Ambassadors for education’s site compromised
October 26th, 2009
globalfundforeducation.org has been compromised.
Obfuscated JavaScript:
A little bit of fiddling around with the JS code allows us to display what it actually does:
An iframe:
Which is also referenced in the main code:
The final payload seemed to come from soft-siski.com in the form of several executables.
Jerome Segura
Warning: all links contained in this post may infect your computer!
Comments:
|
|
