Wepawet (alpha)

Home | About | Sample Reports | Support | News

Analysis report for http://online-doors.co.uk/video/?go

Sample Overview

URL	http://online-doors.co.uk/video/?go
MD5	4b86a3cf56f7019c4f8579c1f894b5bb
Analysis Started	2010-02-01 01:44:47
Report Generated	2010-02-01 01:45:25
Jsand version	1.03.02

See the report for domain online-doors.co.uk.

Detection results

Detector	Result
Jsand 1.03.02	suspicious

This resource appears to be involved in the Koobface malware campaign.

Exploits

No exploits were identified.

Deobfuscation results

Evals

• document.referrer
  

  (repeated 1 time)

• window.redirect
  

  (repeated 2 times)

• location.href
  

  (repeated 1 time)

• location.search
  

  (repeated 1 time)

• window.location.href = window.redirect;
  

  (repeated 1 time)

• window.attachEvent('onunload', exiter);
  

  (repeated 1 time)

Writes

• <OBJECT id="iie" width="0" height="0" style="position:absolute; left:0;top:0;" CLASSID=
  "CLSID:6BF52A52-394A-11d3-B153-00C04F79FAA6" type="application/x-oleobject"> <PARAM NAME=
  "SendPlayStateChangeEvents" VALUE="True"> <PARAM NAME="AutoStart" VALUE="True">	<PARAM name="uiMode"
   value="none"> <PARAM name="PlayCount" value="9999"></OBJECT>
  

  (repeated 1 time)

Network Activity

Requests

URL	Status	Content Type
http://online-doors.co.uk/video/?go	200	text/javascript
http://173.93.242.156/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://99.53.156.66/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://77.124.125.243/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://87.69.56.143/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://77.106.138.128/go.js?0x3E8/view/console=yes/?go	Timeout	application/x-empty
http://97.96.199.84/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://77.127.140.135/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://68.202.8.241/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://68.190.35.127/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://77.126.239.3/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://85.130.10.28/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://97.95.134.150/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://97.96.232.201/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://180.131.238.240/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://97.85.144.175/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://66.31.50.208/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://95.86.65.183/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://77.127.219.236/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://77.124.97.210/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://76.75.114.49/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://76.75.114.49/d=online-doors.co.uk/0x3E8/view/console=yes/?go	200	text/html
http://76.75.114.49/d=online-doors.co.uk/0x3E8/view/console=yes/player.swf?pid=6123	200	application/x-shockwave-flash

Redirects

No redirects.

ActiveX controls

• 6BF52A52-394A-11D3-B153-00C04F79FAA6
  	Name	Arg0	Count
  Methods	launchURL	http://shanghaiwebcamera.com/?pid=312s02&sid=4db12f	1
  		http://76.75.114.49/d=online-doors.co.uk/0x3E8/view/console=yes/?go	1
  	Name	Value	Count
  Attributes	PlayCount	9999	1
  	uiMode	none	1
  	AutoStart	True	1
  	SendPlayStateChangeEvents	True	1

• D27CDB6E-AE6D-11CF-96B8-444553540000
  	Name	Value	Count
  Attributes	bgcolor	#000000	1
  	movie	player.swf?pid=6123	1
  	allowScriptAccess	sameDomain	1
  	allowFullScreen	false	1
  	menu	false	1
  	quality	high	1

Shellcode and Malware

No shellcode was identified.

Additional (potential) malware:

URL	Type	Hash	Analysis
http://76.75.114.49/d=online-doors.co.uk/0x3E8/view/console=yes/?go	N/A	N/A
http://shanghaiwebcamera.com/?pid=312s02&sid=4db12f	N/A	N/A

© 2008–2010 UCSB Computer Security Lab