded file contains this:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">

<h1><b>Please wait a moment. You will be forwarded...</h1></b>


Paste the javascript code into the textbox in the "Code Analysis" tab and click "Execute":

The code tries to call "window.eval()" - click "Show Code" to see what would be executed:

Click "Send to Analyze" to view the code in the code analysis tab and click "Analyze" to see a formatted version of the code:

Downloading the content of the created iframe...
wget -O column.php ""
This file contains 29kb of data and looks like this (shortened):
<html><body><script>g="getElementById";cc="concat";ss=String.fromCharCode;gg="getAttribute";function asd(){try{(alert+"fewfbw")()}catch(adgsdg){window["e"+"v"+"a"+"l"](s);}}</script><u id="google" 


if(r){s=s+r;}else break;
The last version of the Blackhole Exploit Kit I analyzed stored the obfuscated data in the text content of HTML attributes, this version uses different attributes of one single HTML element. To analyze this in JSDetox, copy the whole content of the file in the textbox in the "HTML Document" tab and click "Extract Scripts":

You are then taken to the "Code Analysis" tab where you can analyze the code (it is a decoding loop) or directly execute the script:

JSDetox logs that the code executed "document.getElementById" (to access the big HTML element containing the obfuscated code) and that it emulated that access with the imported HTML data. JSDetox then catches a call to "window.eval()" and makes it possible to view the code that would be executed (click "Show Code" and then "Send to Analyze").

Click "Reformat" to make the code readable. At the end of the code, we find this:

Downloading the file:
wget -O cee0c21.exe ""
A check on virustotal gives a detection rate of 6/43, a few ours later it was 11/43 with some major vendors still missing it:


  1. It seems great! Here are some discount ray ban sunglasses for you.

  2. شركتنا من المتميزون في اعمال الاصلاح بدون هدم او تكسير من خلال شركة ركن البيت التي تقدم الكثير والكثير في عمل اللازم وتصحيح الاخطاء التي تسببها تسريبات المياه فنحن مثلا

    شركة كشف تسربات المياه بجدة تقدم خدمة لعمل الاصلاح بدون اي خراب ونقدم النصيحة للعملاء بالابتعاد عن الاعمال التي تؤدي الي هذا الخراب فتعاملك مع شركة كشف تسربات بجدة لديها الخبرة الكافية تساعدك في الحفاظ علي منزلك كما اننا نتمكن في اننا سوف نرتقي بخدمة لاننا نقوم بالعمل السليم لها كما يوجد لدينا خدمات العوازل التي تمنع التسريبات من الاسقف لكم والحوائط والخزانات من خلال شركة تسمي الاولي في مجالها لذلك نحن نقدم شركة عزل خزانات بالرياض التي تعتبر في عل الخزانات الارضية من الداخل بواسطة مواد متميزة كما نقدم لكم شركة عزل اسطح بالرياض لعمل العوازل التي تمنع جميع التسريبات في الاسقف

  3. One of the most prominent issues the students have to deal with while writing assignments is plagiarism. Hence, they extensively use free plagiarism checker to check if there are any copied content in the paper.
    Another major reason for using plagiarism checkers is that universities do not accept plagiarized content. Plagiarism is a serious offence. Hence, if found, the students are suspended or might even lose the grades.
    Due to these limitations, it is evident that the plagiarism checking & word counter tool are not at all effective to check plagiarism. The term plagiarism is actually very broad. It is merely not coping with words. But these tools, unfortunately, detect words but not ideas. Hence, the chances of plagiarized papers remain.

  4. I suggest everyone to choose Assignment Help Australia for getting the best guidance in their academia. The proficient experts assist as per the requirements and learning styles desired by the university.

  5. There are many other things as well which you keep in mind before choosing it. Go through their samples before choosing any website. So, you can understand the knowledge of assignment experts. Assignment help play an important role as they are the one who writes their assignments.
    Programming help

    Java Assignment help

  6. Thanks for sharing useful information to getting Assignment Help in correct way. If you need any information for hiring an academic writer, place your call via greatassignmenthelp and talk to expert for resolving your concerns.
    Assignment Help Online
    Online Assignment Help
    Assignment Help Online Services
    Assignment Helper
    Assignment Assistance
    Assignment Help Experts
    Online Assignment Help Services
    Assignment Writing Help

  7. Thanks for updating the post! Your post has shared all essential information of Assignment Help very clearly. Students should opt for online assignment writing services in order to save their time. For more details regarding the best academic writing, connect with customer care services of assignmenthelpshop
    Assignment Help Online
    Online Assignment Help
    Assignment Help Online Service
    Assignment Helper
    Assignment Assistance
    Assignment Help Experts
    Online Assignment Help Services

  8. The mt everest base camp trek is the best trekking adventure in the world. It is a best journey to Mount Everest.

  9. Thank you for sharing valuable information. Nice post. I enjoyed reading this post.

  10. QuickBooks error 15106 is a common error which occurs due to problems in the update program.For more information click below: QuickBooks Error 15106 | QuickBooks Is Unable to Send Your Email to Outlook | QuickBooks Error 6000 77

  11. Wow! Thanks for sharing your ideas. Quicken is a financial managing software program needs to be installed it before making it in use. If you are a newbie and non-tech person, then few hurdles can be encountered during installation process. At that point, you should give a ring at Quicken Customer Support Numberwithout any delay. Our team of highly skilled and talented technicians will immediately lend a hand and proffer the fruitful direction so wherever you find the errors will be effectively annihilated in no time. The provided number is our 24/7 accessible toll-free number where all Quicken users arehelped without taking any charges.

    By updating Quicken anyone can get the benefit of amazing features which it offers to users. To learn the ways to update Quicken for windows simply visit Quicken support number.

    Thanks for sharing such a nice Blog.
    quicken problems
    quicken id
    quicken id help
    quicken 2016 bypass intuit id
    quicken id login
    quicken cloud sync errors

  12. Excellent information Providing by your Article, thank you for taking the time to share with us such a nice article. Amazing insight you have on this, it's nice to find a website that details so much information about different artists. Kindly visit livewebtutors website we providing best assignment help services in Australia.
    Read more now :- My Assignment Help

  13. Problem can crop up at anytime, whether it is your life, your surroundings or the things you are using such as software, machines, etc. But, the main thing is we have to tackle down these problems and learn from them, so that these issues will never stumble upon us again. In doing so, you can also take assistance from an expert, a friend, a family member and anyone who you know. This is the same case with Quicken. If you face any issue while using this software then you should go for Quickens’ professionals help before trying something stupid on your own. Now, you must have a question in mind that How Do I Contact Quicken By Phone. Well, Quicken has provided a Quicken Support Number
    +1-888-817-0312 by which you can easily connect with
    Quicken supportteam and resolve your issues.

    Quicken won't open
    Quicken file won't open
    Quicken won t open
    Quicken 2016 wont open
    Quicken 2015 wont open
    Quicken wont open
    quicken won't open after update
    quicken will not open
    quicken will not open after update
    quicken won't update
    Quicken Error OL-301-A
    Quicken Error OL 301 A
    quicken error cc-506
    Quicken Error CC-800
    Quicken Error OL-221-A
    quicken ol-393-a
    convert quicken to QuickBooks
    convert quicken file to quickbooks
    Quicken Error CC-502
    quicken error cc-503

  14. A very high level post with a knowledgeable information .thanks you for giving me such a nice information. If you need any college level Assignment Help at reliable quality with better work. Kindly visit livewebtutors website we providing best assignment help services in Australia, USA, UK, UAE, and Canada etc.
    Read more now :- Nursing Assignment Help

  15. Do you have difficulty in writing an finance assignment? Here is the solution! Opt for our finance assignment help and get a high-quality academic assignment written within the set deadline. As an assignment help provider, we know the importance of finance assignment in students' life. fullassignment has a team with expertise and experience in finance assignment help. We provide the best online assignment help to students. For more info please visit our website:
    or reach out us on whatsapp - (+1) 669-271-4848

  16. GoAssignmentHelp is very useful for the students who are doing their masters and want to submit the document to take their degree. We are providing the best assignment service to everyone. Just contact us at +61-0283206023 for the best quality services. All subjects and types of assignments available.
    Assignment Help Darwin | auditing assignment help | math assignment help | my assignment help

  17. I enjoy kinds very own post. It will be respectable to get a single narrative inside and outside of the core of this distinctive core specialized niche will likely be commonly knowledgeable.
    best online assignment help

  18. Thanks for sharing such an informative post.
    QuickBooks Error Code 15215 often occurs while performing payroll update and releasing maintenance. It may install the download or update of payroll. Who are expert in QuickBooks then in that case you can contact our QuickBooks Pro Support team at +1-(800)969-7370.

  19. I am really glad I have found this information.
    Get To Know About the New and Improved Features in QuickBooks Enterprise 2019. Intuit came up with an avant-garde accounting software- QuickBooks for small and medium businesses. And since then there has been a sea change in the sphere accounting.

  20. Thanks a lot for sharing your knowledge via the post.
    This post discusses the steps to set up folder and windows Access permissions to share company files. If you face any query, then feel free to contact us anytime at our QuickBooks Pro technical support number.i.e. +1-800-969-7370.

  21. 'I'm highly impressed by the piece of thoughts you have shared on this portal. all the best
    connect us on Assignment Help can shed your burden of assignments with a return of qualitative assignments.

  22. We are a certified and reliable third party QuickBooks support provider, offering unlimited QuickBooks support services for QuickBooks users. If you’re experiencing QuickBooks Error 80029c4a, you can get connected with our QuickBooks support professionals to get instant support or help. Our live Phone support is open 24/7 for QB users to provide right solutions.

  23. Hello, I have browsed most of your posts. This post is probably where I got the most useful information for my research. Thanks for posting, we can see more on this. Are you aware of any other websites on this subject.
    dubai events

  24. doesn't make empty promises and has always achieved what we promised our clients by online case study for nursing students. If you need any academic If you need any academic help then connect with me.

  25. Nice blog, it's so knowledgeable, informative, and a good-looking site. Myassignmenthelpau is a great platform that has been performing astonishingly well. If yes, then you are on the right platform to receive the best Accounting Assignment help at an affordable price. They provide transparent and trusted work satisfying universal clientele each year.

  26. 'I'm highly impressed by the piece of thoughts you have shared on this portal
    Install Custom Recovery

  27. This post was awesome thank you for sharing. Nursing students are normally required to write several academic papers before they can graduate. Those students have great writing skills, access to material resources and sufficient time normally find writing such papers to be quite interesting. Learn more from Nursing Assignment Writers

  28. For the success of the shoes which are differentiated by the company, new and innovative styles need to be invented each and every time assignment expert

  29. I have gone through your wonderful and knowledgeable post...! I must say that one should read it and gather know-how from it. I am a QuickBooks certified ProAdvisor that deliver instant QB solution worldwide. You can get in touch with us at +1(800)969-7370.

    QuickBooks Payroll Error 30159 | QuickBooks Error Code C=343

  30. I don’t know where on the internet I would have gotten such a great content thumb up. Did you know? Water quality concerns are becoming more of a focus for the public. You may have heard about contaminants in the drinking water such as Arsenic, Chromium, Cryptosporidium or Giardia. Visit Watts Premier Ro-Pure Plus Filters for more.

  31. Myassignmenthelp offers customized and unique assignment help through actual professionals. Our team of PhD. certified experts strive to meet students’ expectations along with University guidelines to ensure high scoring assignments every time. Along with adept writing help we offer professional proofreading, editing, free samples and exam help to assist students in achieving their career aspirations.

  32. ABC Assignment help is the proficient academic writing service holding a resourceful team of more than 3,000 assignment tutors, dedicated to assist students with the authentic academic support. Our team is always available to help students on a plethora of assignments, essays, coursework and more.

    For More - physics assignment help

  33. Its a great pleasure reading your article post.Its full of information I am looking for and I love to post a comment that "The content of your post is awesome" Great work.
    QuickBooks Online (QBO) Login Problems on Chrome
    QuickBooks Error H101, H202, H303, or H505
    QuickBooks Database Server Manager
    QuickBooks Install Diagnostic Tool

    QuickBooks Error Code 80070057

  34. Hello everyone today I am going to tell you that this website provides very, useful information and helpful, I hope you also like the information.

    Different Windows 10 versions that work best for QuickBooks Desktop
    QuickBooks Has Stopped Working Error
    QuickBooks File Doctor
    QuickBooks Install Diagnostic tool

  35. Thank you so much for this Post and all the best for your future. You have opened my eyes to varying views on this topic with the interesting. I am satisfied with the arrangement of your post. Thank you..!!!

    QuickBooks Desktop are Supported on Windows 10
    QuickBooks Connection Diagnostic Tool

  36. Great, i must say and thanks for sharing this informative post.I am really impressed that there is so much information about this subject that have been uncovered and you’ve done your best, is giving help to students who is stressed with their homework help and submit their assignment on time.we are already trusted by thousands of students who struggle to write their academic papers and also by those students who simply want to save their time and make life easy.
    psychology assignment help
    Database Management Assignment Help
    electrical engineering assignment help
    assignment expert

  37. Thank you for bringing to a halt my long search topic. I really benefited from your content. If you are experiencing trouble striking a balance between your busy academic life and handling your online classes, you can get help from a professional who will take online classes on your behalf. It doesn’t matter the kind of help you need, whether it is passing your exam, finishing your assignments or even the entire classwork, you can get help here at Online Class Help .

  38. Quickbooks-database-server-managerallows the person to configure the software server for multi-consumer access. The tool also helps in growing the network facts record for any corporation document. One of the reasons why putting in Database Server Manage advocated is due to the fact it allows the consumer to use multi- variations of QB desktop software. Moreover, the device also can hook up with more than one structure to perform tasks

  39. Assignment Help services work like wonder when you don't have sufficient time to write your homework. Take the guidance of professional academic writers using online academic writing and finish your work as soon as possible even if you are in Australia.
    My Assignment Help
    Assignment Help Online
    Online Assignment Help