Author Topic: Javascript malcode detected here?  (Read 1047 times)

0 Members and 1 Guest are viewing this topic.

Online polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34053
  • malware fighter
Javascript malcode detected here?
« on: March 06, 2016, 05:52:49 PM »
Re: https://www.virustotal.com/en/url/31348ac194f0eb4aa5435b1870626d949358d826cadbe00fbf32398abacc2dda/analysis/1457281950/
Google safe browse check
WARNING
Google finds the site to be potentially dangerous

Web application version:
Joomla Version 1.7.x for: -http://kontrolapolicije.me/language/en-GB/en-GB.ini
Joomla version outdated: Upgrade required.
Outdated Joomla Found: Joomla under 3.4.5
Joomla Modules, Components and Plugins
The following modules were detected from the HTML source of the Joomla front page.
mod_vijesti_aktuelno
mod_slides
The following components were detected from the HTML source of the Joomla front page.
No components were found passively in HTML source
The following plugins were detected from the HTML source of the Joomla front page.
jcemediabox
Adding Modules, Components and Plugins to a Joomla site expands your attack surface. These addons are a source of many security vulnerabilities, it is important to always keep them updated to the latest version available and check the developers plugin page for information about security related updates and fixes. Using the JoomlaVS scanner it is possible to dig deeper and determine all installed components, including the version. This allows security vulnerabilities to be identified.

jQuery Detected libraries:
jquery - 1.7.1 : (active1) -http://kontrolapolicije.me/media/widgetkit/js/jquery.js
Info: Severity: medium
http://bugs.jquery.com/ticket/11290
http://research.insecurelabs.org/jquery/test/
(active) - the library was also found to be active by running code
1 vulnerable library detected

The link here should be blocked: -http://js.zelenuenogotochki.info/  but is not detected here: https://urlquery.net/report.php?id=1457282297782

Sucuri flags: Known javascript malware. Details: http://sucuri.net/malware/entry/mw:js:gen2?web.js.injection.megaadvertize.001

Quttera detecs 7 malicious files: http://quttera.com/detailed_report/kontrolapolicije.me

See for instance here: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fkontrolapolicije.me%2Fmedia%2Fsystem%2Fjs%2Fcaption.js
Detected encoded JavaScript code commonly used to hide malicious behaviour.

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!