Wepawet (alpha)

Home | About | Sample Reports | Support | News

Analysis report for http://marylenerother.blogspot.com/

Sample Overview

URL	http://marylenerother.blogspot.com/
MD5	7d6cce317e9a5a63a49b0f9e8e639e77
Analysis Started	2010-01-31 22:37:14
Report Generated	2010-01-31 22:37:39
Jsand version	1.03.02

See the report for domain marylenerother.blogspot.com.

Detection results

Detector	Result
Jsand 1.03.02	suspicious

This resource appears to be involved in the Koobface malware campaign.

Exploits

No exploits were identified.

Deobfuscation results

Evals

• document.referrer
  

  (repeated 2 times)

• window.redirect
  

  (repeated 2 times)

• location.href
  

  (repeated 1 time)

• location.search
  

  (repeated 1 time)

• window.location.href = window.redirect;
  

  (repeated 1 time)

• window.attachEvent('onunload', exiter);
  

  (repeated 1 time)

Writes

• <OBJECT id="iie" width="0" height="0" style="position:absolute; left:0;top:0;" CLASSID=
  "CLSID:6BF52A52-394A-11d3-B153-00C04F79FAA6" type="application/x-oleobject"> <PARAM NAME=
  "SendPlayStateChangeEvents" VALUE="True"> <PARAM NAME="AutoStart" VALUE="True">	<PARAM name="uiMode"
   value="none"> <PARAM name="PlayCount" value="9999"></OBJECT>
  

  (repeated 1 time)

Network Activity

Requests

URL	Status	Content Type
http://marylenerother.blogspot.com/	200	text/html
http://www.herangi.com/main/?go	200	text/javascript
http://75.75.42.202/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://209.169.109.40/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://24.5.253.59/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://109.64.8.65/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://89.138.9.59/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://85.64.50.152/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://96.231.223.38/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://89.138.152.206/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://76.247.132.82/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://84.110.141.98/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://84.109.232.102/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://98.233.216.119/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://76.249.24.112/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://75.65.141.17/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://109.66.11.75/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://76.117.45.44/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://67.167.199.159/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://69.229.27.73/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://99.227.172.21/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://93.172.193.116/go.js?0x3E8/view/console=yes/?go	200	text/javascript
about:blank	200	text/html
http://93.172.193.116/d=www.herangi.com/0x3E8/view/console=yes/?go	200	text/html
http://93.172.193.116/d=www.herangi.com/0x3E8/view/console=yes/player.swf?pid=6123	200	application/x-shockwave-flash

Redirects

No redirects.

ActiveX controls

• 6BF52A52-394A-11D3-B153-00C04F79FAA6
  	Name	Arg0	Count
  Methods	launchURL	http://coloradowin.com/?pid=312s02&sid=4db12f	1
  		http://93.172.193.116/d=www.herangi.com/0x3E8/view/console=yes/?go	1
  	Name	Value	Count
  Attributes	PlayCount	9999	1
  	uiMode	none	1
  	AutoStart	True	1
  	SendPlayStateChangeEvents	True	1

• D27CDB6E-AE6D-11CF-96B8-444553540000
  	Name	Value	Count
  Attributes	bgcolor	#000000	1
  	movie	player.swf?pid=6123	1
  	allowScriptAccess	sameDomain	1
  	allowFullScreen	false	1
  	menu	false	1
  	quality	high	1

Shellcode and Malware

No shellcode was identified.

Additional (potential) malware:

URL	Type	Hash	Analysis
http://93.172.193.116/d=www.herangi.com/0x3E8/view/console=yes/?go	N/A	N/A
http://coloradowin.com/?pid=312s02&sid=4db12f	N/A	N/A

© 2008–2010 UCSB Computer Security Lab