Analysis by: Kiyoshi Obuchi

ALIASES:

JS/Dwnldr-VKX(Sophos-Lite); Js.Ursnif.Tiboal!c (AegisLab); Trojan-Downloader.JS.Agent.oes (Kaspersky)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size: 706,303 bytes
File Type: JS
Memory Resident: No
Initial Samples Received Date: 12 Apr 2018

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Trojan connects to the following possibly malicious URL:

  • http://{BLOCKED}.{BLOCKED}-pklah4pe40.m8h4pe-pklah4pe4ivzxqzhivzxqzh0.m8h4pe-pklah4pe4vzxp80.ge0.m8h4pe-pklah4pe40.m8h4pe-pklah4pe4ivzxqzhivzxqz0.m8h4pe-pklah4pe4./0.m8H4pe-pkLAH4pe4.g56.VAg56.0.m8H4pe-pkLAH4pe4VA.VAAIVZXqzVZXq.g56.
  • http://{BLOCKED}.{BLOCKED}e-pklah4poe40.m8h4poe-pklah4poe4oivzxqzhivzxqzh0.m8h4poe-pklah4poe4vzxp80.ge0.m8h4poe-pklah4poe40.m8h4poe-pklah4poe4oivzxqzhivzxqz0.m8h4poe-pklah4poe4t8./0.m8H4pOe-pkLAH4pOe4.g56.VAg56.0.m8H4pOe-pkLAH4pOe4VAT8.VAAIVZXqzVZXq.g56.
  • http://{BLOCKED}.{BLOCKED}.a56.qzhi15.a56.qzh93.d930.m83h4poe44pdklah4poe4ii15.a56.qzhi15.a56.qzh93.d930.m83h4poe44pdklah4poe4hi15.a56.qz393i15.a56.qzhho.9i15.a56.qzhi15.a56.qzh93.d930.m83h4poe44pdklah4poe4t/15.A56.p815.Ag2i9.pt
  • http://{BLOCKED}.{BLOCKED}oe-pklah4poe4330.m83h4poe-pklah4poe4oivzxqzhivzxqzh30.m83h4poe-pklah4poe4vzxp830.ge30.m83h4poe-pklah4poe4330.m83h4poe-pklah4poe4oivzxqzhivzxqz30.m83h4poe-pklah4poe4t8./30.m83H4pOe-pkLAH4pOe4.g56.VAg56.30.m83H4pOe-pkLAH4pOe4VAT8.VAAIVZXqzVZXq.g56.
  • http://{BLOCKED}.{BLOCKED}.qge93.d930.3i93.d930.m83nhsue4sdklanhsue4i15.a56.qzhi15.a56.qzh93.d930.m83nhsue4sdklanhsue4615.a56.qge93.d930.3i93.d930.m83nhsue4sdklanhsue4i15.a56.qzhip8p15.a56.qgeh93.d930.9.856.p8p93.d930.9.856.p8p15.a56.p8p.u93.d930./
  • http://{BLOCKED}.{BLOCKED}klah4pv.m8h4-pklah4pv.m8h4-pklah4pviqzhiqzh.m8h4-pklah4pvam8h4pklah4pv//.ds5ds.p.m8H4-pkLAH4pvIqzq.ds5ds.
  • http://{BLOCKED}.{BLOCKED}laa1.m8a-pklaa1.m8a-pklaa1iqzhiqzh.m8a-pklaa1am8apklaa1//.ds5ds.p.m8a-pkLAa1Iqzq.ds5ds.
  • http://a.{BLOCKED}v.m8a-pklaapv.m8a-pklaapviqzhiqzh.m8a-pklaapvam8apklaapv//.ds5ds.p.m8a-pkLAapvIqzq.ds5ds.
  • http://a.{BLOCKED}ah4pv.m8h4pe-pklah4pv.m8h4pe-pklah4pviqzhiqzh.m8h4pe-pklah4pvam8h4pe-pklah4pva.m8h4pe-pklah4pvi.m8h4pe-pklah4pv.656.-.m8h4pe-pklah4pv.m8h4pe-pklah4pv//H6e-.m8H4pe-pkLAH4pv.m8H4pe-pkLAH4pv.m8H4pe-pkLAH4pv.m8H4pe-pkLAH4pv./.m8H4pe-pkLAH4pv.656.p.m8H4pe-pkLAH4pvIqzq.656.
  • http://a.{BLOCKED}ah4pv.m8h4pe-pklah4pv.m8h4pe-pklah4pvizxqzhizxqzh.m8h4pe-pklah4pvzxam8h4pe-pklah4pva.m8h4pe-pklah4pvi.m8h4pe-pklah4pv.656.-.m8h4pe-pklah4pv.m8h4pe-pklah4pv//H6e-.m8H4pe-pkLAH4pv.m8H4pe-pkLAH4pv.m8H4pe-pkLAH4pv.m8H4pe-pkLAH4pv./.m8H4pe-pkLAH4pv.656.p.m8H4pe-pkLAH4pvIZXqzZXq.656.
  • http://a.{BLOCKED}4pv.m8h4-pklah4pv.m8h4-pklah4pviqzhiqzh.m8h4-pklah4pvam8h4-pklah4pva.m8h4-pklah4pvi.m8h4-pklah4pv.656.-.m8h4-pklah4pv.m8h4-pklah4pv//H6e-.m8H4-pkLAH4pv.m8H4-pkLAH4pv.m8H4-pkLAH4pv.m8H4-pkLAH4pv./.m8H4-pkLAH4pv.656.p.m8H4-pkLAH4pvIqzq.656.
  • http://a0.{BLOCKED}lah4pe40.m8h4pe-pklah4pe40.m8h4pe-pklah4pe4ivzxqzhivzxqzh0.m8h4pe-pklah4pe4vzxp8va.0.m8h4pe-pklah4pe4a0.m8h4pe-pklah4pe4i0.m8h4pe-pklah4pe4.g56.-0.m8h4pe-pklah4pe40.m8h4pe-pklah4pe4/..H0..ge-0.m8H4pe-pkLAH4pe40.m8H4pe-pkLAH4pe40.m8H4pe-pkLAH4pe40.m8H4pe-pkLAH4pe4./0.m8H4pe-pkLAH4pe4.g56.p0.m8H4pe-pkLAH4pe4IVZXqzVZXq.g56.
  • http://a0.{BLOCKED}lah4pe40.m8h4pe-pklah4pe40.m8h4pe-pklah4pe4izxqzhizxqzh0.m8h4pe-pklah4pe4zxp8a.0.m8h4pe-pklah4pe4a0.m8h4pe-pklah4pe4i0.m8h4pe-pklah4pe4.g56.-0.m8h4pe-pklah4pe40.m8h4pe-pklah4pe4/..H0..ge-0.m8H4pe-pkLAH4pe40.m8H4pe-pkLAH4pe40.m8H4pe-pkLAH4pe40.m8H4pe-pkLAH4pe4./0.m8H4pe-pkLAH4pe4.g56.p0.m8H4pe-pkLAH4pe4IZXqzZXq.g56.
  • http://a0.{BLOCKED}klah4poe40.m8h4poe-pklah4poe40.m8h4poe-pklah4poe4oivzxqzhivzxqzh0.m8h4poe-pklah4poe4vzxp8vat8.0.m8h4poe-pklah4poe4a0.m8h4poe-pklah4poe4i0.m8h4poe-pklah4poe4.g56.-0.m8h4poe-pklah4poe40.m8h4poe-pklah4poe4/.T8./.T8.H0..ge-0.m8H4pOe-pkLAH4pOe40.m8H4pOe-pkLAH4pOe40.m8H4pOe-pkLAH4pOe40.m8H4pOe-pkLAH4pOe4T8./0.m8H4pOe-pkLAH4pOe4.g56.p0.m8H4pOe-pkLAH4pOe4IVZXqzVZXq.g56.
  • http://azxqdse.ds.m8h4-pklah4pviqzhiqzh.{BLOCKED}klah4pvds.m8h4-pklah4pvdseiqdseqdse.m8h4-pklah4pvpqdseqdse.m8h4-pklah4pv85ds.p.dsp/
  • http://bx88-oakl8-8-w.5.ptiz5.{BLOCKED}oakl8-8-wbx88-oakl8-8-w8-bx88-oakl8-8-wt.tizbx88-oakl8-8-w-/BXc
  • http://{BLOCKED}akl8-8-wbx88-oakl8-8-wibx88-oakl8-8-wbx88-oakl8-8-wh.5bx88-oakl8-8-wbx88-oakl8-8-wbx88-oakl8-8-wbx88-oakl8-8-w./
  • http://{BLOCKED}akl8-8-wbx88-oakl8-8-wiqzhiqzhbx88-oakl8-8-w.-bx88-oakl8-8-wbx88-oakl8-8-wiqzhiqzhbx88-8-w.5.8-5m88-oakl8-8-w8-.8-8-iqzq.5./
  • http://{BLOCKED}akl8-8-wbx88-oakl8-8-wiqzhiqzhbx88-oakl8-8-w.-bx88-oakl8-8-wbx88-oakl8-8-wiqzhiqzhbx88-oakl8-8-w.5.vbx88-oakl8-8-w.q-.-i.-tp/
  • http://{BLOCKED}pkl8-8-w.5.ptiz5.tbx88--pkl8-8-wbx88--pkl8-8-w8-bx88--pkl8-8-wt.tizbx88--pkl8-8-w-/BXc
  • http://{BLOCKED}pkl8-8-wbx88--pkl8-8-wibx88--pkl8-8-wbx88--pkl8-8-wh.5bx88--pkl8-8-wbx88--pkl8-8-wbx88--pkl8-8-wbx88--pkl8-8-w./
  • http://{BLOCKED}pkl8-8-wbx88--pkl8-8-wiqzhiqzhbx88--pkl8-8-w.-bx88--pkl8-8-wbx88--pkl8-8-wiqzhiqzhbx88-8-w.5.8-5m88--pkl8-8-w8-.8-8-iqzq.5./
  • http://{BLOCKED}pkl8-8-wbx88--pkl8-8-wiqzhiqzhbx88--pkl8-8-w.-bx88--pkl8-8-wbx88--pkl8-8-wiqzhiqzhbx88--pkl8-8-w.5.vbx88--pkl8-8-w.q-.-i.-tp/
  • http://{BLOCKED}pklpiepie1bx8pie-pklpiepie1iqzhiqzhbx8pie-pklpiepie1.dsebx8pie-pklpiepie1bx8pie-pklpiepie1iqzhiqzhbx8piepie1.ds5ds.pieds5dsm8pie-pklpiepie1pie.piepieiqzq.ds5ds./
  • http://{BLOCKED}pklpiepie1bx8pie-pklpiepie1iqzhiqzhbx8pie-pklpiepie1.dsebx8pie-pklpiepie1bx8pie-pklpiepie1iqzhiqzhbx8pie-pklpiepie1.ds5ds.vbx8pie-pklpiepie1.qdseds.-i.-tp/
  • http://{BLOCKED}pklpi-pi-w.5.ptiz5.tbx8pi--pklpi-pi-wbx8pi--pklpi-pi-wpi-bx8pi--pklpi-pi-wt.tizbx8pi--pklpi-pi-w-/BXc
  • http://{BLOCKED}pklpi-pi-wbx8pi--pklpi-pi-wiqzhiqzhbx8pi--pklpi-pi-w.-bx8pi--pklpi-pi-wbx8pi--pklpi-pi-wiqzhiqzhbx8pi-pi-w.5.pi-5m8pi--pklpi-pi-wpi-.pi-pi-iqzq.5./
  • http://{BLOCKED}pklpi-pi-wbx8pi--pklpi-pi-wiqzhiqzhbx8pi--pklpi-pi-w.-bx8pi--pklpi-pi-wbx8pi--pklpi-pi-wiqzhiqzhbx8pi--pklpi-pi-w.5.vbx8pi--pklpi-pi-w.q-.-i.-tp/
  • http://{BLOCKED}pklpiupiu1.5.ptiz5.tbx8piu-pklpiupiu1bx8piu-pklpiupiu1piubx8piu-pklpiupiu1t.tizbx8piu-pklpiupiu1u/BXc
  • http://{BLOCKED}pklpiupiu1bx8piu-pklpiupiu1iqzhiqzhbx8piu-pklpiupiu1.ubx8piu-pklpiupiu1bx8piu-pklpiupiu1iqzhiqzhbx8piupiu1.5.piu5m8piu-pklpiupiu1piu.piupiuiqzq.5./
  • http://{BLOCKED}pklpiupiu1bx8piu-pklpiupiu1iqzhiqzhbx8piu-pklpiupiu1.ubx8piu-pklpiupiu1bx8piu-pklpiupiu1iqzhiqzhbx8piu-pklpiupiu1.5.vbx8piu-pklpiupiu1.qu.-i.-tp/
  • http://{BLOCKED}pklpiupiuw.5.ptiz5.tbx8piu-pklpiupiuwbx8piu-pklpiupiuwpiubx8piu-pklpiupiuwt.tizbx8piu-pklpiupiuwu/BXc
  • http://{BLOCKED}pklpiupiuwbx8piu-pklpiupiuwiqzhiqzhbx8piu-pklpiupiuw.ubx8piu-pklpiupiuwbx8piu-pklpiupiuwiqzhiqzhbx8piupiuw.5.piu5m8piu-pklpiupiuwpiu.piupiuiqzq.5./
  • http://{BLOCKED}pklpiupiuwbx8piu-pklpiupiuwiqzhiqzhbx8piu-pklpiupiuw.ubx8piu-pklpiupiuwbx8piu-pklpiupiuwiqzhiqzhbx8piu-pklpiupiuw.5.vbx8piu-pklpiupiuw.qu.-i.-tp/
  • http://{BLOCKED}klpnpn1.ds5ds.ptdsizds5ds.dstdsdsbx8pn-pklpnpn1bx8pn-pklpnpn1pnbx8pn-pklpnpn1dstdsds.tdsizbx8pn-pklpnpn1dse/BXc
  • http://{BLOCKED}klpnpn1bx8pn-pklpnpn1ibx8pn-pklpnpn1bx8pn-pklpnpn1h.ds5dsbx8pn-pklpnpn1bx8pn-pklpnpn1bx8pn-pklpnpn1bx8pn-pklpnpn1./
  • http://{BLOCKED}klpnpn1bx8pn-pklpnpn1iqzhiqzhbx8pn-pklpnpn1.dsebx8pn-pklpnpn1bx8pn-pklpnpn1iqzhiqzhbx8pn-pklpnpn1.ds5ds.vbx8pn-pklpnpn1.qdseds.-i.-tp/
  • http://{BLOCKED}klpnpn1bx8pn-pklpnpn1iqzhiqzhbx8pn-pklpnpn1.dsebx8pn-pklpnpn1bx8pn-pklpnpn1iqzhiqzhbx8pnpn1.ds5ds.pnds5dsm8pn-pklpnpn1pn.pnpniqzq.ds5ds./
  • http://{BLOCKED}oaklsx-sx-w.5.ptiz5.tbxsxsx-oaklsx-sx-wbxsxsx-oaklsx-sx-wsx-bxsxsx-oaklsx-sx-wt.tizbxsxsx-oaklsx-sx-w-/BXc
  • http://{BLOCKED}oaklsx-sx-wbxsxsx-oaklsx-sx-wiqzhiqzhbxsxsx-oaklsx-sx-w.-bxsxsx-oaklsx-sx-wbxsxsx-oaklsx-sx-wiqzhiqzhbxsxsx-oaklsx-sx-w.5.vbxsxsx-oaklsx-sx-w.q-.-i.-tp/
  • http://{BLOCKED}oaklsx-sx-wbxsxsx-oaklsx-sx-wiqzhiqzhbxsxsx-oaklsx-sx-w.-bxsxsx-oaklsx-sx-wbxsxsx-oaklsx-sx-wiqzhiqzhbxsxsx-sx-w.5.sx-5msxsx-oaklsx-sx-wsx-.sx-sx-iqzq.5./
  • http://gh.{BLOCKED}klah4pv.m8h4-pklah4pviqzhiqzh.m8h4-pklah4pv.dse.m8h4-pklah4pv.m8h4-pklah4pviqzhiqzh.m8h4-pklah4pv.ds5ds.v.m8h4-pklah4pv.qdseds.-i.-tp/
  • http://i.zx.656.a6e.{BLOCKED}-pklah4pv.m8h4pe-pklah4pv.zxq6e6.ph.h.-.m8h4pe-pklah4pv.m8h4pe-pklah4pv//.m8H4pe-pkLAH4pv.m8H4pe-pkLAH4pv.m8H4pe-pkLAH4pvA.At
  • http://iq-.{BLOCKED}8-8-wiqzhiqzhbx88-oakl8-8-wq-.ibx88-oakl8-8-wiqzhipq-h85.p85.pp/
  • http://iq-.{BLOCKED}8-8-wiqzhiqzhbx88--pkl8-8-wq-.ibx88--pkl8-8-wiqzhipq-h85.p85.pp/
  • http://iq-.{BLOCKED}lpi-pi-wiqzhiqzhbx8pi--pklpi-pi-wq-.ibx8pi--pklpi-pi-wiqzhipq-h85.p85.pp/
  • http://iq-.{BLOCKED}klsx-sx-wiqzhiqzhbxsxsx-oaklsx-sx-wq-.ibxsxsx-oaklsx-sx-wiqzhipq-hsx5.psx5.pp/
  • http://iq6e.i.{BLOCKED}pklah4pviqzhiqzh.m8h4pe-pklah4pv6q6e.i.m8h4pe-pklah4pviqzhipq6eh856.p856.pp/
  • http://iq6e.i.{BLOCKED}lah4pviqzhiqzh.m8h4-pklah4pv6q6e.i.m8h4-pklah4pviqzhipq6eh856.p856.pp/
  • http://iqdse.i.{BLOCKED}laa1iqzhiqzh.m8a-pklaa1dsqdse.i.m8a-pklaa1iqzhipqdseh85ds.p85ds.pp/
  • http://iqdse.i.{BLOCKED}laapviqzhiqzh.m8a-pklaapvdsqdse.i.m8a-pklaapviqzhipqdseh85ds.p85ds.pp/
  • http://iqdse.i.{BLOCKED}klah4pviqzhiqzh.m8h4-pklah4pvdsqdse.i.m8h4-pklah4pviqzhipqdseh85ds.p85ds.pp/
  • http://iqdse.i.{BLOCKED}klpnpn1iqzhiqzh.m8pn-pklpnpn1dsqdse.i.m8pn-pklpnpn1iqzhipqdseh85ds.p85ds.pp/
  • http://iqdse.ib{BLOCKED}pklpiepie1iqzhiqzhbx8pie-pklpiepie1dsqdse.ibx8pie-pklpiepie1iqzhipqdseh85ds.p85ds.pp/
  • http://iqdse.ib{BLOCKED}klpnpn1iqzhiqzhbx8pn-pklpnpn1dsqdse.ibx8pn-pklpnpn1iqzhipqdseh85ds.p85ds.pp/
  • http://iqdsu7.{BLOCKED}7-pklpiu7piu71iqzhiqzhbx8piu7-pklpiu7piu71dsqdsu7.ibx8piu7-pklpiu7piu71iqzhipqdsu7h85ds.p85ds.pp/
  • http://iqu.{BLOCKED}lpiupiu1iqzhiqzhbx8piu-pklpiupiu1qu.ibx8piu-pklpiupiu1iqzhipquh85.p85.pp/
  • http://iqu.{BLOCKED}lpiupiuwiqzhiqzhbx8piu-pklpiupiuwqu.ibx8piu-pklpiupiuwiqzhipquh85.p85.pp/
  • http://iqu7.{BLOCKED}pklpiu7piu71iqzhiqzhbx8piu7-pklpiu7piu71qu7.ibx8piu7-pklpiu7piu71iqzhipqu7h85.p85.pp/
  • http://izxq6e.i.{BLOCKED}-pklah4pvizxqzhizxqzh.m8h4pe-pklah4pv6zxq6e.i.m8h4pe-pklah4pvizxqzhipzxq6eh856.p856.pzxp/
  • http://pn.{BLOCKED}klpnpn1.m8pn-pklpnpn1.m8pn-pklpnpn1iqzhiqzh.m8pn-pklpnpn1pnm8pnpklpnpn1//.ds5ds.p.m8PN-pkLPNPN1Iqzq.ds5ds.
  • http://{BLOCKED}x88-oakl8-8-wbx88-oakl8-8-w8-bx88-oakl8-8-w.-/IBX88-OAkL8-8-W.5.IBXOAkL8-8-WH.5.8-5..-
  • http://{BLOCKED}x88--pkl8-8-wbx88--pkl8-8-w8-bx88--pkl8-8-w.-/IBX88--pkL8-8-W.5.IBX-pkL8-8-WH.5.8-5..-
  • http://pza6e.{BLOCKED}-pklah4pv.m8h4pe-pklah4pva.m8h4pe-pklah4pv.6e/I.m8H4pe-pkLAH4pv.656.I.m8H4pe-pkLAH4pv.656.A656.6656m8H4pe-pkLAH4pv.m8H4pe-pkLAH4pvH.m8H4pe-pkLAH4pvH.656.A656.6.6e
  • http://pza6e.{BLOCKED}-pklah4pv.m8h4pe-pklah4pva.m8h4pe-pklah4pv.6e/I.m8H4pe-pkLAH4pv.656.I.m8H4pe-pkLAH4pv.656.A656.6656m8H4pe-pkLAH4pv.m8H4pe-pkLAH4pvH.m8H4pe-pkLAH4pvH.656.A656.6.ZX6e
  • http://pza6e.{BLOCKED}klah4pv.m8h4-pklah4pva.m8h4-pklah4pv.6e/I.m8H4-pkLAH4pv.656.I.m8H4-pkLAH4pv.656.A656.6656m8H4-pkLAH4pv.m8H4-pkLAH4pvH.m8H4-pkLAH4pvH.656.A656.6.6e
  • http://pzadse.{BLOCKED}aa1.m8a-pklaa1a.m8a-pklaa1.dse/I.m8a-pkLAa1.ds5ds.I.m-pkLAa1H.ds5ds.Ads5ds.ds.dse
  • http://pzadse.{BLOCKED}aapv.m8a-pklaapva.m8a-pklaapv.dse/I.m8a-pkLAapv.ds5ds.I.m-pkLAapvH.ds5ds.Ads5ds.ds.dse
  • http://{BLOCKED}bx8pi--pklpi-pi-wbx8pi--pklpi-pi-wpi-bx8pi--pklpi-pi-w.-/IBX8PI--pkLPI-PI-W.5.IBX-pkLPI-PI-WH.5.PI-5..-
  • http://{BLOCKED}sebx8pie-pklpiepie1bx8pie-pklpiepie1piebx8pie-pklpiepie1.dse/IBX8PIE-pkLPIEPIE1.ds5ds.IBX-pkLPIEPIE1H.ds5ds.PIEds5ds.ds.dse
  • http://{BLOCKED}bx8piu-pklpiupiu1bx8piu-pklpiupiu1piubx8piu-pklpiupiu1.u/IBX8PIU-pkLPIUPIU1.5.IBX-pkLPIUPIU1H.5.PIU5..U
  • http://{BLOCKED}bx8piu-pklpiupiuwbx8piu-pklpiupiuwpiubx8piu-pklpiupiuw.u/IBX8PIU-pkLPIUPIUW.5.IBX-pkLPIUPIUWH.5.PIU5..U
  • http://pzpndse.{BLOCKED}klpnpn1.m8pn-pklpnpn1pn.m8pn-pklpnpn1.dse/I.m8PN-pkLPNPN1.ds5ds.I.m-pkLPNPN1H.ds5ds.PNds5ds.ds.dse
  • http://{BLOCKED}ebx8pn-pklpnpn1bx8pn-pklpnpn1pnbx8pn-pklpnpn1.dse/IBX8PN-pkLPNPN1.ds5ds.IBX-pkLPNPN1H.ds5ds.PNds5ds.ds.dse
  • http://{BLOCKED}bxsxsx-oaklsx-sx-wbxsxsx-oaklsx-sx-wsx-bxsxsx-oaklsx-sx-w.-/IBXSXSX-OAkLSX-SX-W.5.IBXOAkLSX-SX-WH.5.SX-5..-
  • http://q6e.6.{BLOCKED}-pklah4pviqzhiqzh.m8h4pe-pklah4pv6.m8h4pe-pklah4pv6eiq6eq6e.m8h4pe-pklah4pv.66q6e.666e.66p./6I.656.
  • http://q6e.6.{BLOCKED}-pklah4pviqzhiqzh.m8h4pe-pklah4pv6.m8h4pe-pklah4pv6eiq6eq6e.m8h4pe-pklah4pvpq6eq6e.m8h4pe-pklah4pv856.p.6p/
  • http://q6e.6.{BLOCKED}klah4pviqzhiqzh.m8h4-pklah4pv6.m8h4-pklah4pv6eiq6eq6e.m8h4-pklah4pv.66q6e.666e.66p./6I.656.
  • http://q6e.6.{BLOCKED}klah4pviqzhiqzh.m8h4-pklah4pv6.m8h4-pklah4pv6eiq6eq6e.m8h4-pklah4pvpq6eq6e.m8h4-pklah4pv856.p.6p/
  • http://qdse.ds.m8a-pklaa1iqzhiqzh.{BLOCKED}ds.m8a-pklaa1dseiqdseqdse.m8a-pklaa1.dsdsqdse.dsdsdse.dsdsp./dsI.ds5ds.
  • http://qdse.ds.m8a-pklaa1iqzhiqzh.{BLOCKED}ds.m8a-pklaa1dseiqdseqdse.m8a-pklaa1pqdseqdse.m8a-pklaa185ds.p.dsp/
  • http://qdse.ds.m8a-pklaapviqzhiqzh.{BLOCKED}pvds.m8a-pklaapvdseiqdseqdse.m8a-pklaapv.dsdsqdse.dsdsdse.dsdsp./dsI.ds5ds.
  • http://qdse.ds.m8a-pklaapviqzhiqzh.{BLOCKED}pvds.m8a-pklaapvdseiqdseqdse.m8a-pklaapvpqdseqdse.m8a-pklaapv85ds.p.dsp/
  • http://qdse.ds.m8pn-pklpnpn1iqzhiqzh.{BLOCKED}lpnpn1ds.m8pn-pklpnpn1dseiqdseqdse.m8pn-pklpnpn1.dsdsqdse.dsdsdse.dsdsp./dsI.ds5ds.
  • http://qdse.ds.m8pn-pklpnpn1iqzhiqzh.{BLOCKED}lpnpn1ds.m8pn-pklpnpn1dseiqdseqdse.m8pn-pklpnpn1pqdseqdse.m8pn-pklpnpn185ds.p.dsp/
  • http://qfdsddeedse.ds.{BLOCKED}lah4pviqzhiqzh.m8h4-pklah4pvds.m8h4-pklah4pvdseiqdseqdse.m8h4-pklah4pv.dsdsqdse.dsdsdse.dsdsp./dsI.ds5ds.
  • http://rrt.m8h4-pklah4pv.{BLOCKED}lah4pviqzhiqzh.m8h4-pklah4pv.dse.m8h4-pklah4pv.m8h4-pklah4pviqzhiqzh.m8h4h4pv.ds5ds.ads5dsm8h4-pklah4pva.aaiqzq.ds5ds./
  • http://ttpzadse.m8h4-pklah4pv.{BLOCKED}lah4pva.m8h4-pklah4pv.dse/I.m8H4-pkLAH4pv.ds5ds.I.m-pkLAH4pvH.ds5ds.Ads5ds.ds.dse
  • http://vmd.m8h4-pklah4pv.{BLOCKED}h4pvi.m8h4-pklah4pv.m8h4-pklah4pva.m8h4-pklah4pv4-pklah4pv./Hdse-.m8H4-pkLAH4pv.m8H4-pkLAH4pv.m8H4-pkLAH4pv.m8H4-pkLAH4pv.
  • http://vsmd.m8h4-pklah4pv.{BLOCKED}ah4pvi.m8h4-pklah4pv.m8h4-pklah4pvh.ds5ds.m8h4-pklah4pv.m8h4-pklah4pv.m8h4-pklah4pv.m8h4-pklah4pv./
  • http://zxq6e.6.{BLOCKED}pklah4pvizxqzhizxqzh.m8h4pe-pklah4pv6.m8h4pe-pklah4pv6eizxq6ezxq6e.m8h4pe-pklah4pv.66zxq6e.666e.66zxp./6I.656.
  • http://zxq6e.6.{BLOCKED}pklah4pvizxqzhizxqzh.m8h4pe-pklah4pv6.m8h4pe-pklah4pv6eizxq6ezxq6e.m8h4pe-pklah4pvzxpzxq6ezxq6e.m8h4pe-pklah4pv856.p.6p/

  SOLUTION

Minimum Scan Engine: 9.850
FIRST VSAPI PATTERN FILE: 14.188.02
FIRST VSAPI PATTERN DATE: 13 Apr 2018
VSAPI OPR PATTERN File: 14.189.00
VSAPI OPR PATTERN Date: 14 Apr 2018

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Scan your computer with your Trend Micro product to delete files detected as JS_URSNIF.TIBOAL. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:


Did this description help? Tell us how we did.