Packed.Win32.Black.d (+ Win32/Injector) @: windowssoftwaire.eu5.org (IP: 5.9.106.214) GERMANY

MALWARE SITE:
1 - Packed.Win32.Black.d
2 - Win32/Injector
3 - HIDDEN IFRAME

DOMAIN:

http://windowssoftwaire.eu5.org/

• https://www.virustotal.com/de/url/cf360dffa24a58212c44d2340e2aeacac62031d1b06ac3a968f2e13edb33d41e/analysis/1396014984/

---> HIDDEN IFRAME TO

http://ads.yahoo.com/st?ad_type=iframe&ad_size=300x250&site=1580851&section_code=ADO3b

• https://www.virustotal.com/de/url/639f767bb6de5e8b70499590e7c3a38ca047d1eb77b39e53b94b4aed4333148a/analysis/1396015602/

http://windowssoftwaire.eu5.org/PBDownForce.rar

• https://www.virustotal.com/de/url/5fdf9ca80cddf232ad2ff32fe776e75eaa91283e858546e6902de39318734e59/analysis/1396014869/

MALWARE:

Packed.Win32.Black.d

• https://www.virustotal.com/de/file/8f937adfb1ba4f2dcb2554a4a78d579438eec4351301141424f529ff1a17c0c3/analysis/1396014875/

ALSO:

http://windowssoftwaire.eu5.org/KeyText.rar

• https://www.virustotal.com/de/url/b8dff45c4625e721c13fe7972f0c45ad5eebd3b0e4b7f634c98e155b87346242/analysis/1396016110/

Win32/Injector

• https://www.virustotal.com/de/file/c5eb9f43af160569196b28476a3b89fcfde89dee6399c06e71766ff39a5763fb/analysis/1396016120/

IP:

5.9.106.214

• https://www.virustotal.com/de/url/c675d95e168a09cbf8361aef286347b2473c933d8082578acee280d0607dd564/analysis/1396020096/
• https://www.virustotal.com/de/ip-address/5.9.106.214/information/

BHA: 2.949

• https://www.projecthoneypot.org/ip_5.9.106.214

HTML CODE CAN BE FOUND HERE: