injected script h.js

[philipp]

a google search (http://www.google.de/search?hl=en&q=intitle%3A"h.js"+intitle%3A"script+src"&btnG=Search) rgives 2040 results on this.
looking at this script, the following exploit chain can be drawn:

Code: [Select]

http://dbios.org/h.js
- http://vvexe.com/haha/index.html
  - flash.htm
    - gdi2.swf
    - GDI1.swf
  - 06014.htm
    --> http://www.vvexe.com/haha/down.exe (md5: 16096127c078f03893819b71c2caff3a)
  - flash112.htm
    - i1.html
      - ii115.swf
      - i45.swf
      - i16.swf
      - i64.swf
      - i28.swf
      - i47.swf
      --> http://www.vvexe.com/haha/down.exe (md5: 16096127c078f03893819b71c2caff3a)
    - f2.html
      - ff115.swf
      - f64.swf
      - f47.swf
      - f45.swf
      - f28.swf
      - f16.swf
      --> http://www.vvexe.com/haha/down.exe (md5: 16096127c078f03893819b71c2caff3a)
  - ff.htm
    --> http://www.vvexe.com/haha/down.exe (md5: 16096127c078f03893819b71c2caff3a)
  - xl.htm (down)
  - mi.htm
    --> http://www.vvexe.com/haha/down.exe (md5: 16096127c078f03893819b71c2caff3a)
  - real10.htm (down)
  - real11.htm
    --> http://www.vvexe.com/haha/down.exe (md5: 16096127c078f03893819b71c2caff3a)
  - tr.htm
    - http://www.letusearch.com/xiaoke.htm
    - http://www.onegameplace.com/xiaoke.htm
    - http://www.ctexe.com/key.htm
      - http://www.bbcseek.com/seo.php?ref=itxiaoke
      - http://www.kikclicks.com/engine/?ref=apple
      - http://www.netsearch.cc/go.php?u=86731
      - http://www.pay-avail-click.com/portal.php?r=0&username=86731
      - http://www.parsonsearch.com/itxiaoke.htm
    - http://www.lukclick.com/search/51777.htm
- http://www.kenya.com/faq.htm

i've got no time to dig any deeper right now. also i am not sure if this specific injection is already well known.

[Serg]

Wow  Seems like new chines self made things. As i see they sell and games account and bots and traffic  Interesting ...