Wepawet (alpha)

Home | About | Sample Reports | Support | News

Analysis report for http://www.renewalretreat.com/main/?go

Sample Overview

URL	http://www.renewalretreat.com/main/?go
MD5	f8bf57a0865314f493aa22ca6041b55e
Analysis Started	2010-01-31 23:41:32
Report Generated	2010-01-31 23:42:03
Jsand version	1.03.02

See the report for domain www.renewalretreat.com.

Detection results

Detector	Result
Jsand 1.03.02	suspicious

This resource appears to be involved in the Koobface malware campaign.

Exploits

No exploits were identified.

Deobfuscation results

Evals

• document.referrer
  

  (repeated 1 time)

• window.redirect
  

  (repeated 2 times)

• location.href
  

  (repeated 1 time)

• location.search
  

  (repeated 1 time)

• window.location.href = window.redirect;
  

  (repeated 1 time)

• window.attachEvent('onunload', exiter);
  

  (repeated 1 time)

Writes

• <OBJECT id="iie" width="0" height="0" style="position:absolute; left:0;top:0;" CLASSID=
  "CLSID:6BF52A52-394A-11d3-B153-00C04F79FAA6" type="application/x-oleobject"> <PARAM NAME=
  "SendPlayStateChangeEvents" VALUE="True"> <PARAM NAME="AutoStart" VALUE="True">	<PARAM name="uiMode"
   value="none"> <PARAM name="PlayCount" value="9999"></OBJECT>
  

  (repeated 1 time)

Network Activity

Requests

URL	Status	Content Type
http://www.renewalretreat.com/main/?go	200	text/javascript
http://75.136.35.104/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://77.124.20.87/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://67.167.199.159/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://98.219.142.25/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://98.209.7.193/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://99.191.124.174/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://77.124.97.210/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://84.109.189.239/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://217.132.61.44/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://76.123.170.136/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://218.190.237.9/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://79.183.23.192/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://85.64.50.152/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://84.111.61.84/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://74.131.196.91/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://68.84.239.98/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://60.48.77.177/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://68.118.15.173/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://70.251.98.183/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://87.69.56.143/go.js?0x3E8/view/console=yes/?go	200	text/javascript
http://87.69.56.143/d=www.renewalretreat.com/0x3E8/view/console=yes/?go	200	text/html
http://87.69.56.143/d=www.renewalretreat.com/0x3E8/view/console=yes/player.swf?pid=6123	200	application/x-shockwave-flash

Redirects

No redirects.

ActiveX controls

• 6BF52A52-394A-11D3-B153-00C04F79FAA6
  	Name	Arg0	Count
  Methods	launchURL	http://connecticuttea.com/?pid=312s02&sid=4db12f	1
  		http://87.69.56.143/d=www.renewalretreat.com/0x3E8/view/console=yes/?go	1
  	Name	Value	Count
  Attributes	PlayCount	9999	1
  	uiMode	none	1
  	AutoStart	True	1
  	SendPlayStateChangeEvents	True	1

• D27CDB6E-AE6D-11CF-96B8-444553540000
  	Name	Value	Count
  Attributes	bgcolor	#000000	1
  	movie	player.swf?pid=6123	1
  	allowScriptAccess	sameDomain	1
  	allowFullScreen	false	1
  	menu	false	1
  	quality	high	1

Shellcode and Malware

No shellcode was identified.

Additional (potential) malware:

URL	Type	Hash	Analysis
http://87.69.56.143/d=www.renewalretreat.com/0x3E8/view/console=yes/?go	N/A	N/A
http://connecticuttea.com/?pid=312s02&sid=4db12f	N/A	N/A

© 2008–2010 UCSB Computer Security Lab