Analysis report for http://gxf.co.il/index.php/?go
Sample Overview
| URL | http://gxf.co.il/index.php/?go |
|---|---|
| MD5 | 1d1fb480595d2d48d4f152b941182c63 |
| Analysis Started | 2010-02-08 13:06:10 |
| Report Generated | 2010-02-08 13:08:03 |
| Jsand version | 1.03.02 |
See the report for domain gxf.co.il.
Detection results
| Detector | Result |
|---|---|
| Jsand 1.03.02 | suspicious |
This resource appears to be involved in the Koobface malware campaign.
Exploits
No exploits were identified.Deobfuscation results
Evals
- (repeated 1 time)
document.referrer
- (repeated 2 times)
window.redirect
- (repeated 1 time)
location.href
- (repeated 1 time)
location.search
- (repeated 1 time)
window.location.href = window.redirect;
- (repeated 1 time)
window.attachEvent('onunload', exiter);
Writes
- (repeated 1 time)
<OBJECT id="iie" width="0" height="0" style="position:absolute; left:0;top:0;" CLASSID= "CLSID:6BF52A52-394A-11d3-B153-00C04F79FAA6" type="application/x-oleobject"> <PARAM NAME= "SendPlayStateChangeEvents" VALUE="True"> <PARAM NAME="AutoStart" VALUE="True"> <PARAM name="uiMode" value="none"> <PARAM name="PlayCount" value="9999"></OBJECT>
Network Activity
Requests
| URL | Status | Content Type |
|---|---|---|
| http://gxf.co.il/index.php/?go | 200 | text/javascript |
| http://75.76.238.38/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://99.182.90.49/go.js?0x3E8/view/console=yes/?go | Error | application/x-empty |
| http://76.26.220.66/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://174.49.98.133/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://93.172.165.162/go.js?0x3E8/view/console=yes/?go | Timeout | application/x-empty |
| http://95.26.30.236/go.js?0x3E8/view/console=yes/?go | Timeout | application/x-empty |
| http://67.242.96.3/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://89.138.240.62/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://84.110.111.94/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://68.42.247.223/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://85.250.177.106/go.js?0x3E8/view/console=yes/?go | Timeout | application/x-empty |
| http://74.76.244.119/go.js?0x3E8/view/console=yes/?go | Timeout | application/x-empty |
| http://77.126.8.110/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://24.9.152.97/go.js?0x3E8/view/console=yes/?go | Timeout | application/x-empty |
| http://79.176.66.245/go.js?0x3E8/view/console=yes/?go | Timeout | application/x-empty |
| http://77.126.8.110/d=gxf.co.il/0x3E8/view/console=yes/?go | 200 | text/html |
| http://77.126.8.110/d=gxf.co.il/0x3E8/view/console=yes/player.swf?pid=6123 | 200 | application/x-shockwave-flash |
Redirects
No redirects.ActiveX controls
-
6BF52A52-394A-11D3-B153-00C04F79FAA6 Name Arg0 Count Methods launchURL http://pablopicassosite.com/?pid=312s02&sid=4db12f
1 http://77.126.8.110/d=gxf.co.il/0x3E8/view/console=yes/?go
1 Name Value Count Attributes PlayCount 9999
1 uiMode none
1 AutoStart True
1 SendPlayStateChangeEvents True
1 -
D27CDB6E-AE6D-11CF-96B8-444553540000 Name Value Count Attributes bgcolor #000000
1 movie player.swf?pid=6123
1 allowScriptAccess sameDomain
1 allowFullScreen false
1 menu false
1 quality high
1
Shellcode and Malware
No shellcode was identified.
Additional (potential) malware:
| URL | Type | Hash | Analysis |
|---|---|---|---|
| http://77.126.8.110/d=gxf.co.il/0x3E8/view/console=yes/?go | N/A | N/A |
|
| http://pablopicassosite.com/?pid=312s02&sid=4db12f | N/A | N/A |
|