Malicious #2 ** 6-Aug, webalfa.cn

webalfa.cn ( 210.51.51.176 -Blacklisted)

Others domain share same IP address

mail.webalfa.cn

ns1.webalfa.cn

security-access-control.cn

street-info.com

webalfa.cn

Level 0:http://webalfa.cn/pab/index.php

Level 1:http://webalfa.cn/pab/load.php (Trojan Virustotal 30/41, Anubis Report)

Level 1:http://webalfa.cn/pab/include/iframe.html

Level 1:http://webalfa.cn/pab/include/spl.php?stat=Windows XP|Internet Explorer 7.0|U (PDF exploit Virustotal 13/41)

"index.php" contain malicious codes that exploit

-Office Snapshot Viewer CVE-2008-2463

-MDAC CVE-2006-0003

"iframe.html" actually contain code that exploit "MS Internet Explorer XML Parsing Buffer Overflow Exploit" according http://www.milw0rm.com/exploits/7477

--X0end