Wepawet

Analysis report for http://www.mediafire.com/error.php?errno=320

Sample Overview¶

URL	http://www.mediafire.com/error.php?errno=320
Domain	www.mediafire.com
Analysis Started	2012-09-07 09:55:57
Report Generated	2012-09-07 09:56:26
Jsand version	2.3.4

See the report for domain www.mediafire.com.

Detection results¶

Detector	Result
Jsand 2.3.4	benign

Exploits¶

No exploits were identified.

Deobfuscation results¶

Evals

No evals.

Writes

```
<div id="theToolTip"></div>
```
(repeated 1 time)

<script language="JavaScript" type="text/javascript"

(repeated 4 times)

src="http://optimized-by.rubiconproject.com/a/3196/3346/9685-9.js?cb=0.09066178955858661&fr=true">

(repeated 1 time)

```
</script>
```
(repeated 5 times)

<html><head>            <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">

            <meta http-equiv="Expires" content="Tue, 01 Jan 2000 12:12:12 GMT">
            <meta 
http-equiv="Pragma" content="no-cache">
    </head>
<body> <img src=
'http://207.198.109.206/rubicon/px/aid:73c88cfeff885fd47bb569cb3618478a640dc181;c:3A8582BA7D732D43;s
:594945ced662723a;cid:17775;ts:1347036966126' width=1 height=1 style=
"position: absolute; left: -150px;" />
<a href=
"http://clickserv.sitescout.com/clk/995c5a30529d2e81/e92afadf9edcf2b0/1-3346/2/www.mediafire.com%2Ft
emplates%2Flinkto%2Fdefault-161x601-default.php//" target="_blank">    <img src=
"http://dspads.sitescout.netdna-cdn.com/1900/1877/160-8183937.gif" alt="" border="0"></a> <img src=
"http://pixel.quantserve.com/pixel/p-01nD5uD1pGDW2.gif" border="0" height="1" width="1" style=
"display:none;"/></body></html>

(repeated 1 time)

<script type="text/javascript">oz_sensor_filter = "domain";
</script><script type="text/javascript" defer="defer" src=
"http://tap-cdn.rubiconproject.com/partner/scripts/rubicon/alice.js"></script><script>var _comscore = _comscore || [];
_comscore.push({
  c1 : "8", c2 : "6135404", c3 : "26", c4 : "3346", c10 : "3228680"
}
);
(function (){
  var s = document.createElement("script"), el = document.getElementsByTagName("script")[0
  ];
  s.async = true;
  s.src = (document.location.protocol == "https:" ? "https://sb" : "http://b") + 
  ".scorecardresearch.com/beacon.js";
  el.parentNode.insertBefore(s, el);
}
)();
</script><DIV 
STYLE="height:0px; width:0px; overflow:hidden"><IFRAME SRC=
"http://tap2-cdn.rubiconproject.com/partner/scripts/rubicon/emily.html?rtb_ext=1&pc=3196/3346&geo=na
&co=us" FRAMEBORDER="0" MARGINWIDTH="0" MARGINHEIGHT="0" SCROLLING="NO" WIDTH="0" HEIGHT="0" style=
"height:0px; width:0px"></IFRAME></DIV>

(repeated 1 time)

<script language="JavaScript" type="text/javascript">

(repeated 1 time)

```
var rp_account = "3196";
```
(repeated 1 time)
```
var rp_site = "3346";
```
(repeated 1 time)
```
var rp_zonesize = "9685-2";
```
(repeated 1 time)
```
var rp_adtype = "js";
```
(repeated 1 time)

var rp_smartfile = "http://www.mediafire.com/templates/ads/revv_smart_file.html";

(repeated 1 time)

src="http://ads.rubiconproject.com/ad/3196.js?cb=0.4663331058368708">

(repeated 1 time)

<script type="text/javascript" src=
"http://optimized-by.rubiconproject.com/a/3196/3346/9685-2.js?cb=0.5170936317843917&tk_st=1&tk_sf=1&
rf=http%3A//www.mediafire.com/error.php%3Ferrno%3D320"></script>

(repeated 1 time)

<!-- -------------- Advertising.com ------ Rubicon - Media Fire - MediaFire 728x90 CPM2 - 837333 -
 (728x90) ------------ -->
<script type='text/javascript'>var ACE_AR = {
  site : '837333', size : '728090'
}
;
</script>
<script type='text/javascript' 
SRC='http://uac.advertising.com/wrapper/aceUAC.js'></script>

<!-- ----------
 Copyright 2009, Advertising.com ---------- -->

(repeated 1 time)

<script type="text/javascript">oz_sensor_filter = "domain";
</script><script type="text/javascript" defer="defer" src=
"http://tap-cdn.rubiconproject.com/partner/scripts/rubicon/alice.js"></script><script>var _comscore = _comscore || [];
_comscore.push({
  c1 : "8", c2 : "6135404", c3 : "26", c4 : "3346", c10 : "3437281"
}
);
(function (){
  var s = document.createElement("script"), el = document.getElementsByTagName("script")[0
  ];
  s.async = true;
  s.src = (document.location.protocol == "https:" ? "https://sb" : "http://b") + 
  ".scorecardresearch.com/beacon.js";
  el.parentNode.insertBefore(s, el);
}
)();
</script><DIV 
STYLE="height:0px; width:0px; overflow:hidden"><IFRAME SRC=
"http://tap2-cdn.rubiconproject.com/partner/scripts/rubicon/emily.html?rtb_ext=1&pc=3196/3346&geo=na
&co=us" FRAMEBORDER="0" MARGINWIDTH="0" MARGINHEIGHT="0" SCROLLING="NO" WIDTH="0" HEIGHT="0" style=
"height:0px; width:0px"></IFRAME></DIV>

(repeated 1 time)

<SCRIPT TYPE='text/javascript' SRC=
'http://r1-ads.ace.advertising.com/site=837333/size=728090/u=2/bnum=8350327/wkhr=129/hr=9/hl=2/c=2/s
cres=4/swh=1024x768/tile=1/f=1/r=1/optn=1/fv=9/aolexp=1/dref=http%253A%252F%252Fwww.mediafire.com%25
2Ferror.php%253Ferrno%253D320'></SCRIPT>

(repeated 1 time)

<script language="JavaScript1.1" src=
"http://ebay.adnxs.com/ttj?id=863854&cb=1804574607&pt1=0000837333&pt2=0001246502&pt3=1235&pt4=134703
6967:1804574607:0000837333:0001246502:1235:0:pG530013470369670006&imp_id=v2:I:1347036967:1804574607:
0000837333:0001246502:1235:0&pubclick=http://r1-ads.ace.advertising.com/click/site=0000837333/mnum=0
001246502/cstr=8350327=_504a2727,1804574607,837333_1246502_1235_0,1_/xsxdata=$XSXDATA/bnum=8350327/o
ptn=64?trg="></script>

(repeated 1 time)

<script type="text/javascript" src=
"http://rover.ebay.com/ar/1/711-155813-2042-4/4?mpt=1347036967&Perf_Tracker_1=0000837333&Perf_Tracke
r_2=0001246502&Perf_Tracker_3=1235&ext_id=6049383040932707474&ff6=1347036967:1804574607:0000837333:0
001246502:1235:0:pG530013470369670006&siteid=0&icep_siteid=0&ipn=admain2&adtype=3&size=728x90&placem
ent=15738&mpvc=http%3A%2F%2Fib.adnxs.com%2Fclick%3FAAAAAAAAAAAAAAAAAAAAAAAAAEAzM8M_AAAAAAAAAAAAAAAAA
AAAAJL8ECHTufNT42zMe_ZQVi4nJ0pQAAAAAG4uDQBkAAAAZAAAAAIAAABLHSgAh7wAAAAAAQBVU0QAVVNEANgCWgAO8gAAUioAA
gMCAQUAAIIA4BPd8QAAAAA.%2Fcnd%3D%2521cAWQLwi-mRwQy7qgARiH-QIgBA..%2Freferrer%3Dhttp%253A%252F%252Fww
w.mediafire.com%252Ftemplates%252Flinkto%252Fdefault-729x91-default.php%2Fclickenc%3Dhttp%253A%252F%
252Fr1-ads.ace.advertising.com%252Fclick%252Fsite%253D0000837333%252Fmnum%253D0001246502%252Fcstr%25
3D8350327%253D_504a2727%252C1804574607%252C837333_1246502_1235_0%252C1_%252Fxsxdata%253D%2524XSXDATA
%252Fbnum%253D8350327%252Foptn%253D64%253Ftrg%253D"></script>

(repeated 1 time)

<iframe src="http://view.atdmt.com/iaction/adoapn_AppNexusDemoActionTag_1" width="1" height="1" 
frameborder="0" scrolling="No" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0">
</iframe>

(repeated 1 time)

```
<div id="foldcheck384424594214" >
```
(repeated 1 time)

<script type="text/javascript" src="http://img-cdn.mediaplex.com/0/documentwrite.js"></script>

(repeated 1 time)

<script type="text/javascript" src="http://img-cdn.mediaplex.com/0/711/dapAdChoice.js"></script>

(repeated 1 time)

```
</div>
```
(repeated 1 time)

<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"  codebase=
"https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0" id=
"10269858" name="movie10269858" width="728" height="90"><param name="FlashVars" value=
"clickTAG=http%3a//ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAAAAAEAzM8M%5fAAAAAAAAAAAAAAAAAAAAAJL8ECHT
ufNT42zMe%5fZQVi4nJ0pQAAAAAG4uDQBkAAAAZAAAAAIAAABLHSgAh7wAAAAAAQBVU0QAVVNEANgCWgAO8gAAUioAAgMCAQUAAI
IA4BPd8QAAAAA./cnd%3d%2521cAWQLwi-mRwQy7qgARiH-QIgBA../referrer%3dhttp%253A%252F%252Fwww.mediafire.c
om%252Ftemplates%252Flinkto%252Fdefault-729x91-default.php/clickenc%3dhttp%253A%252F%252Fr1-ads.ace.
advertising.com%252Fclick%252Fsite%253D0000837333%252Fmnum%253D0001246502%252Fcstr%253D8350327%253D%
5f504a2727%252C1804574607%252C837333%5f1246502%5f1235%5f0%252C1%5f%252Fxsxdata%253D%2524XSXDATA%252F
bnum%253D8350327%252Foptn%253D64%253Ftrg%253Dhttp://rover.ebay.com/rover/1/711-155813-2042-4/4?mpt%3
d35766%26ir_DAP_M2%3D10269858%26mpcr%3D10269858&clickTag=http%3a//ib.adnxs.com/click?AAAAAAAAAAAAAAA
AAAAAAAAAAEAzM8M%5fAAAAAAAAAAAAAAAAAAAAAJL8ECHTufNT42zMe%5fZQVi4nJ0pQAAAAAG4uDQBkAAAAZAAAAAIAAABLHSg
Ah7wAAAAAAQBVU0QAVVNEANgCWgAO8gAAUioAAgMCAQUAAIIA4BPd8QAAAAA./cnd%3d%2521cAWQLwi-mRwQy7qgARiH-QIgBA.
./referrer%3dhttp%253A%252F%252Fwww.mediafire.com%252Ftemplates%252Flinkto%252Fdefault-729x91-defaul
t.php/clickenc%3dhttp%253A%252F%252Fr1-ads.ace.advertising.com%252Fclick%252Fsite%253D0000837333%252
Fmnum%253D0001246502%252Fcstr%253D8350327%253D%5f504a2727%252C1804574607%252C837333%5f1246502%5f1235
%5f0%252C1%5f%252Fxsxdata%253D%2524XSXDATA%252Fbnum%253D8350327%252Foptn%253D64%253Ftrg%253Dhttp://r
over.ebay.com/rover/1/711-155813-2042-4/4?mpt%3d35766%26ir_DAP_M2%3D10269858%26mpcr%3D10269858&click
Tag1=http%3a//ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAAAAAEAzM8M%5fAAAAAAAAAAAAAAAAAAAAAJL8ECHTufNT4
2zMe%5fZQVi4nJ0pQAAAAAG4uDQBkAAAAZAAAAAIAAABLHSgAh7wAAAAAAQBVU0QAVVNEANgCWgAO8gAAUioAAgMCAQUAAIIA4BP
d8QAAAAA./cnd%3d%2521cAWQLwi-mRwQy7qgARiH-QIgBA../referrer%3dhttp%253A%252F%252Fwww.mediafire.com%25
2Ftemplates%252Flinkto%252Fdefault-729x91-default.php/clickenc%3dhttp%253A%252F%252Fr1-ads.ace.adver
tising.com%252Fclick%252Fsite%253D0000837333%252Fmnum%253D0001246502%252Fcstr%253D8350327%253D%5f504
a2727%252C1804574607%252C837333%5f1246502%5f1235%5f0%252C1%5f%252Fxsxdata%253D%2524XSXDATA%252Fbnum%
253D8350327%252Foptn%253D64%253Ftrg%253Dhttp://rover.ebay.com/rover/1/711-155813-2042-4/4?mpt%3d3576
6%26ir_DAP_M2%3D10269858%26mpcr%3D10269858&url=http%253A%252F%252Fwww.mediafire.com%252Ferror.php%25
3Ferrno%253D320"><param name="movie" value=
"http://img-cdn.mediaplex.com/0/711/155813/86608_US_2012_Q1_Instant_Sale_New_iPad_Default_728x90.swf
?ir_DAP_M0=0&ir_DAP_M1=71115581320424&ir_DAP_M2=10269858&ir_DAP_M3=&ir_DAP_M4=Santa Barbara&ir_DAP_M
5=&ir_DAP_M6=0&ir_DAP_M7=www.mediafire.com&ir_DAP_M8=&ir_DAP_M9=US&ir_DAP_M10=805&&dap3_template_id=
10269858&rvr_id=384424594214"><param name="wmode" value="opaque"><param name="allowscriptaccess" 
value="always"><embed wmode="opaque" allowscriptaccess="always" name=
"711/155813/86608_US_2012_Q1_Instant_Sale_New_iPad_Default_728x90." src=
"http://img-cdn.mediaplex.com/0/711/155813/86608_US_2012_Q1_Instant_Sale_New_iPad_Default_728x90.swf
?ir_DAP_M0=0&ir_DAP_M1=71115581320424&ir_DAP_M2=10269858&ir_DAP_M3=&ir_DAP_M4=Santa Barbara&ir_DAP_M
5=&ir_DAP_M6=0&ir_DAP_M7=www.mediafire.com&ir_DAP_M8=&ir_DAP_M9=US&ir_DAP_M10=805&&dap3_template_id=
10269858&rvr_id=384424594214" FlashVars=
"clickTAG=http%3a//ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAAAAAEAzM8M%5fAAAAAAAAAAAAAAAAAAAAAJL8ECHT
ufNT42zMe%5fZQVi4nJ0pQAAAAAG4uDQBkAAAAZAAAAAIAAABLHSgAh7wAAAAAAQBVU0QAVVNEANgCWgAO8gAAUioAAgMCAQUAAI
IA4BPd8QAAAAA./cnd%3d%2521cAWQLwi-mRwQy7qgARiH-QIgBA../referrer%3dhttp%253A%252F%252Fwww.mediafire.c
om%252Ftemplates%252Flinkto%252Fdefault-729x91-default.php/clickenc%3dhttp%253A%252F%252Fr1-ads.ace.
advertising.com%252Fclick%252Fsite%253D0000837333%252Fmnum%253D0001246502%252Fcstr%253D8350327%253D%
5f504a2727%252C1804574607%252C837333%5f1246502%5f1235%5f0%252C1%5f%252Fxsxdata%253D%2524XSXDATA%252F
bnum%253D8350327%252Foptn%253D64%253Ftrg%253Dhttp://rover.ebay.com/rover/1/711-155813-2042-4/4?mpt%3
d35766%26ir_DAP_M2%3D10269858%26mpcr%3D10269858&clickTag=http%3a//ib.adnxs.com/click?AAAAAAAAAAAAAAA
AAAAAAAAAAEAzM8M%5fAAAAAAAAAAAAAAAAAAAAAJL8ECHTufNT42zMe%5fZQVi4nJ0pQAAAAAG4uDQBkAAAAZAAAAAIAAABLHSg
Ah7wAAAAAAQBVU0QAVVNEANgCWgAO8gAAUioAAgMCAQUAAIIA4BPd8QAAAAA./cnd%3d%2521cAWQLwi-mRwQy7qgARiH-QIgBA.
./referrer%3dhttp%253A%252F%252Fwww.mediafire.com%252Ftemplates%252Flinkto%252Fdefault-729x91-defaul
t.php/clickenc%3dhttp%253A%252F%252Fr1-ads.ace.advertising.com%252Fclick%252Fsite%253D0000837333%252
Fmnum%253D0001246502%252Fcstr%253D8350327%253D%5f504a2727%252C1804574607%252C837333%5f1246502%5f1235
%5f0%252C1%5f%252Fxsxdata%253D%2524XSXDATA%252Fbnum%253D8350327%252Foptn%253D64%253Ftrg%253Dhttp://r
over.ebay.com/rover/1/711-155813-2042-4/4?mpt%3d35766%26ir_DAP_M2%3D10269858%26mpcr%3D10269858&click
Tag1=http%3a//ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAAAAAEAzM8M%5fAAAAAAAAAAAAAAAAAAAAAJL8ECHTufNT4
2zMe%5fZQVi4nJ0pQAAAAAG4uDQBkAAAAZAAAAAIAAABLHSgAh7wAAAAAAQBVU0QAVVNEANgCWgAO8gAAUioAAgMCAQUAAIIA4BP
d8QAAAAA./cnd%3d%2521cAWQLwi-mRwQy7qgARiH-QIgBA../referrer%3dhttp%253A%252F%252Fwww.mediafire.com%25
2Ftemplates%252Flinkto%252Fdefault-729x91-default.php/clickenc%3dhttp%253A%252F%252Fr1-ads.ace.adver
tising.com%252Fclick%252Fsite%253D0000837333%252Fmnum%253D0001246502%252Fcstr%253D8350327%253D%5f504
a2727%252C1804574607%252C837333%5f1246502%5f1235%5f0%252C1%5f%252Fxsxdata%253D%2524XSXDATA%252Fbnum%
253D8350327%252Foptn%253D64%253Ftrg%253Dhttp://rover.ebay.com/rover/1/711-155813-2042-4/4?mpt%3d3576
6%26ir_DAP_M2%3D10269858%26mpcr%3D10269858&url=http%253A%252F%252Fwww.mediafire.com%252Ferror.php%25
3Ferrno%253D320" swLiveConnect="false" width="728" height="90" type="application/x-shockwave-flash" 
pluginspage=""></embed></object><div id="hiddenReporting10269858" style="visibility:hidden;"></div>

(repeated 1 time)

<IMG SRC=
http://b.scorecardresearch.com/p?c1=3&c2=6035983&c3=155813&c4=10269858&c5=71115581320424&c6=&c10=1&c
11=&c12=p164760327&c13=&c16=mojo&cj=1&ax_fwd=1&r=http://ar.voicefive.com/b/recruitBeacon.pli%3Fpid=p
164760327%26PRAd=71115581320424%26AR_C=10269858%26clid=6035983%26cid=155813%26stid=%26sz=%26as=mojo%
26rn=1347036967886>

(repeated 1 time)

<script type="text/javascript" src="http://js.dmtry.com/antenna2.js?0_2612_71115581320424_0">
</script>

(repeated 1 time)

<img width="0" height="0" border="0" name="ADO_track_new">

(repeated 1 time)

src="http://optimized-by.rubiconproject.com/a/3196/3346/9685-15.js?cb=0.8463241175238363&fr=true">

(repeated 1 time)

<!-- -------------- Advertising.com ------ Rubicon - Media Fire - MediaFire 300x250 CPM2 - 837331 -
 (300x250) ------------ -->
<script type='text/javascript'>var ACE_AR = {
  site : '837331', size : '300250'
}
;
</script>
<script type='text/javascript' 
SRC='http://uac.advertising.com/wrapper/aceUAC.js'></script>

<!-- ----------
 Copyright 2009, Advertising.com ---------- -->

(repeated 1 time)

<script type="text/javascript">oz_sensor_filter = "domain";
</script><script type="text/javascript" defer="defer" src=
"http://tap-cdn.rubiconproject.com/partner/scripts/rubicon/alice.js"></script><script>var _comscore = _comscore || [];
_comscore.push({
  c1 : "8", c2 : "6135404", c3 : "26", c4 : "3346", c10 : "3437285"
}
);
(function (){
  var s = document.createElement("script"), el = document.getElementsByTagName("script")[0
  ];
  s.async = true;
  s.src = (document.location.protocol == "https:" ? "https://sb" : "http://b") + 
  ".scorecardresearch.com/beacon.js";
  el.parentNode.insertBefore(s, el);
}
)();
</script><DIV 
STYLE="height:0px; width:0px; overflow:hidden"><IFRAME SRC=
"http://tap2-cdn.rubiconproject.com/partner/scripts/rubicon/emily.html?rtb_ext=1&pc=3196/3346&geo=na
&co=us" FRAMEBORDER="0" MARGINWIDTH="0" MARGINHEIGHT="0" SCROLLING="NO" WIDTH="0" HEIGHT="0" style=
"height:0px; width:0px"></IFRAME></DIV>

(repeated 1 time)

<SCRIPT TYPE='text/javascript' SRC=
'http://r1-ads.ace.advertising.com/site=837331/size=300250/u=2/bnum=46778862/wkhr=129/hr=9/hl=2/c=2/
scres=4/swh=1024x768/tile=1/f=1/r=1/optn=1/fv=9/aolexp=1/dref=http%253A%252F%252Fwww.mediafire.com%2
52Ferror.php%253Ferrno%253D320'></SCRIPT>

(repeated 1 time)

<SCRIPT language='JavaScript1.1' SRC=
"http://ad.doubleclick.net/adj/N6921.134363.ADVERTISING.COM-PLA/B5746730.10;sz=300x250;click=http://
r1-ads.ace.advertising.com/click/site=0000837331/mnum=0001062031/cstr=46778862=_504a2729,7371572180,
837331_1062031_1235_0,1_/xsxdata=$xsxdata/bnum=46778862/optn=64?trg=;ord=7371572180?">

(repeated 1 time)

```
</SCRIPT>
```
(repeated 1 time)

<a target="_blank" href=
"http://ad.doubleclick.net/click;h=v8/3ce9/c/af/%2a/u;251907831;3-0;0;76070764;4307-300/250;49251655
/49246948/1;;~sscs=%3fhttp://r1-ads.ace.advertising.com/click/site=0000837331/mnum=0001062031/cstr=4
6778862=_504a2729,7371572180,837331_1062031_1235_0,1_/xsxdata=$xsxdata/bnum=46778862/optn=64?trg=htt
p%3a%2f%2fwww.zulily.com/%3Ftid%3Daoldisp_adcmcpa_49251655"><img src=
"http://s0.2mdn.net/viewad/3227518/300x250_0705_fairydreams.jpg" border=0 alt=
"Click here to find out more!"></a>

(repeated 1 time)

<iframe src='http://tap.rubiconproject.com/oz/feeds/invite-media-rtb/tokens/?rt=iframe' width='1' 
height='1' frameborder='0'></iframe>

(repeated 1 time)

src="http://optimized-by.rubiconproject.com/a/3196/3346/27309-15.js?cb=0.1241273885804478&fr=true">

(repeated 1 time)

<html><head>            <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">

            <meta http-equiv="Expires" content="Tue, 01 Jan 2000 12:12:12 GMT">
            <meta 
http-equiv="Pragma" content="no-cache">
    </head>
<body> <img src=
'http://207.198.109.209/rubicon/px/aid:f0f3fba07be1b362553d1e934373c3ad2986a04b;c:E62C129E7E12420F;s
:594945ced662723a;cid:17775;ts:1347036969957' width=1 height=1 style=
"position: absolute; left: -150px;" />
<a href=
"http://clickserv.sitescout.com/clk/d341316292c25060/e92afadf9edcf2b0/1-3346/2/www.mediafire.com%2Ft
emplates%2Flinkto%2Fdefault-337x281-default2.php//" target="_blank">    <img src=
"http://dspads.sitescout.netdna-cdn.com/1900/1877/300-BBC21D3.gif" alt="" border="0"></a> <img src=
"http://pixel.quantserve.com/pixel/p-01nD5uD1pGDW2.gif" border="0" height="1" width="1" style=
"display:none;"/></body></html>

(repeated 1 time)

<script type="text/javascript">oz_sensor_filter = "domain";
</script><script type="text/javascript" defer="defer" src=
"http://tap-cdn.rubiconproject.com/partner/scripts/rubicon/alice.js"></script><script>var _comscore = _comscore || [];
_comscore.push({
  c1 : "8", c2 : "6135404", c3 : "26", c4 : "3346", c10 : "3228674"
}
);
(function (){
  var s = document.createElement("script"), el = document.getElementsByTagName("script")[0
  ];
  s.async = true;
  s.src = (document.location.protocol == "https:" ? "https://sb" : "http://b") + 
  ".scorecardresearch.com/beacon.js";
  el.parentNode.insertBefore(s, el);
}
)();
</script><DIV 
STYLE="height:0px; width:0px; overflow:hidden"><IFRAME SRC=
"http://tap2-cdn.rubiconproject.com/partner/scripts/rubicon/emily.html?rtb_ext=1&pc=3196/3346&geo=na
&co=us" FRAMEBORDER="0" MARGINWIDTH="0" MARGINHEIGHT="0" SCROLLING="NO" WIDTH="0" HEIGHT="0" style=
"height:0px; width:0px"></IFRAME></DIV>

(repeated 1 time)

Network Activity¶

Requests

URL	Status	Content Type
http://www.mediafire.com/error.php?errno=320	200	text/html
http://www.google-analytics.com/ga.js	200	text/javascript
about:blank	200	text/html
http://connect.facebook.net/en_US/all.js	200	application/x-javascript
http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.js	200	text/javascript
http://cdn.mediafire.com/css/mfv3_82944.php?ver=nonssl	200	text/css
http://cdn.mediafire.com/css/mfv4_82944.php?ver=nonssl	200	text/css
https://fonts.googleapis.com/css?family=Open+Sans:800,400,700	200	text/css
http://cdn.mediafire.com/css/ie_82944.css?ver=nonssl	200	text/css
http://cdn.mediafire.com/css/ie7_82944.css?ver=nonssl	200	text/css
http://cdn.mediafire.com/js/master_82944.js	200	text/javascript
http://rts.sparkstudios.com/Publishers/e95076fd0c.js?ver=async&random=95531635&millis=1347036964272	200	empty
http://cdn.engine.adsupply.com/Scripts/infinity.js.aspx	200	application/x-javascript
http://engine.adsupply.com/Tag.engine?guid=5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0&rand0.43571154827889647&ver=async&time=420	200	application/json
http://www.google-analytics.com/__utm.gif?utmwv=5.3.5&utms=1&utmn=211502750&utmhn=www.mediafire.com&utmcs=-&utmsr=1024x768&utmvp=1256x1983&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=9.0%20r115&utmdt=Free%20Cloud%20Storage%20-%20MediaFire&utmhid=1417554647&utmr=-&utmp=%2Ferror.php%3Ferrno%3D320&utmac=UA-340518-28&utmcc=__utma%3D1.1742271160.1347036964.1347036964.1347036964.1%3B%2B__utmz%3D1.1347036964.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmu=qBAg~	200	image/gif
http://www.google-analytics.com/__utm.gif?utmwv=5.3.5&utms=2&utmn=1261857017&utmhn=www.mediafire.com&utmt=event&utme=5(EngineScriptLoad5ff0fb62-0643-4ff1-aaee-c737f9ffc0e0)&utmcs=-&utmsr=1024x768&utmvp=1256x1983&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=9.0%20r115&utmdt=Free%20Cloud%20Storage%20-%20MediaFire&utmhid=1417554647&utmr=-&utmp=%2Ferror.php%3Ferrno%3D320&utmac=UA-340518-28&utmcc=__utma%3D1.1742271160.1347036964.1347036964.1347036964.1%3B%2B__utmz%3D1.1347036964.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmu=6BAg~	200	image/gif
http://cdn.mediafire.com/blank.html	200	text/html
http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.facebook.com%2FMediaFire&send=false&layout=button_count&width=180&show_faces=false&action=like&colorscheme=light&font&height=80	200	text/html
http://b.static.ak.fbcdn.net/rsrc.php/v2/y4/r/YAV6Ce5hx-Z.js	200	application/x-javascript
http://platform.twitter.com/widgets/follow_button.html?screen_name=MediaFire&show_count=true&show_screen_name=false	200	text/html
http://www.mediafire.com/templates/linkto/default-161x601-default.php	200	text/html
http://optimized-by.rubiconproject.com/a/3196/3346/9685-9.js?cb=0.09066178955858661&fr=true	200	application/x-javascript
http://tap2-cdn.rubiconproject.com/partner/scripts/rubicon/emily.html?rtb_ext=1&pc=3196/3346&geo=na&co=us	200	text/html
http://tap.rubiconproject.com/oz/feeds/invite-media-rtb/tokens/?rt=iframe	302	text/html
http://pixel.invitemedia.com/rubicon_sync?publisher_user_id=e9ff5ab73a4345f5ff2fe552412670a44efd76c3&publisher_dsp_id=2101&publisher_call_type=iframe&publisher_redirecturl=http://tap.rubiconproject.com/oz/feeds/invite-media-rtb/tokens/	200	text/html
http://tap-cdn.rubiconproject.com/partner/scripts/rubicon/alice.js	200	text/javascript
http://tap-cdn.rubiconproject.com/partner/scripts/rubicon/page_parser.js?d=www.mediafire.com	200	text/javascript
http://b.scorecardresearch.com/beacon.js	200	application/x-javascript
http://www.mediafire.com/templates/linkto/default-729x91-default.php	200	text/html
http://ads.rubiconproject.com/ad/3196.js?cb=0.4663331058368708	200	text/javascript
http://optimized-by.rubiconproject.com/a/3196/3346/9685-2.js?cb=0.5170936317843917&tk_st=1&tk_sf=1&rf=http%3A//www.mediafire.com/error.php%3Ferrno%3D320	200	application/x-javascript
http://uac.advertising.com/wrapper/aceUAC.js	200	application/x-javascript
http://r1-ads.ace.advertising.com/site=837333/size=728090/u=2/bnum=8350327/wkhr=129/hr=9/hl=2/c=2/scres=4/swh=1024x768/tile=1/f=1/r=1/optn=1/fv=9/aolexp=1/dref=http%253A%252F%252Fwww.mediafire.com%252Ferror.php%253Ferrno%253D320	302	text/html
http://r1-ads.ace.advertising.com/ctst=1/site=837333/size=728090/u=2/bnum=8350327/wkhr=129/hr=9/hl=2/c=2/scres=4/swh=1024x768/tile=1/f=1/r=1/optn=1/fv=9/aolexp=1/dref=http%253A%252F%252Fwww.mediafire.com%252Ferror.php%253Ferrno%253D320	200	application/x-javascript
http://ebay.adnxs.com/ttj?id=863854&cb=1804574607&pt1=0000837333&pt2=0001246502&pt3=1235&pt4=1347036967:1804574607:0000837333:0001246502:1235:0:pG530013470369670006&imp_id=v2:I:1347036967:1804574607:0000837333:0001246502:1235:0&pubclick=http://r1-ads.ace.advertising.com/click/site=0000837333/mnum=0001246502/cstr=8350327=_504a2727,1804574607,837333_1246502_1235_0,1_/xsxdata=$XSXDATA/bnum=8350327/optn=64?trg=	302	text/html
http://ib.adnxs.com/bounce?%2Fttj%3Fid%3D863854%26cb%3D1804574607%26pt1%3D0000837333%26pt2%3D0001246502%26pt3%3D1235%26pt4%3D1347036967%3A1804574607%3A0000837333%3A0001246502%3A1235%3A0%3ApG530013470369670006%26imp_id%3Dv2%3AI%3A1347036967%3A1804574607%3A0000837333%3A0001246502%3A1235%3A0%26pubclick%3Dhttp%3A%2F%2Fr1-ads.ace.advertising.com%2Fclick%2Fsite%3D0000837333%2Fmnum%3D0001246502%2Fcstr%3D8350327%3D_504a2727%2C1804574607%2C837333_1246502_1235_0%2C1_%2Fxsxdata%3D%24XSXDATA%2Fbnum%3D8350327%2Foptn%3D64%3Ftrg%3D	200	text/javascript
http://rover.ebay.com/ar/1/711-155813-2042-4/4?mpt=1347036967&Perf_Tracker_1=0000837333&Perf_Tracker_2=0001246502&Perf_Tracker_3=1235&ext_id=6049383040932707474&ff6=1347036967:1804574607:0000837333:0001246502:1235:0:pG530013470369670006&siteid=0&icep_siteid=0&ipn=admain2&adtype=3&size=728x90&placement=15738&mpvc=http%3A%2F%2Fib.adnxs.com%2Fclick%3FAAAAAAAAAAAAAAAAAAAAAAAAAEAzM8M_AAAAAAAAAAAAAAAAAAAAAJL8ECHTufNT42zMe_ZQVi4nJ0pQAAAAAG4uDQBkAAAAZAAAAAIAAABLHSgAh7wAAAAAAQBVU0QAVVNEANgCWgAO8gAAUioAAgMCAQUAAIIA4BPd8QAAAAA.%2Fcnd%3D%2521cAWQLwi-mRwQy7qgARiH-QIgBA..%2Freferrer%3Dhttp%253A%252F%252Fwww.mediafire.com%252Ftemplates%252Flinkto%252Fdefault-729x91-default.php%2Fclickenc%3Dhttp%253A%252F%252Fr1-ads.ace.advertising.com%252Fclick%252Fsite%253D0000837333%252Fmnum%253D0001246502%252Fcstr%253D8350327%253D_504a2727%252C1804574607%252C837333_1246502_1235_0%252C1_%252Fxsxdata%253D%2524XSXDATA%252Fbnum%253D8350327%252Foptn%253D64%253Ftrg%253D	200	text/html
http://img-cdn.mediaplex.com/0/documentwrite.js	200	application/x-javascript
http://js.dmtry.com/antenna2.js?0_2612_71115581320424_0	200	application/x-javascript
http://img-cdn.mediaplex.com/0/711/dapAdChoice.js	200	text/html
http://edpn.ebay.com/engagement?INIT=384424594214%7C10269858%7C71115581320424%7C1%7C11%7C0%7C%7Chttp://www.mediafire.com/error.php?errno=320	200	text/xml
http://view.atdmt.com/iaction/adoapn_AppNexusDemoActionTag_1	200	text/html
http://r1-ads.ace.advertising.com/site=837331/size=300250/u=2/bnum=46778862/wkhr=129/hr=9/hl=2/c=2/scres=4/swh=1024x768/tile=1/f=1/r=1/optn=1/fv=9/aolexp=1/dref=http%253A%252F%252Fwww.mediafire.com%252Ferror.php%253Ferrno%253D320	200	application/x-javascript
http://ad.doubleclick.net/adj/N6921.134363.ADVERTISING.COM-PLA/B5746730.10;sz=300x250;click=http://r1-ads.ace.advertising.com/click/site=0000837331/mnum=0001062031/cstr=46778862=_504a2729,7371572180,837331_1062031_1235_0,1_/xsxdata=$xsxdata/bnum=46778862/optn=64?trg=;ord=7371572180?	200	application/x-javascript
http://img-cdn.mediaplex.com/0/711/155813/86608_US_2012_Q1_Instant_Sale_New_iPad_Default_728x90.swf?ir_DAP_M0=0&ir_DAP_M1=71115581320424&ir_DAP_M2=10269858&ir_DAP_M3=&ir_DAP_M4=Santa%20Barbara&ir_DAP_M5=&ir_DAP_M6=0&ir_DAP_M7=www.mediafire.com&ir_DAP_M8=&ir_DAP_M9=US&ir_DAP_M10=805&&dap3_template_id=10269858&rvr_id=384424594214	200	application/x-shockwave-flash
http://www.mediafire.com/templates/linkto/default-337x281-default.php	200	text/html
http://optimized-by.rubiconproject.com/a/3196/3346/9685-15.js?cb=0.8463241175238363&fr=true	200	application/x-javascript
http://www.mediafire.com/templates/linkto/default-337x281-default2.php	200	text/html
http://optimized-by.rubiconproject.com/a/3196/3346/27309-15.js?cb=0.1241273885804478&fr=true	200	application/x-javascript

Redirects

From	To
http://r1-ads.ace.advertising.com/site=837333/size=728090/u=2/bnum=8350327/wkhr=129/hr=9/hl=2/c=2/scres=4/swh=1024x768/tile=1/f=1/r=1/optn=1/fv=9/aolexp=1/dref=http%253A%252F%252Fwww.mediafire.com%252Ferror.php%253Ferrno%253D320	http://r1-ads.ace.advertising.com/ctst=1/site=837333/size=728090/u=2/bnum=8350327/wkhr=129/hr=9/hl=2/c=2/scres=4/swh=1024x768/tile=1/f=1/r=1/optn=1/fv=9/aolexp=1/dref=http%253A%252F%252Fwww.mediafire.com%252Ferror.php%253Ferrno%253D320
http://ebay.adnxs.com/ttj?id=863854&cb=1804574607&pt1=0000837333&pt2=0001246502&pt3=1235&pt4=1347036967:1804574607:0000837333:0001246502:1235:0:pG530013470369670006&imp_id=v2:I:1347036967:1804574607:0000837333:0001246502:1235:0&pubclick=http://r1-ads.ace.advertising.com/click/site=0000837333/mnum=0001246502/cstr=8350327=_504a2727,1804574607,837333_1246502_1235_0,1_/xsxdata=$XSXDATA/bnum=8350327/optn=64?trg=	http://ib.adnxs.com/bounce?%2Fttj%3Fid%3D863854%26cb%3D1804574607%26pt1%3D0000837333%26pt2%3D0001246502%26pt3%3D1235%26pt4%3D1347036967%3A1804574607%3A0000837333%3A0001246502%3A1235%3A0%3ApG530013470369670006%26imp_id%3Dv2%3AI%3A1347036967%3A1804574607%3A0000837333%3A0001246502%3A1235%3A0%26pubclick%3Dhttp%3A%2F%2Fr1-ads.ace.advertising.com%2Fclick%2Fsite%3D0000837333%2Fmnum%3D0001246502%2Fcstr%3D8350327%3D_504a2727%2C1804574607%2C837333_1246502_1235_0%2C1_%2Fxsxdata%3D%24XSXDATA%2Fbnum%3D8350327%2Foptn%3D64%3Ftrg%3D
http://tap.rubiconproject.com/oz/feeds/invite-media-rtb/tokens/?rt=iframe	http://pixel.invitemedia.com/rubicon_sync?publisher_user_id=e9ff5ab73a4345f5ff2fe552412670a44efd76c3&publisher_dsp_id=2101&publisher_call_type=iframe&publisher_redirecturl=http://tap.rubiconproject.com/oz/feeds/invite-media-rtb/tokens/

ActiveX controls¶

D27CDB6E-AE6D-11CF-96B8-444553540000
	Name	Value
Attributes	movie	http://img-cdn.mediaplex.com/0/711/155813/86608_US_2012_Q1_Instant_Sale_New_iPad _Default_728x90.swf?ir_DAP_M0=0&ir_DAP_M1=71115581320424&ir_DAP_M2=10269858&ir_D AP_M3=&ir_DAP_M4=Santa.Barbara&ir_DAP_M5=&ir_DAP_M6=0&ir_DAP_M7=www.mediafire.co m&ir_DAP_M8=&ir_DAP_M9=US&ir_DAP_M10=805&&dap3_template_id=10269858&rvr_id=38442 4594214
	wmode	opaque
	FlashVars	clickTAG=http%3a//ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAAAAAEAzM8M%5fAAAAAAAAA AAAAAAAAAAAAJL8ECHTufNT42zMe%5fZQVi4nJ0pQAAAAAG4uDQBkAAAAZAAAAAIAAABLHSgAh7wAAAA AAQBVU0QAVVNEANgCWgAO8gAAUioAAgMCAQUAAIIA4BPd8QAAAAA./cnd%3d%2521cAWQLwi-mRwQy7q other 1760 bytes 2727%252C1804574607%252C837333%5f1246502%5f1235%5f0%252C1%5f%252Fxsxdata%253D%25 24XSXDATA%252Fbnum%253D8350327%252Foptn%253D64%253Ftrg%253Dhttp://rover.ebay.com /rover/1/711-155813-2042-4/4?mpt%3d35766%26ir_DAP_M2%3D10269858%26mpcr%3D1026985 8&url=http%253A%252F%252Fwww.mediafire.com%252Ferror.php%253Ferrno%253D320
	allowscriptaccess	always

ShockwaveFlash.ShockwaveFlash
	Name	Arg0
Methods	GetVariable	$version

Shellcode¶

No shellcode was identified.

Malware¶

Additional (potential) malware:

URL	Type	Hash	Analysis
http://rover.ebay.com/rover/1/711-155813-2042-4/4?mpt%3d35766%26ir_DAP_M2%3D1026 9858%26mpcr%3D10269858&clickTag=http%3a//ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAA AAAAAEAzM8M%5fAAAAAAAAAAAAAAAAAAAAAJL8ECHTufNT42zMe%5fZQVi4nJ0pQAAAAAG4uDQBkAAAA ZAAAAAIAAABLHSgAh7wAAAAAAQBVU0QAVVNEANgCWgAO8gAAUioAAgMCAQUAAIIA4BPd8QAAAAA./cnd %3d%2521cAWQLwi-mRwQy7qgARiH-QIgBA../referrer%3dhttp%253A%252F%252Fwww.mediafire .com%252Ftemplates%252Flinkto%252Fdefault-729x91-default.php/clickenc%3dhttp%253 A%252F%252Fr1-ads.ace.advertising.com%252Fclick%252Fsite%253D0000837333%252Fmnum %253D0001246502%252Fcstr%253D8350327%253D%5f504a2727%252C1804574607%252C837333%5 f1246502%5f1235%5f0%252C1%5f%252Fxsxdata%253D%2524XSXDATA%252Fbnum%253D8350327%2 52Foptn%253D64%253Ftrg%253Dhttp://rover.ebay.com/rover/1/711-155813-2042-4/4?mpt %3d35766%26ir_DAP_M2%3D10269858%26mpcr%3D10269858&clickTag1=http%3a//ib.adnxs.co m/click?AAAAAAAAAAAAAAAAAAAAAAAAAEAzM8M%5fAAAAAAAAAAAAAAAAAAAAAJL8ECHTufNT42zMe% 5fZQVi4nJ0pQAAAAAG4uDQBkAAAAZAAAAAIAAABLHSgAh7wAAAAAAQBVU0QAVVNEANgCWgAO8gAAUioA AgMCAQUAAIIA4BPd8QAAAAA./cnd%3d%2521cAWQLwi-mRwQy7qgARiH-QIgBA../referrer%3dhttp %253A%252F%252Fwww.mediafire.com%252Ftemplates%252Flinkto%252Fdefault-729x91-def ault.php/clickenc%3dhttp%253A%252F%252Fr1-ads.ace.advertising.com%252Fclick%252F site%253D0000837333%252Fmnum%253D0001246502%252Fcstr%253D8350327%253D%5f504a2727 %252C1804574607%252C837333%5f1246502%5f1235%5f0%252C1%5f%252Fxsxdata%253D%2524XS XDATA%252Fbnum%253D8350327%252Foptn%253D64%253Ftrg%253Dhttp://rover.ebay.com/rov er/1/711-155813-2042-4/4?mpt%3d35766%26ir_DAP_M2%3D10269858%26mpcr%3D10269858&ur l=http%253A%252F%252Fwww.mediafire.com%252Ferror.php%253Ferrno%253D320	HTML document text	d49fe3ef1690a38fa5138c7ec4908018

FEEDBACK

Analysis report for http://www.mediafire.com/error.php?errno=320

Sample Overview¶

Detection results¶

Exploits¶

Deobfuscation results¶

Evals

Writes

Network Activity¶

Requests

Redirects

ActiveX controls¶

Shellcode¶

Malware¶

Comments