jsunpack - a generic JavaScript unpacker

script benign

[nothing detected] script
info: [decodingLevel=0] found JavaScript
info: [meta refresh] URL=blacklefilm.com/x.html
info: [var m] URL=127.0.0.1/
info: [var newurl] URL=127.0.0.1/
info: [decodingLevel=1] found JavaScript
file: 5a0e52381ec991eeb4a9eef406212c1c7bf7438b: 335 bytes
file: 6000ace6237e35ecc3aaadfa4ebb3f7b2a7a529c: 304 bytes

Decoded Files

5a0e/52381ec991eeb4a9eef406212c1c7bf7438b from script (335 bytes, 10 hidden) download

6000/ace6237e35ecc3aaadfa4ebb3f7b2a7a529c from script (304 bytes) download

lausakizse.cz.cc/scanner10/?afid=24 benign

[nothing detected] (metarefresh) lausakizse.cz.cc/scanner10/?afid=24
status: (referer=blacklefilm.com/x.html)saved 2114 bytes f3511ddc0cd7179ae4f60cd8ef233313fb0c1dd8
info: [img] lausakizse.cz.cc/assets/5b9c863d/Images/loading.gif
info: [script] lausakizse.cz.cc/scanner10/codejs
info: [decodingLevel=0] found JavaScript
info: [1] no JavaScript
file: f3511ddc0cd7179ae4f60cd8ef233313fb0c1dd8: 2114 bytes
file: 31f2acfb474b14fd4d9a74f5f1849727d9e9aafd: 44 bytes

Decoded Files

f351/1ddc0cd7179ae4f60cd8ef233313fb0c1dd8 from lausakizse.cz.cc/scanner10/?afid=24 (2114 bytes, 136 hidden) download

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta http-equiv="Content-Language" content="en" /> <meta http-equiv="Cache-control" content="Public" />  <title>My Windows Online Scanner</title> <link rel="icon" href="/assets/5b9c863d//Images/favicon.gif" type="image/gif" />  <style type="text/css" media="screen"> #loading { height:auto; left:45%; padding:2px; position:absolute; top:40%; z-index:20001; } #loading a { color:#225588; } #loading .loading-indicator { -x-system-font:none; background:white none repeat scroll 0 0; color:#444444; font-family:tahoma,arial,helvetica; font-size:13px; font-size-adjust:none; font-stretch:normal; font-style:normal; font-variant:normal; font-weight:bold; height:auto; line-height:normal; margin:0; padding:10px; } #loading-msg { -x-system-font:none; font-family:arial,tahoma,sans-serif; font-size:10px; font-size-adjust:none; font-stretch:normal; font-style:normal; font-variant:normal; font-weight:normal; line-height:normal; } </style> <script type="text/javascript">  </script> </head> <body> <div id="loading" style="display:block"> <div class="loading-indicator"><img height="50" width="50" style="margin-right: 8px; float: left; vertical-align: top;" src="/assets/5b9c863d//Images/loading.gif"/><br/><span id="loading-msg">Initializing Virus Protection System...</span></div> </div> <script type="text/javascript" src="/scanner10/codejs"> </script> </body> </html>

31f2/acfb474b14fd4d9a74f5f1849727d9e9aafd from lausakizse.cz.cc/scanner10/?afid=24 (44 bytes) download

lausakizse.cz.cc/scanner10/codejs benign

[nothing detected] (script) lausakizse.cz.cc/scanner10/codejs
status: (referer=lausakizse.cz.cc/scanner10/?afid=24)saved 67411 bytes bc1a2356ead15b438d1739825f81de349719ebe2
info: [decodingLevel=0] found JavaScript
error: undefined variable a
file: bc1a2356ead15b438d1739825f81de349719ebe2: 67411 bytes

Decoded Files

bc1a/2356ead15b438d1739825f81de349719ebe2 from lausakizse.cz.cc/scanner10/codejs (67411 bytes, 12 hidden) download

var strategy={"isShowPreLanding":false,"preLandingTemplate":false,"preLandingTemplateInitScript":false,"preLandingTemplateCSSFile":false,"preLandingImagesList":false,"preLandingShowMinTime":-1,"centralLandingTemplate":"<div class=\"centrallanding_main\">\t\r\n\t<div class=\"centrallanding_left\" id=\"centrallanding_left\">\r\n\t\t\r\n\t\t<div class=\"centrallanding_left_1\">\r\n <div class=\"left_icon_1\"><\/div>\r\n <div class=\"centrallanding_spacer\"><\/div>\r\n \t<div class=\"centrallanding_top\">System Tasks<\/div>\r\n <div class=\"centrallanding_bottom\"><\/div>\r\n\t\t\t<div class=\"centrallanding_left_inner\" onclick=\"kPromo.initiateDownload();return false;\">View system information<\/div>\r\n\t\t\t<div class=\"centrallanding_left_inner\" onclick=\"kPromo.initiateDownload();return false;\">Add or remove programs<\/div>\r\n\t\t\t<div class=\"centrallanding_left_inner\" onclick=\"kPromo.initiateDownload();return false;\">Change a settings<\/div>\r\n <\/div>\r\n\t\t<div class=\"centrallanding_left_1\">\r\n <div class=\"left_icon_2\"><\/div>\r\n <div class=\"centrallanding_spacer\"><\/div>\r\n \t<div class=\"centrallanding_top\">Other Places<\/div>\r\n <div class=\"centrallanding_bottom\"><\/div>\r\n\t\t\t<div class=\"centrallanding_left_inner\" onclick=\"kPromo.initiateDownload();return false;\">My Network Places<\/div>\r\n\t\t\t<div class=\"centrallanding_left_inner\" onclick=\"kPromo.initiateDownload();return false;\">My Documents<\/div>\r\n\t\t\t<div class=\"centrallanding_left_inner\" onclick=\"kPromo.initiateDownload();return false;\">Shared Documents<\/div>\r\n\t\t\t<div class=\"centrallanding_left_inner\" onclick=\"kPromo.initiateDownload();return false;\">Control Panel<\/div>\r\n <\/div>\r\n\t\t<div class=\"centrallanding_left_1\">\r\n \t<div class=\"centrallanding_spacer\"><\/div>\r\n \t<div class=\"centrallanding_top\">Details<\/div>\r\n <div class=\"centrallanding_bottom\"><\/div>\r\n\t\t\t<strong>My Computer<\/strong><br \/>\r\nSystem Folder\r\n <\/div>\r\n\t<\/div>\r\n\t\r\n\t<div class=\"centrallanding_right\">\r\n \t\r\n\t\t<div class=\"centrallanding_spacer\"><\/div>\r\n\t\t<div class=\"centrallanding_right_1\">System folders<span id=\"centrallanding_right_1_alert\"><\/span><\/div>\r\n\t\t<div class=\"centrallanding_grad\"><\/div>\r\n <div class=\"centrallanding_folders\">\r\n <div class=\"centrallanding_folder_1\">\r\n <b class=\"icon\"><\/b>\r\n Shared Documents\r\n <div class=\"centrallanding_virus_1\" id=\"centrallanding_virus_1\"><b class=\"threat\"><\/b><span id=\"centrallanding_virus_1_number\"><\/span>&nbsp;Viruses found<\/div>\r\n <\/div>\r\n <div class=\"centrallanding_folder_2\">\r\n <b class=\"icon\"><\/b>\r\n My Documents\r\n <div class=\"centrallanding_virus_1\" id=\"centrallanding_virus_2\"><b class=\"threat\"><\/b><span id=\"centrallanding_virus_2_number\"><\/span>&nbsp;Viruses found<\/div>\r\n <\/div>\r\n <\/div>\r\n <div class=\"centrallanding_spacer\"><\/div>\r\n\t\t<div class=\"centrallanding_right_1\">Hard drive<span id=\"centrallanding_right_1_alert\"><\/span><\/div>\r\n\t\t<div class=\"centrallanding_grad\"><\/div>\r\n <div class=\"centrallanding_hdd_1\">\r\n <b class=\"icon\"><\/b>\r\n Hard drive (C:)\r\n <div class=\"centrallanding_virus_1\" id=\"centrallanding_virus_3\"><b class=\"threat\"><\/b><span id=\"centrallanding_virus_3_number\"><\/span>&nbsp;Viruses found<\/div>\r\n <\/div>\r\n <div class=\"centrallanding_right_1\">Security<span id=\"centrallanding_right_1_alert\"><\/span><\/div>\r\n\t\t<div class=\"centrallanding_grad\"><\/div>\r\n <div class=\"centrallanding_sec_1\" id=\"centrallanding_sec_1\">\r\n <b class=\"icon\"><\/b>\r\n Windows Security\r\n <div class=\"centrallanding_virus_2\" id=\"centrallanding_virus_2_1\">Security is affected by virus<\/div>\r\n <\/div>\r\n <div class=\"centrallanding_scroll\"><span id=\"centrallanding_scroll\">0<\/span><span>%<\/span>\r\n \t<div class=\"centrallanding_scroll_bg\" id=\"centrallanding_scroll_bg\"><\/div>\r\n <\/div>\r\n <div class=\"centrallanding_progress\" id=\"centrallanding_progress_1\">Checking: <span id=\"centrallanding_progress\"> <\/span><\/div>\r\n <div class=\"centrallanding_table\" id=\"centrallanding_table\">\r\n \t<div class=\"centrallanding_table_text\">Your Computer is infected<\/div>\r\n \t\t<div class=\"centrallanding_spacer\"><\/div>\r\n \t<table class=\"centrallanding_inner_table\" cellpadding=\"0\" cellspacing=\"0\">\r\n \t<tr class=\"centrallanding_table_tr_1\">\r\n \t<td colspan=\"2\" width=\"260\">Name<\/td>\r\n <td width=\"4\"><b class=\"del\"><\/b><\/td>\r\n <td width=\"75\">Type<\/td>\r\n <td width=\"4\"><b class=\"del\"><\/b><\/td>\r\n <td>Threat level<\/td>\r\n <\/tr>\r\n <\/table>\r\n <div class=\"centrallanding_inner_table_cont\" id=\"centrallanding_inner_table_cont\">\r\n \t<div class=\"centrallanding_spacer\"><\/div>\r\n \t<table class=\"centrallanding_inner_table_2\" cellpadding=\"0\" cellspacing=\"0\">\r\n \r\n <\/table>\r\n <\/div>\r\n <div class=\"centrallanding_recommend

URL	Status
127.0.0.1/

fajigeg.co.cc/news/?onpage=11ss&on=get&page=168&offset=off&vid=param&map=img	status: (referer=blacklefilm.com/x.html)failure: HTTP Error 404: Not Found

Submission permanent link c78f8dbff54c6e5fd64854b5469637bf709b9baa (Received 2010-09-21 12:06:38, script )

All Malicious or Suspicious Elements of Submission