Author Topic: Suspicious code on hacked website detected?  (Read 868 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33925
  • malware fighter
Suspicious code on hacked website detected?
« on: August 05, 2015, 12:32:50 AM »
malcode still on after 7 days: http://killmalware.com/goddogproducciones.com/#
Found to be infected with Malware:
ISSUE DETECTED                 DEFINITION                   INFECTED URL
Website Malware   malware-entry-mwanomalysp7?v53   http://goddogproducciones.com
Website Malware   malware-entry-mwanomalysp7?v53   http://goddogproducciones.com/404javascript.js
Known javascript malware. Details: http://labs.sucuri.net/db/malware/malware-entry-mwanomalysp7?v53
index.html
Severity:   Potentially Suspicious
Reason:   Suspicious JavaScript code injection.
Details:   Procedure: unescape has been called with a string containing hidden URL (jswrite.com) to script code
Threat dump:   see attached
Threat dump MD5:   906771815344D76BA113CE26B7E4932E
File size[byte]:   10184
File type:   ASCII
Page/File MD5:   D124067030C824B806A6EC3049066F36
Scan duration[sec]:   0.096000

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!