Author Topic: Malware infested website flagged?  (Read 1718 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34051
  • malware fighter
Malware infested website flagged?
« on: March 19, 2015, 11:37:59 AM »
Here it is not being detected: http://killmalware.com/yemekkitabim.net/#
Site earlier hacked by a backdoor script and a valid admin login usually deleted and replaced with bad admin login.
This could well have been the scenario and there are still software vulnerabilities, because of
Web application version:
WordPress version: WordPress 3.6.1
Wordpress Version 3.6.1 based on: htxp://www.YemekKitabim.Net//wp-admin/js/common.js
WordPress theme: htxp://www.YemekKitabim.Net/wp-content/themes/ymk/
Wordpress internal path: -/home/yemekkit/public_html/wp-content/themes/ymk/index.php
WordPress version outdated: Upgrade required.
Outdated WordPress Found: WordPress Under 4.0
Outdated Web Server Apache Found: Apache/2.2.26

1 suspicious file from Quttera's: /feed
Severity:   Suspicious
Reason:   Detected reference to blacklisted domain
Details:   Detected reference to suspicious blacklisted domain wXw.annemintarifleri.com
File size[byte]:   57738
File type:   XML
Page/File MD5:   22C2B62FEBD2107B76B573967A39B866
Scan duration[sec]:   0.123000

Yandex blacklisted: http://yandex.com/infected?l10n=en&url=yemekkitabim.net

ISSUE DETECTED   DEFINITION   INFECTED URL
Website Malware   malware-entry-mwblacklisted35   htxp://www.YemekKitabim.Net/
Website Malware   malware-entry-mwblacklisted35   htxp://www.YemekKitabim.Net/404testpage4525d2fdc
Website Malware   malware-entry-mwblacklisted35   htxp://www.YemekKitabim.Net/404javascript.js
Website Malware   malware-entry-mwblacklisted35   htxp://www.YemekKitabim.Net/bosnak-boregi-videolu-tarifi-yk/
Website Malware   malware-entry-mwblacklisted35   htxp://www.YemekKitabim.Net/yemek-tarifleri/yemek-tarifi-videolari/
Website Malware   malware-entry-mwblacklisted35   htxp://www.YemekKitabim.Net/kilis-kebabi-videolu-tarif/

View code: https://www.uploady.com/download/wOMHwdk9x8r/WsTa5Z9P7qAmKWTW
These types of code are often used to distribute malware from external web sites while not being visible to the user.

Javascript Check: Suspicious

avascript" src="htxp://track-m.ru/wp-admin/css/colors/index.php"></script><script>,'opacity':false,'speedin':,'speedout':,'changespeed':,'overlayshow':false,'overlayopacity':"",'ov...

Included script: Suspect - please check list for unknown includes

htxp://track-m.ru/wp-admin/css/colors/index.php

404 error-check: Suspicious

Suspicious 404 Page:
   -.ru/wp-admin/css/colors/index.php"></script><script>,'opacity':false,'speedin':,'speedout':,'changespeed':,'overlayshow'

External links tracking report attached - ads, analytics and widget tracking. Do not open given links in a browser - txt report for security research purposes only.

IP malware history: https://www.virustotal.com/en/ip-address/31.192.211.196/information/

polonus
« Last Edit: March 19, 2015, 11:44:40 AM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!