Online Trojan analysis-malicious code implanted in the blizzard player Forum

Author:Mir-lin@126.com (chulin)

Source: jianmeng
Website address:Http://bngamer.com/bbs
Trojan: Malicious JS scripts are embedded near the bottom of the page.


This JS. Framework is switchedHttp://x1.315666.net/m10.html? Bng
However, x1.315666.net has been blocked by the anti-Black HOSTS of this site. It has been blocked twice ..

Http://x1.315666.net/news.html..8Hexadecimal encryption.
Http://user1.33220.net/ms06014.js
Http://user1.33220.net/Thunder.html
Http://user1.33220.net/GLWORLD.html
Http://user1.33220.net/StormII.html
Http://user1.33220.net/Real.html
Http://user1.33220.net/real.js
Http://user1.33220.net/Baidu.cab

Download allHttp://user1.33220.net/bak.css

User1.332w.net, which has not been blocked ..

... No vulnerability that caused my poisoning... continue to explore ING...