JS_BLACOLE.SMVY
ALIASES:
Trojan:JS/BlacoleRef.DH (Microsoft), JS/Exploit-Blacole.le (McAfee), JS/Blacole.DH.2 (Antivir), JS/IFrame.SY (F-Prot), Trojan.JS.BlacoleRef (Ikarus)
PLATFORM:
Windows 2000, Windows XP, Windows Server 2003
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan executes when a user accesses certain websites where it is hosted.
It inserts an IFRAME tag that redirects users to certain URLs.
TECHNICAL DETAILS
File Size: Varies
File Type: HTML, HTM
Memory Resident: No
Initial Samples Received Date: 24 Jun 2013
Arrival Details
This Trojan executes when a user accesses certain websites where it is hosted.
Other Details
This Trojan inserts an IFRAME tag that redirects users to the following URLs:
- http://www.{BLOCKED}le.co.za/picture_library/count.php
- http://www.{BLOCKED}ackersandmovers.com/css-js/cnt.php
- http://{BLOCKED}a.net/clik.php
- http://{BLOCKED}a.net/clik.php
- http://{BLOCKED}ss.sakura.ne.jp/Templates/traf.php
- http://{BLOCKED}yfit.com/cnt.php
- http://{BLOCKED}floorballbund.net/vqjcwCpP.php
- http://{BLOCKED}ijd.com/esd.php
- http://www.{BLOCKED}raft.phichit1.go.th/skn/nNxC8VMz.php
- http://www.{BLOCKED}csa.net/documents/clk.php
- http://www.{BLOCKED}nweb.com/lib/counter.php