View source for SPL exploit kit – now with CVE-2013-0422

{{Publication
|ExploitKit=SPL Pack,
|Vulnerability=CVE-2013-0422, CVE-2012-1723,
|Year=2013
|Date=2013-01-14
|Link=http://ondailybasis.com/blog/2013/01/14/spl-exploit-kit-now-with-cve-2013-0422/
|Author=Denis Laskov,
|Abstract=Once in few days  I see some new stuff (for me, of course) and Google cannot answer me with enough details :)

Friends, WTF is SPL Exploit Kit? urlquery.net/report.php?id=… << sample detection by @urlquery.

— Denis Laskov (@it4sec) January 7, 2013

So URLquery named it SPL Exploit kit, and almost no additional info about it present. Weird? Yep.

So me and @nsmfoo had  a look at it, to see what we can learn.

Well, first of all, as I understand, name to this EK was given based on some tech specs, that return in each installation detected. Since then tech details slightly changed, but major idea is the same.

Ok, lets begin…
}}