Home / malware

PDF

Trojan.Script.254568

First posted on 21 November 2011.
Source: BitDefender

Aliases :

Trojan.Script.254568 is also known as JS/ShellCode.J, Heuristic.Script.Crypted, Mal/Badsrc-D.

Explanation :

The Trojan is a special written JavaScript, designed in a cryptic way in order to avoid detection or to make the code harder to be read.

First it checks for a specific cookie named "CoreBeta" in order to verify if the system was already attacked. If the cookie isn't found then it's created and set to expire in one day. After this, it decrypts some of its own code, inserting in the page several other masked components. If the cookie is found then the user gets an "about:blank" page.

Last update 21 November 2011

 

TOP