jsunpack - a generic JavaScript unpacker

upload benign

[nothing detected] upload
info: [img] antivirpwr.com/images/logotarget.jpg
info: [img] antivirpwr.com/images/point.png
info: [img] antivirpwr.com/images/downbutton.png
info: [decodingLevel=0] found JavaScript
error: line:3: SyntaxError: missing = in XML attribute:
error: line:3: <!DOCTYPE HTML PUBLIC -/W3C/DTD HTML 4.01 Transitional/EN http:/www.w3.org/TR/html4/loose.dtd>
error: line:3: ...............^
file: 9878d2b2dd51845b41e0865d1bc488cf33877655: 2838 bytes

Decoded Files

9878/d2b2dd51845b41e0865d1bc488cf33877655 from upload (2838 bytes, 131 hidden) download

<!DOCTYPE HTML PUBLIC -//W3C//DTD HTML 4.01 Transitional//EN http://www.w3.org/TR/html4/loose.dtd> <html> <head> <title>Internet Explorer cannot display the webpage.</title>  <style> body{ background-color:#F7F7F7;} .stl4 {font-weight: 550;font-family: Arial;font-size: 16px;color: #666666; font-stretch:ultra-expanded;} .stl5 {font-weight: 550;font-family: Arial;font-size: 16px;color: #0099CC; text-decoration:none;} </style>  <script language="javascript"> function init() {var jnnasv = document.getElementById('wewdq');var dfopmv = document.getElementById('btwumk');var s1 = 'Check your comp';s1 += 'uter for viruses and malware.';dfopmv.innerHTML = s1;s1 = 'Purchase for secure I';s1 += 'nternet surfing (Recommended).';jnnasv.innerHTML = s1;s1 = 'http://antivirpwr.com/shop?abc=cGdpZD01JnI9NTcuMA==';hrf0.href = s1;hrf1.href = s1;hrf2.href = s1; } </script>  </head> <body onload="init();"> <table width=830 cellpadding=0 cellspacing=0 border=0> <tr> <td width=83 height="103"><div align="right"><img src="http://antivirpwr.com/images/logotarget.jpg" width="68" height="65"></div></td> <td width=747> <h1 style='font-family: Arial, Helvetica, sans-serif;font-size: 18px;color: #006699; margin-top:22px;'>Internet Explorer Warning - visiting this web site may harm your computer!</h1></td></tr><tr><td id=statusCodeAlign class=errorCodeAndDivider align=right>&nbsp;</td> </tr> <tr> <td>&nbsp;</td> <td valign=top align=left> <span class=stl4>Most likely causes:</span> <ul>   <li class=stl4>The website contains exploits that can launch a malicious code on your computer</li>   <li class=stl4>Suspicious network activity detected</li>   <li class=stl4>There might be an active spyware running on your computer</li> </ul>  </td></tr> <tr><td>&nbsp;</td> <td valign=top align=left> <span class=stl4>What you can try:</span> <br><br></td></tr><tr><td >&nbsp;</td> <td align=left valign=middle> <table><tr><td width="30" valign=top><img src="http://antivirpwr.com/images/point.png" border=0 class=actionIcon></td><td valign=top>  <a id="hrf0" class="stl5" ><span id="wewdq"/></a>  </td>   </tr></table><br></td></tr> <tr><td >&nbsp;</td><td align=left valign=middle> <table><tr><td width="30" valign=top><img src="http://antivirpwr.com/images/point.png" border=0></td><td valign=top><a id="hrf1"  class=stl5><span id="btwumk"/></a></td> </tr></table><br></td></tr><tr><td align=right valign=top>&nbsp;</td><td id=moreInfoAlign align=left valign=middle><table> <tr> <td width="30" valign=top><img src="http://antivirpwr.com/images/downbutton.png"></td> <td valign=top><a id="hrf2" class="stl5"> More information </a></td> </tr> </table> <div style=display:none></p></div></td></tr> </table> </body> </html>

Submission permanent link 2ba8eb9a6d40ee9e4c93ced314d0eabaa699a298 (Received 2010-09-20 12:52:28, get2[1]_php )

All Malicious or Suspicious Elements of Submission