Injected iframer

[michajp]

The following (Japanese) site contains an obfuscated iframer (on _first_ load only):

Code: [Select]

hxxp://2011.myojowaraku.net/
Iframe points to:

Code: [Select]

hxxp://heardthat.de.tf/in.cgi?2
#Note, the same site contained phishes at 2012-02-16 23:11:31 JST and similar iframer at 2012-02-17 23:04:05 JST.

Analysis:
http://urlquery.net/report.php?id=25445
http://jsunpack.jeek.org/?report=424dda16d567f31f296228335409a8632e4ecddd

[michajp]

Injected target changed:

Code: [Select]

hxxp://downthat.sg.tf/in.cgi?2
http://urlquery.net/report.php?id=25934

[SysAdMini]

Hi Micha,

I don't see any malicious activity there.

These redirectors lead to hxxp://188.72.213.185/c/.

Content of this url is just "GOTCHA!"

Do you see anything else ?

[GmG]

now downthat.sg.tf redirect to

Code: [Select]

http://gb.facebook4experts.com/direct.php?page=13adec71d62c3e90


[SysAdMini]

now downthat.sg.tf redirect to

Code: [Select]

http://gb.facebook4experts.com/direct.php?page=13adec71d62c3e90


Interesting. Not for me.

[CkreM]

now downthat.sg.tf redirect to

Code: [Select]

http://gb.facebook4experts.com/direct.php?page=13adec71d62c3e90


Interesting. Not for me.

The redirection is probably affected by Geo-location .