har5launo.com/cgi-bin/index.cgi?dx

URL contains malicious javascript which eventually links to Mebroot trojan.
[VT results=4/38]

cbp7t.cn

this sql-injected domain retrieves iframe from www.jmlrmg.com/index.htm

The malicious iframe exploits a number of typical vulnerabilities.

The VT analysis of the malicious file www.jmlrmg.com/chanm/yahoo.exe is here. ThreatExpert here.

Other domains sharing the same IP are jsani.cn, woshow11.cn

cdm1djeni.com/cgi-bin/index.cgi?dx

after a series of obfuscated JS, the final decoded content as follows: