New Chinese exploit pack - Revision history

Eric.freyssinet: 1 revision imported

2015-02-07T14:27:27Z

1 revision imported

← Older revision		Revision as of 14:27, 7 February 2015
(No difference)

Eric.freyssinet at 20:15, 1 February 2015

2015-02-01T20:15:09Z

← Older revision		Revision as of 20:15, 1 February 2015
Line 6:		Line 6:
	\|Link=http://www.kahusecurity.com/2012/new-chinese-exploit-pack/		\|Link=http://www.kahusecurity.com/2012/new-chinese-exploit-pack/
	\|Author=Darryl,		\|Author=Darryl,
			\|Type=Blogpost
	\|Abstract=A Korean news site was recently observed distributing malware. I thought it would be an opportune time to test out my program that attempts to locate malicious scripts on a website. Here’s an excerpt from the results		\|Abstract=A Korean news site was recently observed distributing malware. I thought it would be an opportune time to test out my program that attempts to locate malicious scripts on a website. Here’s an excerpt from the results
	Looking at the screenshot above from the bottom up, we see some suspicious content from an IP address. That page gets called by an infected “popupmenu.js” file. And that file gets referenced on the main news page. Good, we know now where to start looking! By the way, the “ad.html” page that gets iframed has an “entropy” value of about 68% which is rather high (see top of the screenshot). This suggests the page has obfuscated Javascript.		Looking at the screenshot above from the bottom up, we see some suspicious content from an IP address. That page gets called by an infected “popupmenu.js” file. And that file gets referenced on the main news page. Good, we know now where to start looking! By the way, the “ad.html” page that gets iframed has an “entropy” value of about 68% which is rather high (see top of the screenshot). This suggests the page has obfuscated Javascript.
	}}		}}

Eric.freyssinet at 20:14, 1 February 2015

2015-02-01T20:14:32Z

← Older revision		Revision as of 20:14, 1 February 2015
Line 6:		Line 6:
	\|Link=http://www.kahusecurity.com/2012/new-chinese-exploit-pack/		\|Link=http://www.kahusecurity.com/2012/new-chinese-exploit-pack/
	\|Author=Darryl,		\|Author=Darryl,
	\|Abstract=A Korean news site was recently observed distributing malware. I thought it would be an opportune time to test out my program that attempts to locate malicious scripts on a website. Here’s an excerpt from the results ~~[...]~~ Looking at the screenshot above from the bottom up, we see some suspicious content from an IP address. That page gets called by an infected “popupmenu.js” file. And that file gets referenced on the main news page. Good, we know now where to start looking! By the way, the “ad.html” page that gets iframed has an “entropy” value of about 68% which is rather high (see top of the screenshot). This suggests the page has obfuscated Javascript.		\|Abstract=A Korean news site was recently observed distributing malware. I thought it would be an opportune time to test out my program that attempts to locate malicious scripts on a website. Here’s an excerpt from the results
			Looking at the screenshot above from the bottom up, we see some suspicious content from an IP address. That page gets called by an infected “popupmenu.js” file. And that file gets referenced on the main news page. Good, we know now where to start looking! By the way, the “ad.html” page that gets iframed has an “entropy” value of about 68% which is rather high (see top of the screenshot). This suggests the page has obfuscated Javascript.
	}}		}}

Eric.freyssinet at 20:14, 1 February 2015

2015-02-01T20:14:00Z

← Older revision		Revision as of 20:14, 1 February 2015
Line 1:		Line 1:
	{{Publication		{{Publication
			\|ExploitKit=KaiXin,
	\|Year=2012		\|Year=2012
	\|Date=2012-08-02		\|Date=2012-08-02
Line 5:		Line 6:
	\|Link=http://www.kahusecurity.com/2012/new-chinese-exploit-pack/		\|Link=http://www.kahusecurity.com/2012/new-chinese-exploit-pack/
	\|Author=Darryl,		\|Author=Darryl,
			\|Abstract=A Korean news site was recently observed distributing malware. I thought it would be an opportune time to test out my program that attempts to locate malicious scripts on a website. Here’s an excerpt from the results [...] Looking at the screenshot above from the bottom up, we see some suspicious content from an IP address. That page gets called by an infected “popupmenu.js” file. And that file gets referenced on the main news page. Good, we know now where to start looking! By the way, the “ad.html” page that gets iframed has an “entropy” value of about 68% which is rather high (see top of the screenshot). This suggests the page has obfuscated Javascript.
	}}		}}

Eric.freyssinet: Created page with "{{Publication |Year=2012 |Date=2012-08-02 |Editor=Kahu security blog |Link=http://www.kahusecurity.com/2012/new-chinese-exploit-pack/ |Author=Darryl, }}"

2015-02-01T20:13:31Z

Created page with "{{Publication |Year=2012 |Date=2012-08-02 |Editor=Kahu security blog |Link=http://www.kahusecurity.com/2012/new-chinese-exploit-pack/ |Author=Darryl, }}"

← Older revision		Revision as of 20:13, 1 February 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	~~\|Image=~~
	~~\|Legend=~~
	~~\|Document=~~
	~~\|Licence=~~
	~~\|Video=~~
	~~\|Link=http://www.kahusecurity.com/2012/new-chinese-exploit-pack/ www.dahusecurity.com~~
	~~\|Author=Darryl,~~
	~~\|NomRevue=Kahu Security blog~~
	~~\|Date=02 août 2012~~
	~~\|Editor=Kahu Security~~
	\|Year=2012		\|Year=2012
	\|~~ISBN~~=		\|Date=2012-08-02
	\|~~Page~~=		\|Editor=Kahu security blog
	\|~~Abstract~~=~~A Korean news site was recently observed distributing malware~~. ~~I thought it would be an opportune time to test out my program that attempts to locate malicious scripts on a website~~. Here’s an excerpt from the results [...] Looking at the screenshot above from the bottom up, we see some suspicious content from an IP address. That page gets called by an infected “popupmenu.js” file. And that file gets referenced on the main news page. Good, we know now where to start looking! By the way, the “ad.html” page that gets iframed has an “entropy” value of about 68% which is rather high (see top of the screenshot). This suggests the page has obfuscated Javascript.		\|Link=http://www.kahusecurity.com/2012/new-chinese-exploit-pack/
	~~\|Botnet=,~~		\|Author=Darryl,
	~~\|Malware=,~~
	~~\|ExploitKit=KaiXin,~~
	~~\|CCProtocol=,~~
	~~\|Operation=,~~
	\|~~Keyword~~=,
	}}		}}

Eric.freyssinet at 13:43, 16 August 2012

2012-08-16T13:43:51Z

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.kahusecurity.com/2012/new-chinese-exploit-pack/ www.dahusecurity.com
|Author=Darryl,
|NomRevue=Kahu Security blog
|Date=02 août 2012
|Editor=Kahu Security
|Year=2012
|ISBN=
|Page=
|Abstract=A Korean news site was recently observed distributing malware. I thought it would be an opportune time to test out my program that attempts to locate malicious scripts on a website. Here’s an excerpt from the results [...] Looking at the screenshot above from the bottom up, we see some suspicious content from an IP address. That page gets called by an infected “popupmenu.js” file. And that file gets referenced on the main news page. Good, we know now where to start looking! By the way, the “ad.html” page that gets iframed has an “entropy” value of about 68% which is rather high (see top of the screenshot). This suggests the page has obfuscated Javascript.
|Botnet=,
|Malware=,
|ExploitKit=KaiXin,
|CCProtocol=,
|Operation=,
|Keyword=,
}}