f1y.in/j.js

another round of sql-injection atttempt

218.213.77.96/a.js

a recent round of sql-injected link.

3b3.org/c.js

This sql-injected script src has been around for some time.

The interesting point of this script is that it behaves differently if the injected site is from “.gov.cn” or “.edu.cn”. Code as shown below:

cn0093.cn/v.js

following previous post, a new injected script has emerged that resolves to same IP.

v.js retrieves another iframe src www.vieio.cn/i.htm.

This exploitation kit tries to avoid detection by splitting each respective exploit into 2 files. One .htm and .js

tsnse.cn/i.js

This sql-injected script calls iframe www.gomne.cn/yh.htm

deabak.com/z.js

this is a new script that are being sql-injected.

z.js contains a iframe from www.893500.cn/2/index.htm

iwdown.com/inc/e.js

this sql-injected URL contains iframes to www.advpoints.com.
Seems to be profiting thru referrals rather than injecting malware.

u.winzxm.com

another sql-injected domain….this one works.
Iterating through the obfuscated JS, it finally exploits þe typical set of vulnerabilities like IE7, flash, snapshot view etc.

allspaces.com/z.js

this is another sql-injected URL. However z.js does not seem to be accessible.

har5launo.com/cgi-bin/index.cgi?dx

URL contains malicious javascript which eventually links to Mebroot trojan.
[VT results=4/38]