« previous next »
Pages: [1]   Go Down

Author Topic: Sizzle.js used in malware? Renaming sizzle.js will produce conflicts!  (Read 1778 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34060
  • malware fighter
Sizzle.js used in malware? Renaming sizzle.js will produce conflicts!
« on: November 09, 2014, 04:26:33 PM »
See: http://jsunpack.jeek.org/?report=956af79ecc67f5781b56edaf04e50c40218fc0b2
Open link in browser with NoScript active and inside a VM/sandbox.
Many instances of  Mal/FBJack-H include found for IP: http://www.scumware.org/report/199.116.78.141
Clean MX VirusWatch gives unknown_html_RFI_shell.
BrightCloud gives site as trustworthy. Site was vulnerable as it was hacked: http://www.zone-h.org/mirror/id/21735215?zh=1
See also htxp://explore-yachts.com/components/com_community/assets/jqueryui/datepicker/js/jquery-ui-1.9.2.custom.js
and htxp://explore-yachts.com/jomres/javascript/jquery-ui-cal-localisation/jquery.ui.datepicker-en-GB.js
-> http://www.securiteam.com/securitynews/5HP3115AKA.html -> http://jsunpack.jeek.org/?report=d0bf823a58d8c6eff5ff7de1ef5169762b22e9d9

Some good technology applied: http://builtwith.com/explore-yachts.com

polonus
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!
Pages: [1]   Go Up
« previous next »