Web Security And Awareness towards Cybercriminals: Exploit Kit Blackhole

Posts mit dem Label Exploit Kit Blackhole werden angezeigt. Alle Posts anzeigen

3/05/2014

NEWLY DETECTED:
Trojan.JS.Blacole.Gen
ldcseven.comyr.com & donchule.com
HEUR:Trojan-Downloader.Script.Generic
(Encoded Scripts - MIM-Tactic)
UNITED STATES

NEWLY DETECTED MALWARE DOMAIN(S):

HEUR:Trojan-Downloader.Script.Generic (Encoded Scripts)

DOMAIN:

http://ldcseven.comyr.com/

https://www.virustotal.com/de/url/0685ba471b55e064305146a4155d1857601333edaf2d174788621557675da089/analysis/1394045893/

HTML:

https://www.virustotal.com/de/file/9d8db988e3267396a97fe47f79a85719d31b6c118be64f58e337b90d7d75b446/analysis/1394046023/

MALICIOUS URL:

http://ldcseven.comyr.com/UFPvaVNW.php?id=29514587

INFECTION:

HEUR:Trojan-Downloader.Script.Generic

https://www.virustotal.com/de/url/b6e6ec75c7190316ce80ef8661d56dd26406036052fd4d3eef39fd38ec3baf11/analysis/1394045890/

---> REMOTE LINK:

http://donchule.com/js/slider/Ww84LhDN.php?id=1821816

https://www.virustotal.com/de/url/b9d3a4338b900524d214624c18c993059c91f88ed7e207f0cdcc64f48324afe0/analysis/1394048670/

FULL REVIEW:

2/17/2014

CVE-2010-1885:
oasissalesltd.com
G01-Pack EXPLOIT KIT & BLACKHOLE EXPLOIT KIT (V1)
(United States)

RBN 162
CVE-2010-1885
2 EXPLOIT KITS

G01-Pack EXPLOIT KIT & BLACKHOLE V1 & MORE

http://oasissalesltd.com/

https://www.virustotal.com/de/url/72db1f5817c25099af14a2eae08013fdcaab743073a4b93310c2df7eee5b62a2/analysis/1373801163/

Trojan-Downloader.JS.Iframe.chf

https://www.virustotal.com/de/file/bcd159c52a585704c5278afc54cb1cd3c0718c671edfacd4f1b11f52653311bd/analysis/

https://www.virustotal.com/de/file/0eba2d732c74fc34ce72293129ce7516931fa77a9f3401acbf55c44177b7d8ee/analysis/

Exploit:HTML/IframeRef.V

https://www.virustotal.com/de/file/e270ef91ae2795b7fe3e5362aff7ee020fb5584264096876eb09efd65f0cc565/analysis/1392554684/

http://wepawet.iseclab.org/view.php?hash=cd2f37b1cad3b1eabdc2800a56fc134f&t=1392554456&type=js

Likely Blackhole Exploit Kit Driveby Download Secondary Request

https://urlquery.net/report.php?id=9464549

FULL REPORT :

2/08/2014

MALICIOUS VISITOR TO THIS BLOG: www.bema.it INFECTED: Trojan-Downloader.JS.Iframe.czo & HEUR:Trojan.Script.Generic (ITALY)

MALICIOUS SITE: EXPLOIT BLACKHOLE (MALICIOUS INJECTION) Trojan-Downloader.JS.Iframe.czo

DOMAIN:

www.bema.it

https://www.virustotal.com/de/url/9c313118270d7060f6a88b8d02315e60f6fa366d1e640d01b0154f43f721ab7c/analysis/1391876292/

HTML

https://www.virustotal.com/de/file/c48575a72b511e9fc0a7e9e601b33507d08296eadb6efebb18655dc1177de4c1/analysis/

SPECIFIC MALWARE (VISITING) LINK:

www.bema.it/paesaggigeologici.htm

https://www.virustotal.com/de/url/1a3e767c25cb71944b44bf81943c6d839273fdec1f176966f963d0875215e959/analysis/1391876591/

INFECTION:

Trojan-Downloader.JS.Iframe.czo

https://www.virustotal.com/de/file/483e183fedd9db8a7fd74fd979c235c2d0565933534898c55abbfa3e7801b5e7/analysis/1391875774/

HEUR:Trojan.Script.Generic

https://www.virustotal.com/de/file/0e3b1abbec7f3d81910ab10ba644d5ba64a1075db3b9a85a7833642913871582/analysis/1391875789/

http://jsunpack.jeek.org/?report=8ace5573ffdaf77d5ed6faf5dd6aface337b0387

http://wepawet.iseclab.org/view.php?hash=a4bbe339803250d0b1a917575df82c92&t=1391875552&type=js

https://urlquery.net/report.php?id=9316907

---> REMOTE

miamiheattickets.com/http.php

https://www.virustotal.com/de/url/0bbe620806942d74fb1ede783f53c0f29151485340a3687deec3bdb8689900d8/analysis/1391877039/

--->

www.bema.it/bema_internet.css

https://www.virustotal.com/de/url/28a06f8a729f620fc4fb8c3b3aa47c3f2a66b5b9e7fba3578075c5f187218d58/analysis/1391877125/

https://www.virustotal.com/de/file/805730a9867637233a0e88034a7160ceebb1232bec363db7d057455dc4e8243c/analysis/1352190357/

OTHER MALWARE LINKS FROM THIS DOMAIN:

1) www.bema.it/opere/pg_1.htm

https://www.virustotal.com/de/url/52200c7f623b60c44c2256c70bc3041a0f7efbf825c1e0067565fd8dfd3dfd37/analysis/1391877987/

INFECTION:

HEUR:Trojan.Script.Generic

https://www.virustotal.com/de/file/a4e9035cacdfbfcb1b28cfb2ebedccc0901dbc4c82173a388648d43a7d82b88f/analysis/1391877891/

--->

moreclosings.com

https://www.virustotal.com/de/url/cb65fb78eb9f34870ab0c33b3fd7b48e9163f72d6d9b29ee9320e97dcb6d69f4/analysis/1391878110/

moreclosings.com/showthread.php?sid=193854

https://www.virustotal.com/de/url/97d8c820291908356fa32a0b17c1d0eb4bc54e40e4ef64c9a2e72dfd8469a30b/analysis/

https://urlquery.net/report.php?id=9317125

2) www.bema.it/artigrafiche.htm

https://www.virustotal.com/de/url/d2fba275794bdef2a814e05cf08b9439daa40293e332fa100bde91327b470231/analysis/1391878663/

INFECTION:

Trojan-Downloader.JS.Iframe.czo

https://www.virustotal.com/de/file/3fa71c9f13947e2c60e52843932f59dddcc8e2d424a6f106717f5632e4533dcd/analysis/1391878603/

https://urlquery.net/report.php?id=9317122

3) www.bema.it/impianti.htm

https://www.virustotal.com/de/url/17a7d8f57f4c1f929637dea43d3cf7332442a484bb2f89ecca2afb9bf4a9dd1c/analysis/

INFECTION:

Trojan-Downloader.JS.Iframe.czo

https://www.virustotal.com/de/file/fc694a8433ca74015e3badf6ecd4d00b18f93ddfaa30121a21b6405658a97928/analysis/1391878854/

https://urlquery.net/report.php?id=9317119

2/06/2014

arifizgidizayn.com (MALICIOUS DOMAIN)
Infected with: HEUR:Trojan.Script.Generic
(EXPLOIT KIT, TURKEY)

MALICIOUS DOMAIN: EXPLOIT (KIT)

arifizgidizayn.com

https://www.virustotal.com/de/url/6d6c58ba2c1ccebe07cdae728992b6ecb9ada7c603b89df47fc4fda6dd80a703/analysis/1391683685/

SPECIFIC LINK:

arifizgidizayn.com/swfnoborder.js

https://www.virustotal.com/de/url/0505699678769fee5f460fc5d4d1eb04c24ad093d348504cfd2dd82860e595a4/analysis/1391683043/

https://www.virustotal.com/de/file/24a0434d89dfd70c0b84e3caa8adb9231512568bf2caf24d2bb9a6d7404952bb/analysis/1391683046/

Malware Network Compromised Redirect

https://urlquery.net/report.php?id=9252311

http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=arifizgidizayn.com

---> PATH

DOMAIN:

habibtour.com.au

https://www.virustotal.com/de/url/1ab36c262cf6533186fbe3a53be55e00d781a106bbffce7bea5fdbff8feab24a/analysis/1391683497/

SPECIFIC REDIRECTION LINK(s) (SUSPENDED):

habibtour.com.au/language/t.php

https://www.virustotal.com/de/url/7506f10411b494a3fdd3e39a6485ff45534f0ea20342a400ffdf22ae4c6238e8/analysis/1391683482/

https://www.virustotal.com/de/file/07f99e34de6b4f4707f502d1cfcf2957b330c5ff713cf377d1eb82b85f975539/analysis/1391414551/

habibtour.com.au/cgi-sys/suspendedpage.cgi

https://www.virustotal.com/de/url/be266fdc5e1bb28d85a41c7de7af5c0fce9c078aa3bcab1d83530e56c0fe52ca/analysis/1391683618/

1/19/2014

NEW MALWARE: Exploit.JS.Agent.bnu
found on
www.cretosocostruzioni.it (BLACKHOLE ITALY)

NEW MALWARE found on:

www.cretosocostruzioni.it

https://www.virustotal.com/de/url/56d645fd54a3131e943fffc38c7d8d2b08708d7fea96a0359b706e41c10b40ed/analysis/

INFECTED: Exploit.JS.Agent.bnu

https://www.virustotal.com/de/file/7fdbf0bce169b0e2ab441fda2d63ac7d7b114b85ec0dff12e509f074150d9f2d/analysis/1390128259/

www.cretosocostruzioni.it/online

https://www.virustotal.com/de/url/f2c0777c24805a398d42e4b2fcee5ff98fbd375a42482aac2c019334536fc97b/analysis/1390129080/

INFECTED: Exploit.JS.Agent.bnu

https://www.virustotal.com/de/file/742113b12396661ca1c2d2796834169e5543624111f75308b5ef1796d80634d1/analysis/1390128250/

81a338 (BLACKHOLE)

https://urlquery.net/report.php?id=8882516

---> REMOTE(s)

DOMAIN:

lanotfo.com

https://www.virustotal.com/de/url/6ff7f2d41dd24b4613f5c7f2ddf8045fb0cf966e530535a171dc971168a03bdb/analysis/1390129287/

lanotfo.com/exit.php

https://www.virustotal.com/de/url/418aefb901fd9cef797a1419bd4c3b82f15eab2e5fac9688998f3ce1cee83775/analysis/1390129281/

DOMAIN:

gylaqim.com

https://www.virustotal.com/de/url/fc04abfc736f83c76d968a82259c71d4382cbb895c2f50e15d345948c08541a9/analysis/1390128973/

gylaqim.com/exit.php

https://www.virustotal.com/de/url/fa57933bb759bbb97a034a0ff3ecf1563a51474ad5795f06949b746e58bc6986/analysis/1390128981/

----------------------------------------------------------------------------------------------------------------------------------------------
OTHER RESULTS:

http://app.webinspector.com/public/reports/19564893

http://wepawet.iseclab.org/view.php?hash=334dfbfddf5c8dd2e23083b3665eb265&t=1390127730&type=js

http://zulu.zscaler.com/submission/show/11e7b4c701fdd5cc9d49ceff4e6c058d-1390127849

1/18/2014

MALICIOUS U.K. SITE: gannons.mwhub.com
EXPLOIT BlackHole v2.0
Heuristic.LooksLike.HTML.Suspicious-URL.N

MALWARE & POTENTIALLY MALICIOUS DOMAIN: EXPLOIT BlackHole v2.0

gannons.mwhub.com

https://www.virustotal.com/de/url/2ae814e04d71ace1ed27086bb48b31bd5bd8150f464baaec47fc9d048b47588b/analysis/1390049811/

MALICIOUS LINK:

gannons.mwhub.com/1e20232b7e40f2e8f95b6aa5287167a5/basketball-identify.php

https://www.virustotal.com/de/url/5c01803eaadd4317c7639c56898ac68ddb8d7ceca17417f81ff002628796c696/analysis/1390051247/

EXPLOIT BlackHole v2.0

https://urlquery.net/report.php?id=8876931

-----------------------


OTHER SUSPICIOUS LINK:

gannons.mwhub.com/Gannons-posts-wordpress-2013-10-30.xml

https://www.virustotal.com/de/url/844aacebf2ea3bdfe44ea7314a5dc06d29db249c687feb2d34fd4b676b2870a2/analysis/1390050325/

Heuristic.LooksLike.HTML.Suspicious-URL.N

https://www.virustotal.com/de/file/d9086b09a40360ce592889068897b672a1cb38b704a5bf1874e6a01cc58bce73/analysis/1390050328/

-----------------------


SEE ALSO:

https://www.virustotal.com/de/ip-address/87.117.228.143/information/

1/17/2014

BREAKING DOMAINs: www.itsdc.org
Infected with:
Trojan.JS.Blacole.Gen (United States)

This must be a Professional Skill and...

The Following Links and Domains (in blue) are BREAKING BAD TO MALWARE:

DOMAIN:


www.itsdc.org

https://www.virustotal.com/de/url/d796f7b73d0965aa9de5875b2e257913ea2b0e303e7835432b1fcb0f57894c69/analysis/1389956959/

https://urlquery.net/report.php?id=8864865

http://zulu.zscaler.com/submission/show/3938a7a0a7ef602cfae59a8b94e2fada-1389956985


---------------------------------------------



www.itsdc.org/js/jquery.prettyPhoto.js

https://www.virustotal.com/de/url/d600215636481f986c6e1fc8c8a6019b223364533b8844336ec1a97d8a44fe47/analysis/1389957763/

INFECTED: Trojan.JS.Blacole.Gen

https://www.virustotal.com/de/file/9b9df85fd11cdb66f7dc3fb2d0f9fa0909992b46beff5e227b9d4b0fcda1a4b7/analysis/1389957587/


---------------------------------------------

www.itsdc.org/js/jquery-ui-1.5.2.packed.js

https://www.virustotal.com/de/url/07481a03983a69c4213b393196a280e7dbf4c0a810c0dfcc2784756204e22a46/analysis/1389958201/


INFECTED: JS/Exploit-Blacole.ml

https://www.virustotal.com/de/file/5222c0f0f6ab51af52a2733673222a80499033774e194d0f58d827ca90d7afbf/analysis/1389958031/

---------------------------------------------

www.itsdc.org/js/jquery.validate.js

https://www.virustotal.com/de/url/926fd3bbe47f7c17818f7d825c6c40183d34341ed8921f089bd44151f8b8e3a9/analysis/1389958385/


INFECTED: JS/Exploit-Blacole.ml

https://www.virustotal.com/de/file/f4e388638ccd349bb9a4804dc7522af53d80b052a6018018e885555bae8e952a/analysis/1389958386


---------------------------------------------

www.itsdc.org/js/png.js

https://www.virustotal.com/de/url/e14f6a474b5ee97ae17809b3d568a70fc291de0af1db831617d6208d4cb023ee/analysis/1389958540/

INFECTED: HEUR:Trojan.Script.Generic

https://www.virustotal.com/de/file/2a404dcb1dae86fd3596f9820fc136554da26e05703fd4059e197822c3490082/analysis/1389958624/


---------------------------------------------



www.itsdc.org/js/jquery.easing.1.1.1.js

https://www.virustotal.com/de/url/d5a1643eb8bb43181a8fb78b101134402b498c47bdc0eabca41424f343e441a1/analysis/1389958774/

INFECTED: JS:Agent-CPV [Trj]

https://www.virustotal.com/de/file/ef9101bb998f16c720f4017f2e4058f10518c313cd0904a6b4ac9c661566a6c6/analysis/1389958776/


---------------------------------------------



www.itsdc.org/js/script.js

https://www.virustotal.com/de/url/7905060a766e0415c594658494650b55853982fbd8ecf6c37aec1c885ca16a9a/analysis/1389958984/

INFECTED: HEUR:Trojan.Script.Generic

https://www.virustotal.com/de/file/b9f7dbfaac24018e00168704b6dc1bf9fe291aadc0d003229b1d6f7964ec97c2/analysis/1389958986/


---------------------------------------------



www.itsdc.org/js/cufon.js

https://www.virustotal.com/de/url/ca57d1ed1977c3697dbeb89d8f2a2e6ac26142a02d2024571b5677542c03762a/analysis/1389959036/

INFECTED: HEUR:Trojan.Script.Generic

https://www.virustotal.com/de/file/e0d7f2bc9e768d7f1ba82b658a195c3c572ec6dac52361c5b416be9da456e05a/analysis/1389959040/


---------------------------------------------

www.itsdc.org/js/jquery.cycle.all.min.js

https://www.virustotal.com/de/url/dbacef70c0d2d51f82e9301b6a3586dd5d77f446ced88cc439228c52893ecceb/analysis/1389959128/

INFECTED: Trojan.JS.Blacole.Gen

https://www.virustotal.com/de/file/dcd205df4791b88a15430626db103a400c0627960fcdd2ff47a98a2dda2f1da3/analysis/1389959130/


---> DESTINATION

 

www.ferristree.com.au/viberson-back/56RZR8ck.php?id=21743511

https://www.virustotal.com/de/url/938d25ed6403d2f9cc1ff517aa5bbaddd841f6d292666f525af969903f447820/analysis/1389959565/

INFECTED: HEUR:Trojan.Script.Generic

https://www.virustotal.com/de/file/3d1ea90bc4b4a4516d37152dc721608bc1256ad48cc4b3a0e3871efd74c99687/analysis/1389959400/

https://www.virustotal.com/de/file/13cdae6b3d3cfc1281cdb99753dab2fc584bc9120351b9ceb8ce6dc66a63be95/analysis/1389959422/

http://jsunpack.jeek.org/?report=06721d01e8bf3de21abf75bd5ca8c1e4a89d41f9


---------------------------------------------

... maybe someone wants to notice those 3 (without face(book), wondering why...?) that their Site is infected...

DOMAIN ferristree.com INFECTED:

www.ferristree.com.au

https://www.virustotal.com/de/url/cae9435a93d607c734227e6f4687b7c5315a60f1aa849af781088df3a9c6f811/analysis/1389960189/

INFECTED: HEUR:Trojan.Script.Generic

https://www.virustotal.com/de/file/c893a3d264485f69596365a9d0006dd7cf2ea2c524851355bcda9d0139a70b62/analysis/1389960100/

https://urlquery.net/report.php?id=8865038

http://jsunpack.jeek.org/?report=e4c2e9fda049f5ba96f585233250acd794a4f985


---------------------------------------------



www.ferristree.com.au/js/jquery.js

https://www.virustotal.com/de/url/a94b49a8d55485b3d4eb23bec856b1aa4cc9ade8ae39db98b898426ff789902e/analysis/1389960262/

INFECTED: HEUR:Trojan.Script.Generic

https://www.virustotal.com/de/file/e2f1d06f4551c9f4b403f64dcaef284e7999ee0f4555f469d6902f3517a58217/analysis/1389960320/


---------------------------------------------



www.ferristree.com.au/js/img_on.js

https://www.virustotal.com/de/url/7ae0c27906e5e5f2124b167685d8a85b30f1444b2c9f3401dd626e1d3fa01962/analysis/1389960627/


INFECTED: Trojan:HTML/Redirector.DW

https://www.virustotal.com/de/file/022ce5fdf7ba14c6d1e2efe480d0586e016f134c2a5f91a505adaa1c4f13a65c/analysis/


---> DESTINATION

ida.es/etiquetas/ZwWhK2AF.php?id=21060826

https://www.virustotal.com/de/url/fe914a0b3d52d37a29ec926981f359dba668ab824e8211042ba8c070c8bd98c4/analysis/1389971027/

INFECTED: HEUR:Trojan.Script.Generic

https://www.virustotal.com/de/file/409b4c585342aa93a289b4f2d10c01da8889511b7bc0239c78ce8eae0a959571/analysis/1389970629/


---------------------------------------------

...Integration of developed Applications. WOW ! Sounds great...



DOMAIN ida.es INFECTED: EXPLOIT REDKIT

ida.es

https://www.virustotal.com/de/url/127f82997623325f90a92a86fb4dbb4fc4a4b7e0fee2f6e1fb7ef705f29ada67/analysis/1389960923/

INFECTED: HEUR:Trojan.Script.Generic

https://www.virustotal.com/de/file/e0b6f3ee2acc8918c950bcd88d36e94d21148aaa843cd312487b8fe37a0c4f4c/analysis/1389971978/

https://urlquery.net/report.php?id=8865115


---> PATTERN

...and Chilling. Isn`t it ? The better it is...

dekostube.net/images/3MWDJlIz.php?id=21457000

https://www.virustotal.com/de/url/e43b4a9d200694a7db7e9670447bd9bbdae3ba0d943d56beef5ee9493601876f/analysis/1389972387/

https://www.virustotal.com/de/file/effa29283c16682404074ae8e600fbfe512ddce86dd99f49ec7d73715e8833f3/analysis/


--->

...the worser it gets !

safelist-retire.com/mhsn.html?h=757898

https://www.virustotal.com/de/url/8401ec62af7ea2eaff810973cbb53843cfe2ca37214b3d847132501863a28a7a/analysis/
https://www.virustotal.com/de/file/92133aa8467bcddd785c66777a97785635fe0217f896297e2e09816a147c56ec/analysis/


EXPLOIT RedKit

https://urlquery.net/report.php?id=8866156


SUSPICIOUS PDF File

ida.es/DocumentosPdf/EtiquetasElectronicas.pdf

https://www.virustotal.com/de/url/79840998e517a3cd16f9a1dd6c1d8cb9bedf5fea3ce726665d0e4bdb738c8a30/analysis/1389973163/
https://www.virustotal.com/de/file/dc3a5b8fffcb624a5ac8446ff4f9aec8cdeb9e6e88bb0f7436529631d6cea9b1/analysis/1389973169/


---------------------------------------------



DOMAIN dekostube.net INFECTED:

dekostube.net

https://www.virustotal.com/de/url/2aaefbf20ee0bdfcff1891fdf2de19f229e3fc6936680160d027443ff9c2e475/analysis/1389961175/


EXPLOIT LANDING PAGE

https://urlquery.net/report.php?id=8865136


--->

safelist-retire.com/mhsn.html?h=757898

https://www.virustotal.com/de/url/8401ec62af7ea2eaff810973cbb53843cfe2ca37214b3d847132501863a28a7a/analysis/


OTHER MALICIOUS DOMAINS INVOLVED:

adscendmedia.com

https://www.virustotal.com/de/url/32b0db6874108d5093e977abac99128c8002145d81f5dc757257fba66db05bff/analysis/1389970800/


www.logixcoder.com

https://www.virustotal.com/de/url/eb156f3b4bcb961194bf65bcc11038a3fa3e2da7729776ee6e0577346b7e3dfb/analysis/1389971337/


g.owest.net

https://www.virustotal.com/de/url/cf77607d3b3d7b8a326d67085950159bf642743dab6bc483bbfa598a4c5c1185/analysis/1389961517/

An asset is a resource controlled by the entity as a result of past events and from which future economic benefits are expected to flow to the entity.

My reply to "them": IDIOTS !

12/27/2013

Category MALICIOUS DOMAIN: anadoluerenleri.org - HEUR:Trojan.Script.Iframer - Exploit Kit Blackhole (Turkey)

MALICIOUS DOMAIN:

anadoluerenleri.org

https://www.virustotal.com/de/url/e16489216d92994fbac3bbcb9cb37d95d0d2cd1e4fb010be8b34728cceaccbae/analysis/1388152745/

INFECTED WITH: HEUR:Trojan.Script.Iframer

https://www.virustotal.com/de/file/30a611161ae8c4a3d06ca0052795ce7adc378dbf09405536f98bb9a1697ee3b9/analysis/1388153111/
https://www.virustotal.com/de/file/67c43a96d2475e927f5bf7d98796bef0f899031983ff1cdf5c9d564ca32970bc/analysis/1388153087/
https://urlquery.net/report.php?id=8568895

---> REMOTE DESTINATION (DOMAIN)

rcmeewprehhjewea.info

https://www.virustotal.com/de/url/412467cad9e07b697b7dfb855b20bec7f27f603e7e722c6bc49bde31551e4b3c/analysis/1388153380/

SPECIFIC LINK:

rcmeewprehhjewea.info/in.cgi?14

https://www.virustotal.com/de/url/a7da15f9a7b751e57c085195fde2dfb5ae73516edd7ce5c33c136c90e79298e3/analysis/1388153366/

Google Safebrowsing:

http://www.google.com/safebrowsing/diagnostic?site=anadoluerenleri.org

Translate

3/05/2014

2/17/2014

FULL REPORT :

2/08/2014

2/06/2014

1/19/2014

1/18/2014

1/17/2014

12/27/2013