Analysis report for http://cahillappraisal.com/main/?go
Sample Overview
| URL | http://cahillappraisal.com/main/?go |
|---|---|
| MD5 | 6216bb8d6c5b92514b604a682dc6e717 |
| Analysis Started | 2010-02-08 13:06:36 |
| Report Generated | 2010-02-08 13:09:33 |
| Jsand version | 1.03.02 |
See the report for domain cahillappraisal.com.
Detection results
| Detector | Result |
|---|---|
| Jsand 1.03.02 | suspicious |
This resource appears to be involved in the Koobface malware campaign.
Exploits
No exploits were identified.Deobfuscation results
Evals
- (repeated 1 time)
document.referrer
- (repeated 2 times)
window.redirect
- (repeated 1 time)
location.href
- (repeated 1 time)
location.search
- (repeated 1 time)
window.location.href = window.redirect;
- (repeated 1 time)
window.attachEvent('onunload', exiter);
Writes
- (repeated 1 time)
<OBJECT id="iie" width="0" height="0" style="position:absolute; left:0;top:0;" CLASSID= "CLSID:6BF52A52-394A-11d3-B153-00C04F79FAA6" type="application/x-oleobject"> <PARAM NAME= "SendPlayStateChangeEvents" VALUE="True"> <PARAM NAME="AutoStart" VALUE="True"> <PARAM name="uiMode" value="none"> <PARAM name="PlayCount" value="9999"></OBJECT>
Network Activity
Requests
| URL | Status | Content Type |
|---|---|---|
| http://cahillappraisal.com/main/?go | 200 | text/javascript |
| http://84.108.161.210/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://99.97.213.86/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://62.249.102.53/go.js?0x3E8/view/console=yes/?go | Timeout | application/x-empty |
| http://109.64.20.44/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://123.237.77.227/go.js?0x3E8/view/console=yes/?go | Timeout | application/x-empty |
| http://76.107.49.253/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://221.127.121.19/go.js?0x3E8/view/console=yes/?go | Timeout | application/x-empty |
| http://98.235.240.245/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://87.70.30.107/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://67.222.193.209/go.js?0x3E8/view/console=yes/?go | Timeout | application/x-empty |
| http://87.70.83.177/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://77.124.229.239/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://87.68.59.244/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://84.109.187.111/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://24.181.21.190/go.js?0x3E8/view/console=yes/?go | 200 | text/javascript |
| http://24.181.21.190/d=cahillappraisal.com/0x3E8/view/console=yes/?go | 200 | text/html |
| http://24.181.21.190/d=cahillappraisal.com/0x3E8/view/console=yes/player.swf?pid=6123 | 200 | application/x-shockwave-flash |
Redirects
No redirects.ActiveX controls
-
6BF52A52-394A-11D3-B153-00C04F79FAA6 Name Arg0 Count Methods launchURL http://pablopicassosite.com/?pid=312s02&sid=4db12f
1 http://24.181.21.190/d=cahillappraisal.com/0x3E8/view/console=yes/?go
1 Name Value Count Attributes PlayCount 9999
1 uiMode none
1 AutoStart True
1 SendPlayStateChangeEvents True
1 -
D27CDB6E-AE6D-11CF-96B8-444553540000 Name Value Count Attributes bgcolor #000000
1 movie player.swf?pid=6123
1 allowScriptAccess sameDomain
1 allowFullScreen false
1 menu false
1 quality high
1
Shellcode and Malware
No shellcode was identified.
Additional (potential) malware:
| URL | Type | Hash | Analysis |
|---|---|---|---|
| http://24.181.21.190/d=cahillappraisal.com/0x3E8/view/console=yes/?go | N/A | N/A |
|
| http://pablopicassosite.com/?pid=312s02&sid=4db12f | N/A | N/A |
|