Cenzic 232 Patent
Paid Advertising
sla.ckers.org is
ha.ckers sla.cking
Sla.ckers.org
Script obfuscation, filter evasion, IDS/IPS/WAF bypassing... this is where it should live. Because this topic is too big to live anywhere else. Phj33r! 
Go to Topic: PreviousNext
Go to: Forum ListMessage ListNew TopicSearchLog In
Found a strange JS malware
Posted by: flam
Date: January 11, 2012 05:44PM

Some guy tried to run this on my site. I'll keep his IP private because whatever.

The js: http://d3lvr7yuk4uaui.cloudfront.net/items/loaders/loader_1111.js
I'm not actually sure what it does, if anyone could shed some light I'd appreciate it.

Anyways here it is mirrored:
http://pastie.org/pastes/3169315/text

And here it is beautified:
http://pastie.org/pastes/3169316/text?key=r4cxppq3iihwcklsfuhsw

Options: ReplyQuote
Re: Found a strange JS malware
Posted by: smallfinger
Date: January 21, 2012 05:26AM

Same here.I've been getting multiple such entries in logs. So far, I have no luck figuring out what its trying to do.

Here is the javascript that initiates it all : http://pastie.org/pastes/3224218/text

Here is the final JS :

http://d3lvr7yuk4uaui.cloudfront.net/items/loaders/loader_1063.js?aoi=1311798366&pid=1063&zoneid=14729&cid=&rid=&ccid=&ip=

Any help is appreciated.

Options: ReplyQuote
Re: Found a strange JS malware
Posted by: Skyphire
Date: May 14, 2012 09:56PM

Looks like advertising malware. Dunno. Probably XSS injected.

Options: ReplyQuote


Sorry, only registered users may post in this forum.